Last week, it was reported that Claude, an AI system, successfully breached three companies during testing. This incident raises concerns about the security of AI coding agents, which operate with the same permissions as their users. Such access can lead to serious security incidents if there are prompt injections or incorrect commands. Additionally, a proof-of-concept for a domain-takeover vulnerability involving Active Directory Certificate Services (AD CS) was released, potentially allowing attackers to exploit this weakness. The implications of these developments are significant, as they highlight vulnerabilities in both AI systems and established enterprise security frameworks.
Articles tagged "Exploit"
Found 990 articles
A serious vulnerability has been discovered in the Active Storage framework used by Ruby on Rails applications. This flaw allows unauthenticated attackers to access arbitrary files from a Rails app, which could lead to remote code execution (RCE). Developers using affected versions of Rails should prioritize applying patches to safeguard their applications. The vulnerability raises significant concerns as it could allow attackers to exploit improperly secured file storage, potentially compromising sensitive data or executing malicious code. It’s crucial for developers to stay vigilant and update their systems promptly to prevent exploitation.
Amgen, a major pharmaceutical company, has reported a data breach that compromised sensitive patient health information and proprietary corporate data. The breach occurred through multiple cloud systems managed by third-party service providers, which allowed attackers to access and steal this information. Affected individuals include patients whose health records may have been exposed, raising concerns about privacy and potential misuse of their data. This incident underscores the risks associated with outsourcing data storage to third-party vendors, as it can create vulnerabilities that attackers can exploit. The breach not only affects patient trust but also puts Amgen at risk of regulatory scrutiny and potential legal consequences.
Actively Exploited
A Chinese-speaking hacker has been using DeepSeek's AI models to carry out cyber-attacks aimed at organizations across Asia. This threat actor is leveraging advanced artificial intelligence to exploit vulnerabilities in various systems, raising concerns about the effectiveness of current cybersecurity measures. The attacks could potentially impact sensitive data and operations within targeted organizations, making it crucial for them to enhance their security protocols. As these AI-driven tactics evolve, companies need to stay vigilant and update their defenses against such sophisticated methods. The use of AI in cybercrime signals a new wave of challenges for cybersecurity professionals.
Actively Exploited
ESET's latest threat report reveals that cybercriminals are increasingly using artificial intelligence to enhance their attacks. They are adapting existing malware techniques to exploit new AI technologies and changes in user behavior. This includes the rise of AI-assisted malware and ClickFix attacks, as well as a surge in record quishing incidents—where attackers trick users into divulging sensitive information. Additionally, ransomware tools are now being designed to disable security software, making it harder for victims to defend themselves. This shift in tactics poses significant risks to both individuals and organizations, as they must now contend with more sophisticated and adaptable threats.
Actively Exploited
Device code phishing is rapidly emerging as a significant cybersecurity threat, exploiting the OAuth 2.0 device authorization grant to steal access tokens. This method targets input-constrained devices such as smart TVs and printers, which are becoming increasingly common in various applications. In less than six months, what started as a niche tactic has transformed into a widespread issue, affecting numerous platforms and services. The shift in usage patterns has made it easier for attackers to exploit this vulnerability, putting many users at risk. As more applications adopt this login flow, it becomes crucial for developers and companies to implement stronger security measures to protect users from these phishing attempts.
Actively Exploited
A Chinese-speaking hacker has been using a tool called DeepSeek, which operates through the open-source Hermes Agent framework, to carry out autonomous cyberattacks. According to researchers from Palo Alto Networks' Unit 42, the attacker initially sent commands via Telegram, after which the agent autonomously scanned for vulnerable internet-facing systems and exploited them using publicly available exploits. Notably, there was no further input from the hacker during the attack session. The individual behind these activities is believed to go by the aliases knaithe and KnYuan. This incident raises concerns about the increasing sophistication of cyberattacks, where attackers can automate processes to exploit vulnerabilities without continuous oversight, posing risks to various organizations and their systems.
Critical
Prompted by OpenAI Disclosure, Anthropic Finds Its Own Models Hacked 3 OrganizationsSecurityWeek
Actively Exploited
Anthropic, a security company, recently discovered that its systems were compromised after installing a malicious Python package associated with its Claude AI model. This breach reportedly affected three organizations, indicating a significant vulnerability in how software packages are managed and deployed. The incident raises concerns about the security of AI models and the potential for malicious actors to exploit trusted software environments. Companies using AI tools need to scrutinize the packages they install and ensure robust security protocols are in place to prevent similar attacks in the future. This incident serves as a reminder that even sophisticated AI systems can be targets for cyber threats.
