THEMETASEC

TThe Hacker News Vuln

A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats

A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category.

TThe Hacker News General

Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%

Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44

Choosing a WAAP in 2026: 3 questions that separate the shortlist

One platform or four Your WAF renewal is coming up. The API team has its own tooling in mind, the fraud team wants a bot product, and someone in networking owns DDoS. Four controls, four consoles, four sets of policies in front of the same applications. That is the situation a Web Application and API Protection platform, or WAAP, exists to replace: one service in front of the application portfolio that handles the WAF, API security, bot management, DDoS, and client-side script protection together. The category is settled. What changed in 2026 is the evidence. Buyers now have certified test data that measures how well these platforms stop attacks and how often they stop legitimate traffic by mistake, and the two numbers together tell you more than any feature list. What the test data shows The SecureIQLab Cloud WAAP v5.0 validation, an AMTSO-certified test published in August 2026, ran 12 enterprise platforms through 1,608 attack scenarios and 1,487 legitimate-traffic scenarios. Complete Security Scores ran from a perfect 100% for the top product down to roughly 61% for the weakest. The spread inside a typical shortlist is that wide, and a shortlist drawn up in 2023 or 2024 may no longer describe the products on it. The second number matters as much as the first. A platform that blocks every attack and also blocks legitimate requests cannot stay in blocking mode for long, and false positive avoidance varied almost as widely across the same twelve products. Those percentage points become alerts, tuning hours, and exceptions your team carries every day. 3 questions for every vendor on the list Ask for API coverage protocol by protocol. REST is one protocol among several in a modern estate; GraphQL, SOAP, WebSockets, and gRPC all carry production traffic, and the v5.0 results showed coverage varying widely by protocol inside a single product, with WebSockets the weakest area across the group. A headline API score hides that. Ask how long it takes to reach a tuned, low false-positive state on your traffic, and measure it over two full weeks of real traffic during the proof of value. Time to protection and tuning effort are the costs you pay after the contract is signed. Ask how the deployment and licensing model behaves as the portfolio grows. Each delivery model, SaaS, native in-cloud, or reverse proxy, has its own latency and onboarding profile, and each licensing unit, request, bandwidth, or application, bends the cost curve differently as traffic grows. Model 24 to 36 months of growth with each vendor, starting from your own traffic baseline. Where Imperva fits Imperva, part of Thales, delivers Cloud WAF, Advanced Bot Protection, API Security, DDoS Protection, and Client-Side Protection as one platform, with one policy model and one set of analytics across all of them, deployable as SaaS, on your own infrastructure, or natively inside the public cloud. In the SecureIQLab v5.0 cycle, Imperva was the only vendor of the twelve tested to record a perfect 100% Complete Security Score, and it paired that with a 100% false positive avoidance score, the lab’s measure of legitimate traffic passed untouched. It was Imperva’s fifth consecutive Leader-category placement in the series, and the lab awarded it the Secure by Default rating in the same cycle. Forrester named Imperva a Leader in The Forrester Wave™: Web Application Firewall Solutions, Q1 2025. An honest aside: no one platform suits every environment. If your dominant requirement is a developer-centric edge platform or raw DDoS scrubbing capacity above everything else, weigh those needs explicitly, and validate any shortlist, Imperva included, against your own traffic in a proof of value. The full comparison The complete buyer’s guide on the Imperva blog compares seven WAAP vendors on security efficacy, API protection, bot defense, operational efficiency, and cost, with analyst standing and verified peer ratings for each, and ends with a proof-of-value checklist you can take into your next evaluation. Read Best WAAP Solutions for Enterprise Application Security: How to Choose the Right Platform in 2026 before you renew anything. Then go back to the four consoles and decide how many you still need.

AI-generated code security shows first significant improvement in a year

According to Tech Radar, security in code generated by frontier artificial intelligence models has improved for the first time in a year, with vulnerability rates decreasing from 44% to 38%.

Anthropic files for initial public offering amid broader tech market volatility

Coverage from Silicon Angle indicates that Anthropic has officially filed paperwork for an initial public offering, marking a significant moment for the artificial intelligence industry.

