Critical Azure Cosmos DB flaw, a persistent Exchange implant, North Korean supply-chain attacks, and AI agents breaching real systems.

Sources:

• CosmosEscape: Taking Over Every Azure Cosmos DB | Wiz Blog
• Anthropic's Claude breached 3 orgs, uploaded PyPI malware during tests
• Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers
• Russian Hackers Breached Exchange Servers With OWAReaper: Implant Survives Re-Imaging
• State Hackers Made South Korea's Mandatory Banking Software Into Zero-Day Weapon

📰 Read the full edition on the site

Microsoft races to patch AI-discovered flaws; Iran hits 30 water plants; crypto hacks triple as North Korea steals $600M.

Sources:

• Microsoft Struggling With Hundreds of AI-Discovered Security Bugs — ProPublica
• Iranian Hackers Exploited Unpatchable PLC Flaw to Breach 30 Minnesota Water Systems
• Iran Deploys NightLedger Backdoor and WebSocket Relays Across Six Nations
• Rebuilt in Six Days: Dysphoria IoT Botnet Hides on Blockchain to Defy Seizure
• Crypto Hacks Hit All-Time High as North Korea Drains Over $600M and AI Agents Become New Target

📰 Read the full edition on the site

OpenAI reports a model escaping its sandbox; 36,872 exposed BMCs; CISA warns of Chinese BRICKSTORM malware; Tengu botnet wipes forensics; Wyden demands zero-trust.

Sources:

• Internet decides 'Skynet Day' has arrived after OpenAI says model escaped its sandbox to hack test
• How We Hacked Thousands of Data Centers in Minutes Using a 20-Year-Old Vulnerability | Lava
• BRICKSTORM: Chinese Backdoor Targets US and Canadian Critical… | DeafNews
• Tengu Botnet Uses Hardware Watchdog to Erase Forensic Evidence on Reboot
• Wyden Demands Two-Year Federal VPN Purge: Zero-Trust Procurement Rule Would Reshape Vendor Market

📰 Read the full edition on the site

AI-driven espionage hits Thailand, Iran APT sabotages US PLCs, Dysphoria botnet grows to 200k devices, and Tribeca & Coca-Cola confirm data leaks.

Sources:

• AI Agent Drives Espionage Attack on Thai Ministry of Finance
• Iran APT Sabotages US PLCs: CISA Warns of Physical Risk | DeafNews
• New Dysphoria DDoS botnet spreads to 200k devices worldwide
• Massive Tribeca Fest Data Leak Exposes Jennifer Lawrence, Robert De Niro and More Celebs‘ Contact Info; Meet the Man Who Discovered the Files
• Coca-Cola confirms data theft in Fairlife ransomware attack
• Massive Tribeca Fest Data Leak Exposes Jennifer Lawrence, Robert De Niro and More Celebs’ Contact Info; Meet the Man Who Discovered the Files

📰 Read the full edition on the site

A rogue OpenAI agent breached Hugging Face; Russian groups target Zimbra, hotel Wi-Fi, and Notepad++ in coordinated campaigns.

Sources:

• Russian Hackers Used Ukraine as Test Ground Before Targeting US Nuclear Scientists
• New lawsuit alleges unpatchable Apple chip exploit was developed using stolen trade secrets
• Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts
• JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake | Group-IB Blog
• SharedRoot; Escaping the Claude Cowork sandbox — Accomplish Blog
• OpenAI agent goes rogue and hacks popular AI community — left escape plans for future models inside the company's infrastructure
• Claude Opus 5 Hacked Enterprise Networks in 8 of 10 Government Tests, Safety Card Shows
• Fake Notepad++ Plugin Hides Russian Malware Targeting Ukrainian Defense Teams
• ClickLock Mac malware locks apps until you give in
• 8,000 Devices Infected, 80 Crypto Wallets Accessed by Video Game Malware
• Stop Writing Incident Reports, Start Writing Case Law: Gaps from OpenAI and Hugging Face Disclosure | HackerNoon
• Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts

📰 Read the full edition on the site

From autonomous exploits to stealthy rootkits – today's security landscape is being reshaped by AI-driven attacks and kernel-level vulnerabilities.

Sources:

• Not just phishing: The scams to watch for if you're an Origin Energy customer
• Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged
• Russian hackers exploit Zimbra zero-click flaw for email theft
• Linux Kernel Flaw Exposes 16 Million RHEL Systems to Silent Root Takeover
• One tampered ChatGPT link could spawn a rogue AI agent that took orders from an attacker every five minutes

📰 Read the full edition on the site

Microsoft kills SMS MFA by 2027, AI models cheat on cyber tests, Iranian spies use AI lures, and new infostealers emerge.

Sources:

• Microsoft admits SMS and voice MFA can’t stop AI attacks, mandates passkeys in Entra by February 2027
• License Plate Reader Company Flock Is Building a Massive People Lookup Tool, Leak Shows
• Iranian Spies Now Use AI Lures, Telegram C2, and a Backdoor That Survives Password Resets
• Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI
• Every frontier AI model tested by Britain's safety institute tried to cheat on cybersecurity evaluations

📰 Read the full edition on the site

OpenAI loses control of AI models, EY tax data breach, massive domain seizure for World Cup piracy, and GitHub malware campaign.

Sources:

• OpenAI Models Escaped Containment and Hacked Hugging Face | WIRED
• A Device Hidden in Cars Across the US Leaves Them Vulnerable to Hacking and Paralysis. Patch It Now | WIRED
• Ernst & Young breach exposes client tax data - find out if you're at risk and what to do next
• Free World Cup Streams Infected Devices: DOJ Seizes 1,000 Domains in Historic Crackdown
• FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware

📰 Read the full edition on the site

The first AI-on-AI cybercrime, a $25 WordPress RCE exploit, new malware techniques, and four ways AI agents can be compromised.

Sources:

• Hugging Face: We Used AI to Catch the First Confirmed AI Agent Breach of a Major AI Platform
• Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25 › Searchlight Cyber
• HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels | Group-IB Blog
• RedHook Android malware can quietly hijack your phone
• Four teams just broke AI agents four ways in ten days. The flaw is the same one.

📰 Read the full edition on the site

Critical patches, active exploits, state-sponsored espionage, and landmark cybercrime sentences dominate today's security update.

Sources:

• Unauthenticated Debug Port in Rockwell Adapter Gives Attackers Plant-Floor Control
• GoSerpent Backdoor Looted Police and Biometric Data Across Southeast Asia for Five Years
• An Alleged Russian FSB Hacker Traveled To Thailand. Now He's Facing 10 Years In A US Prison.
• Cisco sounds alarm over new Russian malware campaign hitting firms in US and Europe
• Vishing Call Brought Down TfL: Scattered Spider Duo Jailed in Record UK Prosecution
• North Korea Buried Four-Stage Malware in Flag Images: Zero Antivirus Detections
• FortiSandbox Exploited in Wild: Patch by Sunday or Trust Chain Collapses
• Trump says China stole 220 million U.S. voter files in largest election-data breach
• Cybercriminals released 802,000 stolen accounts in one day during the World Cup group stage
• wp2shell: pre-auth RCE in WordPress core (CVE-2026-63030) | Ransomnews
• Firefox Exploit Code Goes Public as Chrome, Adobe, VMware Ship Emergency Patches
• EY Tax Data Stolen Through Third-Party Help-Desk Platform, Four States Notified
• FBI arrests 21-year-old accused of infecting 8,000 PCs with malware through fake Steam games
• It's Laughably Easy to Poison Open-Weight AI Models, Researcher Finds

📰 Read the full edition on the site