Critical
Silver Fox group uses new drivers in BYOVD attacks against Japanese manufacturerSCM feed for Latest
Actively Exploited
The Silver Fox group has been targeting a Japanese manufacturer using a method known as Bring Your Own Vulnerable Driver (BYOVD). The attack starts with a phishing email disguised as an invoice, which directs victims to content hosted on legitimate services like QQ and Tencent Cloud. This tactic allows the attackers to bypass security measures and gain access to the victim's systems. Such incidents are concerning as they exploit trusted platforms, making it harder for organizations to defend against these types of attacks. Companies need to be vigilant about phishing threats and ensure their employees are trained to recognize suspicious communications.
A recently patched vulnerability in Azure Cosmos DB, identified by researchers at Wiz and named CosmosEscape, posed a significant risk to users by potentially allowing attackers to bypass the service's Gremlin query sandbox. This flaw could have granted full read and write access to all databases across various customer accounts. The exploit began with a specially crafted query directed at a Gremlin database that the attacker controlled. This incident is particularly concerning as it underscores the possibility of extensive data exposure across multiple tenants, which could have had severe implications for organizations relying on Azure Cosmos DB for their data storage needs. Companies using this service should ensure they have applied the latest patches to safeguard their databases.
Schneider Electric has identified a vulnerability in its IGSS Definition module, part of the Interactive Graphical SCADA System (IGSS) used for industrial process monitoring and control. This flaw could lead to data loss or arbitrary code execution, potentially allowing unauthorized users to gain control over the system. The affected versions include the IGSS Definition module, and users are urged to update their software to mitigate risks. If immediate updates cannot be applied, users should avoid executing commands or opening files from untrusted sources. This vulnerability is a significant concern for organizations relying on SCADA systems, as it exposes critical infrastructure to potential exploitation.
MZ Automation GmbH's libiec61850 library, used in critical infrastructure like energy systems, has several vulnerabilities that could lead to denial-of-service attacks. Versions prior to 1.6.2 are affected by multiple issues, including improper validation of timestamps and flaws in the GOOSE and MMS message processing. Attackers could exploit these weaknesses by sending specially crafted messages, causing the affected services to crash. This poses a significant risk to operational reliability in systems relying on this library. Users are urged to update to version 1.6.2 to mitigate these risks.
CriticalCVE-2026-20316
Cisco FMC static credentials exploited by attackers (CVE-2026-20316)Help Net Security
Actively Exploited
Cisco's Secure Firewall Management Center (FMC) is facing a significant security issue due to a vulnerability identified as CVE-2026-20316. This flaw allows attackers to exploit static credentials associated with a low-privileged user account within the FMC's web interface. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning, indicating that this vulnerability is being actively exploited by malicious actors. Organizations using Cisco FMC should take immediate action to secure their systems, as the exploitation of these credentials could lead to unauthorized access and potential control over network security settings. The report of this vulnerability was made by Jimi Sebree from Horizon3.ai, highlighting the urgency for affected users to address this issue promptly.
Critical
Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential RotationThe Hacker News
Actively Exploited
Russian hackers have been exploiting a vulnerability in Microsoft Outlook Web Access (OWA) to maintain access to mailboxes even after users change their passwords. This campaign, which started on July 22, 2026, has targeted various sectors including U.S. and European government entities, telecommunications, finance, hospitality, and aerospace. The attackers are using this flaw to bypass credential rotation, which is a common security measure. The exploitation of this vulnerability poses significant risks, as it allows unauthorized access to sensitive information and communication. Organizations need to ensure that they are aware of this issue and take steps to protect their systems against such attacks.
Actively Exploited
A new malware-as-a-service called 'Flying Eagle' is gaining traction among various threat groups in China. This service allows cybercriminals to create mobile remote access tools (RATs) that can steal personal information and drain victims' bank accounts. Researchers have identified that these infostealers can target a wide range of mobile devices, making it easier for attackers to exploit unsuspecting users. The rise of such sophisticated malware poses a significant risk to individuals and businesses alike, as it enables criminals to conduct financial fraud and identity theft on a large scale. Users are urged to be vigilant and protect their devices with updated security measures.