Sophisticated malware targets government-specific windows systems in Asia

As noted by The Record, suspected nation-state hackers have developed sophisticated malware designed to target a customized version of Windows used by government agencies in Asia.

GCHQ faces scrutiny over lost storage drives and data handling failures

The Government Communications Headquarters is facing significant criticism after an annual report revealed that thousands of storage drives containing sensitive information have been lost for years, with further coverage provided by The Register.

Organizations face security risks from excessive AI autonomy

As reported by Tech Radar, businesses are increasingly delegating critical security decisions to artificial intelligence, creating significant vulnerabilities due to a lack of oversight and control.

Moldova investigates massive cyberattack on national identity infrastructure

As reported by Biometric Update, a significant cyberattack on the digital government infrastructure of Moldova has resulted in the exposure of personal data linked to approximately 750,000 national identification numbers.

Fake cryptocurrency trading app steals funds from Solana wallets

A malicious application named Padre Terminal, which previously appeared on the Apple App Store, was identified as a cryptocurrency drainer responsible for stealing approximately $23,000 from 27 Solana wallets, according to a recent report by Bleeping Computer.

China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days

Vapor Panda targeted more than 200 organizations spanning at least 14 countries, according to CrowdStrike. The ongoing campaign is remarkably successful and operating at shocking speed. The post China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days appeared first on CyberScoop.

Anthropic VS code extension on Cursor backdoored for nearly 12 hours

It's still unknown how attackers got access to Anthropic's verified Cursor account.

Mrfoofoo, Binance, Polymarket, Silent Train, robosurance, privacy, and Josh Marpet - SWN #629

A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices

Thanks to a lucky break, flawed code in a tainted Claude extension prevented the attacker from fully worming their way into some 5,000 developer machines.

DDark Reading General

Devs Hit by Trojanized Claude Code Extension for Cursor

Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).

Identifying election domain threats before they become attacks

Election domain research highlights impersonation risks and the need to distinguish threats from false alarms.

DDark Reading Policy

Behind the Scenes of How Operation Blackout Went Down

A recent law enforcement operation to dismantle harmful scam centers was a big success. A threat intelligence expert walks us through what happened and why he wants more of the same.

Drupal Commerce Core access bypass flaw exploited in attacks

Attackers exploit critical Drupal Commerce Core flaw to bypass access controls and manipulate orders.

Why identity governance demands executive attention

The identity landscape you’re responsible for looks nothing like it did just a few years ago. Employees and contractors now share the enterprise with service accounts, machine identities, and a fast-growing population of AI agents — all accessing business systems and data. Every one of those identities represents an access decision, and every access decision is now a potential point of accountability that lands on your desk. Regulators and boards want proof. They expect security leaders to show who, or what, has access to critical systems and how that access is being governed. But when human and nonhuman identities (NHIs) change faster than manual processes can keep up, proof becomes much harder to produce. Foundry research ranks identity security among the top cybersecurity priorities for 2026, reflecting a shift in how leadership views risk: Identity has evolved from operational detail to executive concern. “The last 15 years of digital transformation has resulted in credential sprawl across the tech stack of every organization,” says Bryan Kelley, AVP, Agentic Technology Specialists at SailPoint. “Whether it’s your own trusted agents or another organization’s rogue agent, they will find and abuse these exposed credentials, API keys, tokens, and secrets to carry out their given goals.” When accountability becomes personalSecurity leaders must demonstrate that identity governance is working, not simply that policies exist. They need a real-time view of each identity and the permissions it holds as business needs change. Leaders can also face personal and professional consequences when a breach or a compliance failure occurs. Boards and regulators may expect the C-suite to show that appropriate controls and oversight were in place at the time. AI agents add to that exposure as they gain access to enterprise resources and take on more autonomous roles. This is why NHIs need the same rigor, visibility, and controls as human identities. The shift to continuous compliance Quarterly or annual access reviews capture a moment in time, but it’s all the other moments in between that present a problem. Between reviews, employees can change roles, contractors can leave, and new identities such as AI agents can gain access. Security teams may not catch outdated permissions or active orphaned accounts until the next review. When identity data lives in separate systems, security teams struggle even more to maintain a current view of access across the enterprise. Continuous identity security makes oversight part of daily operations. Rather than waiting for the next review, an identity governance platform can help validate access as conditions change, automating low-risk approvals and flagging higher-risk access for review. Governance activity also creates an ongoing record of how access was approved and whether policies were applied consistently, so teams don’t have to reconstruct that history when auditors or regulators ask for evidence. Building an adaptive identity security programA continuous approach is made up of three core capabilities. First, organizations need to discover and unify identities to create a centralized view of access. Second, lifecycle management, policy enforcement, and access validation become always-on activities rather than periodic projects. Finally, organizations need to maintain evidence of governance activity so they can demonstrate compliance and respond when issues arise. This approach helps security leaders keep up with constant identity changes while meeting rising expectations for accountability. Learn how continuous identity security can help strengthen oversight and audit readiness.

