The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added several vulnerabilities in the Linux Kernel to its Known Exploited Vulnerabilities catalog. This update indicates that these flaws have been identified as actively exploited in the wild, posing risks to various systems that rely on the Linux operating system. While specific details on the nature of the exploits are not currently available, the inclusion of these vulnerabilities in the catalog signals a need for immediate attention from system administrators and security teams. Users and organizations utilizing affected Linux versions should prioritize patching their systems to mitigate potential attacks, as these vulnerabilities could be leveraged by attackers for unauthorized access or other malicious activities. Staying updated with the latest patches is crucial for maintaining system security.
A new malware campaign is targeting users of the npm package manager, specifically through a malicious package named 'indexed-btree'. Unlike traditional attacks that insert harmful code into installation scripts, this campaign cleverly embeds malicious behavior within the normal runtime operations of the package. This method allows attackers to bypass common security defenses that monitor installation scripts. As a result, developers who unknowingly install this package could face serious security risks, including potential data breaches or system compromise. It’s crucial for developers to be vigilant and scrutinize the packages they use, as traditional safeguards may not catch these types of attacks.
An AI-generated intelligence report nearly escalated tensions between the US and China during the Iran war by falsely claiming that a Chinese ship was transporting nuclear weapons components. According to sources cited by CNN, this misleading report circulated among US military officials, prompting discussions about a potential military operation in response. Fortunately, the situation was defused before any action was taken. This incident raises serious concerns about the reliability of AI in military intelligence and the potential for misinformation to provoke international conflict. As AI technology becomes more integrated into defense systems, ensuring accuracy and accountability in its outputs is crucial to prevent dangerous misunderstandings.
The latest Malware Newsletter from Security Affairs reveals several significant cybersecurity threats. One incident involves a malicious browser extension targeting Twitch users, which has exposed OAuth tokens of around 30,000 individuals to Russian bots. Another report details a campaign called 'Red Heron' that exploits a known vulnerability in Gitea, allowing attackers to deploy a new Linux rootkit. Additionally, researchers discuss a one-click backdoor known as 'Gray Rabbits' that poses risks to systems. These incidents underscore the growing sophistication of malware and the need for users and organizations to remain vigilant against such threats.
Researchers have successfully escaped the sandbox environment of OpenAI's Codex, allowing them to execute commands on a developer's machine. They achieved this through two different methods, even when operating in the most restricted mode of the Codex. OpenAI has since addressed these vulnerabilities with patches. This incident raises concerns about the security of AI development environments and the potential risks they pose if exploited by malicious actors. Developers using Codex should be aware of these vulnerabilities and ensure they are using the latest patched versions to mitigate risks.
Last week, Revolut confirmed a data breach involving sensitive customer records. The breach occurred when an attacker impersonated a government agency, using an email address from that agency's domain to gain unauthorized access to the bank's systems. This incident raises significant concerns about the security of customer data and the effectiveness of identity verification processes in preventing such impersonation attacks. Meanwhile, Cisco released a patch for a zero-day vulnerability in its email gateway that had been actively exploited. This highlights ongoing challenges in cybersecurity, where organizations must remain vigilant against both social engineering tactics and technical vulnerabilities.
A new attack method called BragJack has been demonstrated by Gal Weizman from Forever Security. This proof-of-concept attack targets AI browser agents in popular web browsers, including Chrome, Edge, and Opera Neon, by using a single malicious extension. The technique, known as Prompt Forcing, allows attackers to manipulate AI assistants, potentially leading to unauthorized actions or data exposure. Researchers have reported this vulnerability, which has already resulted in over $20,000 in bounties and two Common Vulnerabilities and Exposures (CVEs). Users of these browsers need to be aware of this threat, as it could compromise their interactions with AI tools.
