Cyber Bites

* AI Assistant Autonomously Hacks Gym Booking System in First Known Australian Case

* ASD and AICD Warn Boards That Frontier AI Is Fundamentally Reshaping Cyber Risk

* Developers Report Widespread Security and Privacy Failures in AI Coding Tools

* AI Vibe Coding Is Flooding App Stores With Low Quality Software While Downloads Barely Budge

* GitHub Adds Three Day Cooldown to Dependabot Version Updates to Counter Supply Chain Attacks

* JFrog Confirms OpenAI AI Models Exploited Artifactory Zero-Day During Benchmark Escape

* Origin Energy Data Breach Affects 900,000 Current and Former Customers

* ClaudeBleed Revisited: Security Researchers Find Anthropic’s Chrome Extension Fix Remains Incomplete

* OpenAI AI Models Autonomously Hacked Hugging Face During Benchmark Testing

* Critical WordPress Vulnerabilities Actively Exploited to Deploy Webshells and Rogue Admin Accounts

* AI Agent Connectors Silently Expand Attack Surface as Third-Party Integrations Shift Beneath Security Teams

* Cyberattack on Partnered Health Exposes Sensitive Patient Data Across 21 Australian Clinics

* Australian and Allied Agencies Warn of Russian State-Sponsored Targeting of Routers and Network Devices

* Australian Signals Directorate Warns Organisations to Embrace AI Model Harnesses as Cyber Threat Landscape Shifts

* ClickLock: New macOS Stealer Holds Victims’ Desktops Hostage Until They Hand Over Their Password

* ACSC Issues Second Warning in Two Months Over Unpatched CMS Vulnerabilities Being Actively Exploited

* OpenMandriva Linux Hit by Internal Sabotage Attempt from Former Contributor

* China Warns Developers to Uninstall Claude Code Over ‘Backdoor’ Data Collection Fears

* Phishing Campaign Impersonates Major Global Brands to Steal Gmail Credentials

* Massive Automated Password Spray Attack Against Microsoft Azure Compromises 78 Accounts Across 64 Organisations

* Apple’s Hide My Email Service Has Been Leaking Real Email Addresses for Over a Year Despite Being Reported

* Anthropic to Restore Claude Fable Access After Export Control Suspension

* Microsoft Introduces Smarter Bot Protection in Microsoft Teams Meetings

* Malicious Websites Are Embedding Hidden Instructions to Hijack AI Agents Through Indirect Prompt Injection

* Fake ABC News Website Scam Using Facebook Ads to Defraud Australians of Hundreds of Thousands of Dollars

* Five Eyes Cyber Chiefs Issue Urgent Joint Warning: AI Is Reshaping Cyber Risk Faster Than Anyone Anticipated

* Anthropic’s Mythos AI Model Found Vulnerabilities in Classified US Government Systems Within Hours

* WhatsApp Phishing Attack Uses Fake Business Documents to Compromise PCs

* New macOS ClickFix Attack Silently Mounts Disk Images to Deploy Information-Stealing Malware

* Malicious JetBrains Marketplace Plugins Discovered Stealing AI API Keys from Developers

* A Three-Stage Vulnerability Chain Turning Microsoft 365 Copilot Into a Silent Data Exfiltration Weapon

* The Digital Trove: How a Single Hack Exposed One Man’s Entire Life and Why We’re All Vulnerable

* FIFA Bug in World Cup Streaming Infrastructure Opened Door to Remote Takeover

* Passkeys vs Passwords: Readers Debate Whether a Smartphone PIN Can Really Be Safer Than a Complex Password

* GitHub Announces Sweeping npm Security Overhaul to Combat Supply Chain Attacks

* Anthropic Rolls Out Claude Fable 5 in Limited-Time Free Release Before Usage-Based Pricing Kicks In

* OpenClaw AI Agent Found Vulnerable to Phishing Attacks, Leaking Sensitive User Data

* Apple Introduces Automatic Password Changing Feature for Compromised Credentials

* Anthropic Expands Claude Mythos Preview Access to Australian Organisations Through Project Glasswing

* Cybercriminals Exploit ChatGPT Share Links to Distribute Malware Via Fake Outage Pages

* Google Chrome Bolsters Security With Session Cookie Theft Protection for All Users

* Hackers Exploit Meta’s AI Support Bot to Hijack High-Profile Instagram Accounts

* Critical HTTP/2 Bomb Vulnerability Exposes Major Web Servers to Remote Denial-of-Service Attacks