Apple notifications alert victims in 99 countries about mercenary spyware infections

The notifications come shortly before the Pall Mall Process is nearing final negotiations on guidelines for the use of commercial hacking tools. The post Apple notifications alert victims in 99 countries about mercenary spyware infections appeared first on CyberScoop.

TThe Hacker News General

Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide

Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based "targeted intrusion adversary" it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in

California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment

Los Angeles County officials told CyberScoop they received multiple grand jury subpoenas investigating alleged election fraud. States and civil groups call it a federal power play. The post California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment appeared first on CyberScoop.

New Framework Puts Ransomware Resilience for AI Systems in Focus

RAID-AI aims to help organizations assess their security preparation for ransomware attacks targeting AI systems

DDark Reading Vuln

L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara

I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese.

Cloud incident response: what changes when you do not own the host

TThe Hacker News Breach

TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them

TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host. A malicious or compromised host can exploit the flaw to crash the viewer's TeamViewer and, depending on the platform, may also run

Defense contractor pleads guilty to aiding North Korean remote worker scheme

The 62-year-old allowed co-conspirators to use his identity and top secret security clearance to apply for almost 100 jobs last year. The scheme’s success rate was limited. The post Defense contractor pleads guilty to aiding North Korean remote worker scheme appeared first on CyberScoop.

CAASM and CMDB: two inventories that answer different questions

Measuring asset coverage across security tools

Centralized or federated cloud security: who owns the decision

A clean code review does not mean a safe runtime

Here are four ways to make exploitation harder and more expensive for attackers.

A data subject request is a discovery capability test

Syrian hacker who served Assad regime gets 42 months in US prison

Ahmad Umar Agha is best known for posting a fake Associated Press tweet claiming President Obama was injured in a White House bombing. The post Syrian hacker who served Assad regime gets 42 months in US prison appeared first on CyberScoop.

Japan Airlines data breach exposes 92,000 customer records

DDark Reading Vuln

Undead Software Projects Continue to Raise Security Risks

A security firm patched a decade-old app to prevent the takeover of millions of machines, highlighting that abandoned domains remain a boon to attackers.

TThe Hacker News Vuln

WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October

Security researcher discovers exposed database on civic engagement platform

Ransomnews identifies 18 billion files in publicly listable cloud buckets

Polymarket trading suspended following third-party supply chain attack

Pentagon investigates suspected cyberattacks on military base freezers

The Vulnpocalypse - Good News and Bad News

tl;dr The bad news is we are inundated with new vulnerabilities due to the increased volumes discovered by AI tooling. The good news is many organizations are starting to handle this with increased speed, prioritization, and existing methods of defense in depth. The bad news is there are also many organizations not doing this, and worse, are sitting on a whole ton of software, configuration, and structural/policy vulnerabilities from prior years. The good news is many of these targets have...

