VulnHub

Real-time Cybersecurity News

Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws

The Hacker News

Overview

Anthropic has announced that it is broadening access to its AI models for selected cybersecurity professionals. This move allows these vetted teams to conduct tests with fewer restrictions, aiming to enhance security measures. The company also reported significant findings from its Project Glasswing initiative, revealing at least 129,000 verified software vulnerabilities discovered between April and July 2026. This large number of vulnerabilities indicates a pressing need for companies to address security flaws in their software. The initiative underscores the ongoing challenges in securing software systems and the importance of proactive measures by cybersecurity teams.

Key Takeaways

  • Affected Systems: Software applications and systems tested under Project Glasswing
  • Action Required: Companies should review and patch vulnerabilities identified in their software.
  • Timeline: Disclosed on [October 3, 2023]

Original Article Summary

Anthropic on Tuesday said it's expanding a program that allows vetted cybersecurity professionals to test its advanced artificial intelligence (AI) models with reduced safeguards and blocking classifiers, as the company claimed its Project Glasswing initiative uncovered at least 129,000 verified software vulnerabilities between April and July 2026. The company said it also found an additional

Impact

Software applications and systems tested under Project Glasswing

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Disclosed on [October 3, 2023]

Remediation

Companies should review and patch vulnerabilities identified in their software.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

The Hacker News

Cybersecurity researchers have uncovered a malicious campaign involving npm packages that has been distributing information stealers and remote access trojans (RATs). Codenamed MALFEX, this operation has been linked to a single threat actor who has published 12 different packages since August 2023, with eight of them being identified as harmful. These malicious packages have been downloaded over 40,000 times, potentially compromising the systems of numerous developers and organizations using npm for package management. The presence of the Overlord RAT and other malware poses serious risks, including data theft and unauthorized access to users' systems. Developers and companies using npm should be vigilant and ensure they are not using any of these compromised packages.

Oct 7, 2026

SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances

The Hacker News

SonicWall has issued hotfixes for four vulnerabilities in its SMA1000 appliances, which are used to facilitate remote access to corporate networks. The most critical flaw has been rated a perfect 10.0 on the CVSS scale and allows attackers to send unauthorized requests through the appliance, potentially accessing internal functions without needing any login credentials. SonicWall has stated that there is currently no evidence that these vulnerabilities are being actively exploited. However, organizations using these appliances should prioritize applying the patches to safeguard their networks. This incident emphasizes the need for companies to regularly update their security appliances to defend against potential attacks.

Oct 7, 2026

Microsoft Outlook to block MSIX attachments starting November

BleepingComputer

Microsoft is set to block .msix and .msixbundle attachments in Outlook Web and the new Outlook Windows client starting in November. This change affects users who rely on these file types for application packaging and distribution. By blocking these attachments, Microsoft aims to enhance security and prevent potential misuse of these formats, which could be exploited by malicious actors. Users will need to explore alternative methods for sharing applications or consider using different attachment formats. This decision reflects ongoing efforts by Microsoft to protect its users from security risks associated with potentially harmful file types.

Oct 7, 2026

Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely

The Hacker News

A serious vulnerability has been discovered in LMCache, an open-source tool used to enhance the performance of large language model servers like vLLM. This flaw allows unauthenticated attackers to execute code on the cache server, posing a significant risk since there is no patch currently available to fix the issue. The problem arises specifically in LMCache's multiprocess mode, where it operates as a standalone server that communicates with LLM workers via the ZeroMQ messaging library. As a result, any server utilizing this software could be at risk of unauthorized access and potential exploitation. Organizations using LMCache should take immediate steps to secure their systems and monitor for any suspicious activity.

Oct 7, 2026

FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials

The Hacker News

The FBI and the Secret Service have issued a warning regarding the ongoing FortiBleed credential harvesting campaign, which targets Fortinet's FortiGate firewalls and SSL VPN gateways. This campaign has reportedly collected over 86,000 credentials, exploiting weaknesses in reused or leaked passwords and outdated password storage methods. Organizations using Fortinet products need to be vigilant, as attackers can gain unauthorized access to sensitive systems. The persistence of this threat highlights the importance of using strong, unique passwords and implementing robust security measures. Companies are urged to review their security protocols to protect against this active exploitation.

Oct 7, 2026

SonicWall warns of max severity SSRF flaw in SMA1000 gateways

BleepingComputer

SonicWall has issued urgent hotfixes to address a serious server-side request forgery (SSRF) vulnerability in its SMA1000 series appliances. This flaw, classified as maximum severity, could allow attackers to send unauthorized requests from the server, potentially exposing sensitive information or compromising internal systems. Users of the SMA1000 series should act quickly to apply these hotfixes to protect their networks. The vulnerability poses a significant risk, especially for organizations relying on these devices for secure remote access. Companies are advised to review their systems and ensure they are updated to mitigate any potential exploitation.

Oct 7, 2026