A North Korean hacking group known as WaterPlum has reportedly compromised at least 30,000 devices globally between December 2025 and July 2026. The attackers managed to siphon off over $10.7 million in stolen cryptocurrency, transferring the funds back to North Korea. The joint advisory from law enforcement agencies indicates that these infections could potentially affect a wide range of devices, leading to significant financial losses for victims. This incident underscores the ongoing risk posed by state-sponsored cybercriminals, who continue to target both individuals and organizations worldwide. Users and companies alike should remain vigilant and consider enhancing their cybersecurity measures to protect against such sophisticated attacks.
The ShinyHunters extortion group has successfully hacked into the Clop ransomware operation's data leak site, which is hosted on the Tor network. They defaced the site and reportedly stole sensitive information, including server data and the private keys for the onion service. This breach is significant because it exposes vulnerabilities within the Clop operation, which has been known for its ransomware attacks. By targeting Clop, ShinyHunters may be attempting to assert dominance within the cybercrime world, potentially leading to further infighting among ransomware groups. This incident raises concerns about the ongoing battle between rival gangs and the implications for victims of ransomware attacks, as it could affect negotiations and payouts in future incidents.
Spear phishing is a targeted form of phishing where attackers impersonate a trusted source to deceive individuals into providing sensitive information, such as login credentials or financial data. This method often involves detailed research on the victim to make the communication appear legitimate. Organizations and individuals can be affected, leading to data breaches, financial loss, and reputational damage. Prevention strategies include employee training to recognize phishing attempts, implementing multi-factor authentication, and using advanced email filtering systems. Staying vigilant and informed about these attacks is essential to protect sensitive information.
Researchers from Hacktron recently demonstrated the ability to exploit a vulnerability in Discourse, a popular forum software, to hijack accounts belonging to OpenAI staff. This attack was notable as it bypassed traditional methods like phishing or leaked passwords, instead using an image upload feature to gain access. Within 72 hours, the researchers managed to take control of accounts associated with OpenAI's ChatGPT and Codex, raising concerns about the security of shared single sign-on (SSO) systems. The incident serves as a reminder of the potential risks associated with vulnerabilities in widely-used platforms and the importance of robust security measures for managing sensitive accounts. Companies using SSO should review their security practices to prevent similar incidents.
Three researchers from Hacktron successfully exploited vulnerabilities in OpenAI's security systems using Anthropic's Claude Opus 5. They first identified a bug in OpenAI's public help forum software, which allowed them to bypass security measures in OpenAI's login system. As a result, they gained access to the ChatGPT and Codex accounts of multiple OpenAI employees and reached an internal code repository. This incident raises concerns about the security of employee accounts and the integrity of internal code, highlighting the importance of addressing software vulnerabilities in major tech companies.
SolarWinds has issued security updates to fix a serious vulnerability in its Access Rights Manager (ARM) software. This flaw, identified as CVE-2026-28326, allows attackers to execute code remotely without authentication, posing a significant risk to users. The vulnerability is rated 8.8 out of 10 on the CVSS scale and affects all versions of ARM up to 2026.2. Users of this software should prioritize applying the latest patches to protect their systems from potential exploitation. Given the nature of the flaw, it is crucial for organizations to act swiftly to secure their environments.
In May 2026, Google's Gemini AI model inadvertently accessed the systems of various companies during a cybersecurity evaluation conducted by the Israeli firm Irregular. This incident, which was first reported by The Wall Street Journal, involved a mix-up with test domains that allowed Gemini to breach security measures at real organizations. The consequences of this oversight could be significant, as it raises concerns about the security protocols surrounding AI technology and its testing processes. Companies involved in the evaluation now face potential data exposure and vulnerabilities due to these unintentional breaches. The situation emphasizes the need for stricter controls and oversight when deploying AI systems in real-world environments.
On May 22, CrowdSec reported that an attacker accessed and copied around 170 of its private GitHub repositories. The breach occurred through the account of a former employee whose GitHub access had not been revoked. This incident is linked to a supply chain attack on TanStack, where compromised npm packages were used to steal credentials. CrowdSec's failure to deactivate the employee's access after their departure allowed the attacker to exploit this oversight. This incident raises concerns about employee access management and the potential risks associated with supply chain vulnerabilities in software development.