Anthropic AI model finds Linux kernel bug that leads to remote root access

Linux servers running Multipath TCP (MPTCP) could be vulnerable to remote code execution through a flaw in the kernel’s networking stack. Anthropic has disclosed a zero-click exploit developed with an unreleased Claude research model that allows an unauthenticated attacker to execute arbitrary commands as root, without requiring any user interaction. Tracked as CVE-2026-98432, the vulnerability is a race-condition-induced use-after-free (UAF) bug in the Linux kernel. Anthropic demonstrated how an attacker could exploit the flaw remotely to leak kernel memory, defeat Kernel Address Space Layout Randomization (KASLR), hijack kernel control flow, and ultimately execute an attacker-controlled shell command. The research is part of Anthropic’s broader effort to evaluate AI models’ ability to discover and exploit vulnerabilities in widely deployed software. The company disclosed five exploit chains involving Chrome, Safari, Android, Windows, and Linux to demonstrate how its internal model could combine multiple weaknesses into functional attacks. Anthropic’s proof of concept for the Linux exploit took approximately 53 minutes to progress from the initial memory leak to successful root-level command execution, the company said in a blog post. A TCP connection race leaves kernel memory exposed According to a Linux kernel CVE advisory, the underlying flaw involves how Linux manages IP options during IPv4 TCP connection establishment. When a new connection is created, the kernel can transfer ownership of IP options from a pending connection request to the newly created socket without making a separate copy. The problem arises when another CPU is simultaneously processing a retransmitted connection request and using those same options to construct a synchronize-acknowledge (SYNACK) response. If the child socket is freed before the second CPU finishes accessing the options, the kernel can end up reading memory that has already been released. This creates a use-after-free condition. The upstream fix addresses the memory-management problem by deferring the release of the affected objects until after a read-copy-update (RCU) grace period, giving concurrent readers time to finish accessing them. The flaw received a critical severity score of 9.8 and affects eight Linux kernel branches, dating back to version 4.4. Fixed releases include 5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7. For users who obtain Linux through distributions such as Debian, Oracle Linux, SUSE, and Amazon Linux, fixed kernel packages are available for at least some releases. Ubuntu and Red Hat Enterprise Linux, however, had yet to release patched kernels as of October 30. MCTCP listeners create the remote attack surface Anthropic’s exploit specifically targets Linux servers running an MPTCP listener. MPTCP extends conventional TCP by allowing a device to use multiple network interfaces simultaneously within a single connection. This enables bandwidth aggregation, improved network selection, and failover when one network path becomes unavailable. Linux implements MPTCP through its networking stack, but the protocol is opt-in: applications must explicitly request it when creating sockets, although mechanisms such as eBPF and other configuration techniques can also force applications to use it. Administrators are advised to review their kernel versions, apply the relevant security updates, and assess whether their systems expose MPTCP listeners.

TThe Hacker News General

Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis

A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported. Trezor has not yet examined the device. It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase. Trezor said in a blog post&nbsp

Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit

Dream found that a suspected Chinese-nexus actor gained root access to Palo Alto Network firewall servers to target government organizations

TThe Hacker News Policy

Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving

The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything.  Their concerns are practical. An IPS protection could block legitimate traffic. A configuration change could interrupt a service. An endpoint policy could affect an application

The $6.3 Billion Binance Hack Was Pulled Off in Just 20 Minutes

Multiple crypto-tracing firms say notorious North Korean hackers TraderTraitor may be behind the largest digital heist in history—with billions of crypto likely gone for good.

Binance Hit by Record-Breaking $6.3bn Hack in Largest Cryptocurrency Heist in History

Leading cryptocurrency analysts have attributed the cyber-attack to a North Korean elite hacking unit

TThe Hacker News General

Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison

Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets. The conspiracy was organized and led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence

Hackers leak personnel data of 41,000+ Homeland Security staff, including ICE and border agents

The US Department of Homeland Security has had the details of more than 41,000 staff, including ICE and CBP agents, published online. Not ideal for an organisation with "Security" in its name. Read more in my article on the Hot for Security blog.

