Cyber Bites

* npm Introduces Human Approval Gates to Counter Software Supply Chain Attacks

* Anthropic’s AI Model Finds Over Ten Thousand Critical Vulnerabilities in Global Software Infrastructure

* Anthropic’s Restricted Claude Mythos Model Moves Closer to Public Release

* AI Emerges as a Game-Changer in Cyber Defence, Australian Signals Directorate Reports

* Grafana Labs Confirms Ransomware Extortion Following TanStack Supply Chain Breach

* GitHub Confirms Internal Repository Breach After Employee Device Compromise

* Google Accidentally Exposes Details of Unpatched Chromium Vulnerability

* CISA Credentials Exposed in Public GitHub Repository for Six Months Before Takedown

* HackerOne Slashes Bug Bounty Payouts as AI Floods Open-Source Security Programs

* Signal Adds In-App Security Warnings to Combat Social Engineering Attacks

* Eighteen-Year-Old Vulnerability Discovered in Nginx Puts Millions of Web Servers at Risk

* OpenAI Confirms Security Breach Following Sophisticated Supply Chain Attack

* New Zero-Day Exploit Allows USB Stick to Bypass Windows BitLocker Encryption

* Agentic AI Is the Security Blind Spot Organisations Can No Longer Afford to Ignore

* Cybercriminals Abuse Amazon SES to Launch Undetected Phishing Campaigns

* ACSC Issues Warning Over ClickFix Attacks Deploying Vidar Stealer Malware

* Malicious OpenClaw Skill Weaponizes AI Agent Framework to Distribute Malware

* Survey Finds 1 in 8 Employees Consider Selling Company Login Credentials Justifiable

* 60% of MD5 Password Hashes Now Crackable in Under an Hour With a Single GPU

* Critical Linux “copyfiles” Vulnerability Grants Root Access on Major Distributions

* Critical cPanel & WHM Authentication Bypass Vulnerability Actively Exploited in the Wild

* Google Patches Maximum Severity CVSS 10 Flaw in Gemini CLI Amid Growing AI Tool Vulnerabilities

* KnowBe4 Research Reveals 86% of Phishing Attacks Are Now AI-Driven

* New “ClawHub” and “ClawSwarm” Malware Campaigns Target AI Agents for Crypto Recruitment

* Claude Desktop Raises Privacy Concerns Over Silent Browser Extension Installation

* Apple Patches iOS Bug That Preserved Deleted Notification Data

* Microsoft Teams Becomes Prime Target for Helpdesk Impersonation Scams

* Malicious Cryptocurrency Wallet Apps Infiltrate China’s Apple App Store

* Anthropic Mythos Discovered 271 Security Vulnerabilities in Firefox

* Booking.com Confirms Data Breach Exposing Millions of Travellers’ Reservation Details

* Adobe Issues Emergency Patch for Actively Exploited Acrobat Reader Zero-Day

* Critical Nginx UI Flaw Under Active Exploitation, Enabling Full Server Takeover Without Authentication

* WordPress Plugin Suite Backdoored, Thousands of Sites Silently Compromised Since August 2025

* OpenAI Unveils GPT-5.4-Cyber, a Defensive AI Model Purpose-Built for Security Teams

* Australia’s Critical Infrastructure Security Laws (SoCI) Branded “Toothless” as Review Calls for Urgent Overhaul

* Hacker Claims Breach of US Law Enforcement Tip Platform, Exposing Over 8 Million Confidential Reports

* TeamPCP Supply Chain Attack Hits Widely Used AI Tool, Exposing Millions of Systems

* TeamPCP Turns Its Hacking Tools Toward Iran, Deploying Data-Destroying Wiper Malware

* Enterprise PCs Found Lagging Behind Macs on Security Patching, New Report Reveals

* Researchers Exploit AI Browser Reasoning to Train Self-Optimizing Phishing Scams in Under Four Minutes

* Meta Collaborates with International Law Enforcement to Dismantle Southeast Asian Scam Operations, Disables 150,000 Accounts

* Malicious npm Package Impersonates OpenClaw Installer to Deploy Remote Access Trojan and Harvest macOS Credentials

* Microsoft Teams Phishing Campaign Deploys Backdoors to Target Employees

* Google’s Cloud Threat Horizons Report: Attackers Exploit Cloud Vulnerabilities More Than Weak Credentials

* New South Wales Criminalises AI-Generated Deepfakes and Non-Consensual Intimate Content

* DJI Romo Robot Vacuums Exposed Thousands of Devices Through Critical Security Flaws

* Developer Faces $82,000 Bill After Stolen Google Gemini API Key Enables Massive Unauthorised Usage

* ClawJacked Vulnerability Allows Malicious Websites to Hijack Local OpenClaw AI Agents via WebSocket

* Hacktivist Groups Launch 149 DDoS Attacks Against 110 Organisations Following Middle East Military Operations

* Iranian Threat Actors Launch Hundreds of Attacks Against IP Surveillance Cameras Across Middle East