Mistral open-sources AI model despite warning it could aid cyberattacks

A trillion-parameter AI model that its developer says could help attackers carry out real cyberattacks is now free to download, modify and run outside the developer’s control. Mistral AI released the open weights of Mistral Large 4, which it calls “Le Chonk,” on Thursday, weeks after putting the multimodal model into public preview. The Paris-based company said it had monitored cybersecurity-related use of the preview in live traffic. “Though we observed the model refusing to comply with black-box attacks against live targets, we see a potential for uplift to conduct real attacks,” the company wrote in a blog post announcing the release. Mistral is modifying the model’s guardrails and will keep updating them in the coming months, the post added. Guardrails stop at the API Those updates can reach only users of Mistral’s API and hosted services. Mistral did not say how those updates would apply to weights already downloaded. Its post says organizations can run and improve Large 4 on their own infrastructure without depending on Mistral to serve it through an API. Hugging Face, which hosts the weights, noted in its own launch post that open weights put both the usage policy and the deployment under the user’s control. In July, the UK’s AI Security Institute reported that leading open-weight models trailed the closed frontier on cyber tasks by four to seven months. For highly cyber-capable models, open release creates “a persistent and irreversible risk of misuse,” the institute said. Attackers are already putting open-source AI tooling to work. Earlier this month, Microsoft said a China-aligned group used the agentic AI framework ARTEX to target more than 2,250 Microsoft 365 tenants. Mistral says the released model can tell defensive work from malicious requests. According to the company, Large 4 refused 96.6% of malicious prompts in the cyber-related portions of the JailbreakBench, StrongREJECT, and AgentHarm benchmarks, the highest rate it has measured among open models. Niyati Daftary, principal analyst at Gartner, said security leaders should read that number narrowly. “Mistral’s 96.6% figure tells you what their model does in their test scenario, not how it will behave with your data, your adversarial use cases, or in production in your environment against motivated attackers,” she said. Mistral is handling a specialized cybersecurity variant differently. Design partners such as Orange Cyberdefense are getting preview access to a version optimized for penetration testing, vulnerability assessment, and red-teaming, the company said. Access is “subject to rigorous vetting and contractual safeguards,” the post said, and is limited to systems partners’ own or are authorized to test. Benchmarks and EU obligations The company said the model scored 51% on the Artificial Analysis Cyber Index, which measures how well a model finds, reproduces, and patches vulnerabilities. The chart in Mistral’s post shows two open-weight models, DeepSeek V4.1 Flash and MiMo-V2.6-Pro, scoring higher. Mistral also calls Large 4 the best open-weight model for coding, citing leading scores on Cognition’s FrontierCode 2.0 and Terminal-Bench 4.0. It has not yet published the technical report behind those results and has said only that one is coming soon. “Without a detailed technical report, the best open-weight model claim remains difficult to validate across workloads,” said Charlie Dai, vice president and principal analyst at Forrester. Dai added that frontier models are evolving so quickly that leadership “can shift within months or even weeks.” ENISA, the EU’s cybersecurity agency, said in a statement published with Mistral’s announcement that it is testing the model to identify vulnerabilities, audit code and analyze defensive logs. Under the EU AI Act, models trained with more than 10^25 floating-point operations (FLOPs) are presumed to carry systemic risk, according to the European Commission. Their providers must assess and mitigate those risks, report serious incidents and maintain cybersecurity protections. Mistral’s post does not say whether Large 4 falls into that category or what risk assessment preceded the release. What it means for enterprises Mistral released the model under a modified MIT license that permits use, modification, fine-tuning, and commercialization, the company said. Businesses running a model-as-a-service offering need a separate license. For those who would rather not host it, Mistral’s API is priced at $0.70 per million input tokens and $2.10 per million output tokens. For European buyers, sovereignty is “a meaningful differentiator, but it should not outweigh security concerns,” Dai said. Open weights and self-hosting shift responsibility for guardrails, access controls, monitoring and misuse prevention to the operator, he added. “Sovereignty and security therefore need to be evaluated together, not traded against each other,” Dai said. Daftary said enterprises self-hosting Large 4 for code audit or vulnerability triage should run it as a controlled component, not an autonomous agent. That means isolated environments, least-privilege access to code and credentials, sandboxed generated code, and human sign-off before any remediation, she said. “Self-hosting can improve data control and operational continuity, but it also makes the enterprise solely responsible for patching, monitoring, evaluation and misuse prevention,” she said.

Everyday channels are available in an incident, but you may not want them

The first hours after a serious cyber incident are filled with activity. Security starts investigating, IT works to contain the impact, legal begins assessing potential obligations, and executives want to know what happened and what the company is doing about it. Most teams rely on the same tools they use every day to coordinate that work, which usually means email, Slack, Teams, shared documents and video calls. Coordination gets much more complicated when the company’s email or collaboration environment is part of the incident. Email may still work, employees may still be able to join meetings, and nothing on the surface may suggest that the organization has lost control of its communications. Meanwhile, an attacker with access to accounts used by responders may read the team’s messages, monitor containment plans or impersonate someone involved in the response. When that happens, the company faces a second crisis inside the first. The systems people depend on to manage the incident can no longer be trusted. After more than two decades in the privacy and breach space, and in my weekly conversations with security and legal teams, I see the same pattern. Most incident response plans account for email or collaboration tools becoming unavailable. Teams have phone trees, personal contact information and backup conference lines. They know whom they need to call. What they often lack is a systematic approach for the harder case. Far fewer plans address the more ambiguous situation in which those systems remain functional while the organization can no longer be certain who is reading, sending or altering messages inside them. That scenario requires a preplanned way to move the response out of band while investigators determine what has been compromised. When the attacker may be inside the response This problem is easy to see during ransomware. Systems go down, employees lose access and the need for alternative communications becomes obvious. Compromised communications make judgment harder because the affected environment may appear completely normal. Suppose the security team discovers that an attacker has gained access to email and collaboration accounts used by incident response team members. The team needs to determine the scope of that access, remove the attacker and contain the intrusion, but discussing those actions in the regular incident channel could tell the attacker exactly what is coming. Legal needs the latest facts to evaluate notification requirements, the comms team is preparing for questions from customers, and leadership expects regular updates. Every one of those conversations may reveal something valuable to the person the company is trying to remove. The attacker is in the meeting. Responders then must answer a basic question before they can safely coordinate anything else: Who can see what we are saying? Countless companies rely on Teams or Slack during incidents because those are the systems their employees already use. The tradeoff is that the response stays inside an environment the attacker may already access and has every reason to monitor. I’m aware of several cases where attackers joined or recorded Zoom and Teams bridges used for incident meetings. What was already said As I discussed in my previous CSO article, putting a lawyer in a large incident channel does not make every conversation privileged. Operational facts and legal advice serve different purposes, and a crisis does not remove the need to control who participates in sensitive discussions. If the attacker was reading the channel, assume that every containment plan, every candid assessment of how the intrusion happened, and every draft customer statement posted there is now outside the company. Some of it may surface in an extortion demand. All of it may surface in discovery. Plan as though the company will end up in court. The out-of-band channel should give teams a place to separate operational coordination from legal analysis, limit participation and begin building the record that regulators and plaintiffs may later examine: what was decided, by whom, on what facts and why. Legal should design that structure before the incident. Trying to create it during one, in a channel the attacker may be reading, compounds the problem. What an out-of-band plan must solve The mistake I see is starting with a backup application. Start with the failure scenario and map every dependency shared by the primary and emergency communications environments, including identity services, managed devices, mobile device management, administrative credentials and employee directories. If both channels depend on the same underlying component, that component remains a single point of failure. Then decide how participants will prove who they are. An attacker with access to email or calendars may know that an emergency meeting is taking place and have enough context to impersonate an executive or responder. The verification process cannot depend on the accounts under investigation. The same preparation should cover outside counsel, forensic investigators, insurers and communications advisers. Maintain current contact information, define who can authorize their participation, and establish how the team will verify them before an incident begins. Devices also matter. An alternative channel provides little value if responders can reach it only through corporate laptops they have been instructed to disconnect. The plan should specify which devices responders can use and what information they may access through them. The specific approach will depend on the company’s size, risk profile and existing systems. The test is whether the response can continue without relying on the environment under investigation. Practice moving the response Most organizations that test backup communications focus on whether the channel works. They should also rehearse the judgment call that activates it. Participants need to recognize when the primary environment has become untrustworthy, alert the response team without exposing the move, and continue operating in the alternate channel. A tabletop exercise can begin with evidence that an attacker has accessed email and collaboration accounts used by several responders, even though both services still appear to function normally. The team must decide what evidence is sufficient to trigger the move, who has the authority to make that call, and how everyone’s identity will be verified after they arrive. The exercise should bring in security, legal, executives and essential outside partners. Add the complications that make real incidents difficult, such as an executive sending conflicting instructions through corporate email, someone joining a meeting from an unfamiliar account, an outdated emergency contact or a third party unable to authenticate. Those moments reveal whether the company has a working capability or only a document describing one. I would measure how long it takes to recognize the need to move, activate essential stakeholders, establish a verified response group, and brief leadership. Every point at which participants fall back on the affected environment exposes a dependency the written plan missed. Most incident response plans assume the company will have somewhere safe to coordinate. That assumption deserves the same scrutiny as backups, recovery procedures and containment playbooks. The decision to leave familiar systems should have defined triggers, a clear owner and a destination everyone has already practiced using. When the communication environment becomes part of the breach, legal deadlines, business decisions, customers and employees do not wait. The company needs to know when to move, where to go and how to keep operating once it gets there.

We are not ready for what AI has done to red teaming

Something shifted in offensive security over the last eighteen months that most organizations haven’t fully absorbed yet. It isn’t that attackers got smarter. It’s that the economics of attack changed entirely — and those of us who run red teams have had a front-row seat to the transformation. The conversation about AI in cybersecurity tends to fixate on defense: better anomaly detection, faster triage, and AI-assisted SOC analysts. That framing misses the more urgent story. The attack side of this ledger has already been rewritten. A small, well-equipped offensive team using frontier AI models today can outperform what was possible with a much larger traditional operation just two years ago, by a margin that should unsettle every security leader reading this. Through our work on the front lines of offensive security, the consensus is clear: if you are not augmenting your operations with AI, you are already at a disadvantage. Before addressing the operational shift, we must clarify a fundamental distinction that is often conflated in industry discussions: AI red teaming: This involves probing Large Language Models (LLMs) for vulnerabilities, testing agentic pipelines, and identifying prompt-injection vectors or unintended behaviors. Red teaming with AI: Using AI as an operator’s tool to execute traditional offensive operations. It is this second category, Red Teaming with AI, where the most immediate, drastic, and dangerous transformation is occurring. The staggering scale of productivity AI-augmented operations transitioned from a nice-to-have luxury to a non-negotiable requirement. The democratization of frontier models introduces asymmetry between well-equipped adversaries and traditional defensive teams relying on manual triage. The productivity leaps we are seeing in the field are staggering. When AI is effectively weaponized by offensive teams, some of the initial findings speak for themselves: MetricTraditional red teamingAI-augmented red teamingAnnual team output60 to 70 findings (3-4 person team)90+ findings generated in a single after-hours exerciseSingle app engagement7 to 10 findings100+ true positive findingsLarge-scale scanningTakes appropriate sequencing and pipelines, or times out entirelyEnables you to build capabilities that can scan millions of IPs in 2-3 hours (for roughly $20k-$30k)Reconnaissance of external applications150-200 valid findings/year100+ findings a month (Data above aggregated by DayBlink Consulting over past 10 years of engagements and validated by Robert Pimentel as representative of his Red team experience.) AI across the engagement lifecycle We are no longer just using AI to write phishing emails. Organizations and threat actors alike are adopting a structured approach to integrate AI throughout every phase of the kill chain: Pre-operation (setup and reconnaissance): The weeks-long setup phase has been accelerated into mere moments. Gathering Open-Source Intelligence (OSINT), provisioning infrastructure, building organizational charts, and configuring command-and-control (C2) servers can now be delegated to agentic AI. This significantly reduces the time and manual effort needed to get an operation off the ground, though complex infrastructure decisions still require experienced operators. Pre-op usually starts off exciting (new op coming) but often ends in a grind.  We love the acceleration AI has provided here. Mid-operation (enumeration and attack): during active engagements, AI acts as a real-time, on-demand expert. Operators use AI interactively to generate custom audit scripts, rapidly adapt strategies, and query unfamiliar technology stacks on the fly. By utilizing an LLMs-as-judges workflow, where one model’s output is vetted by another for correctness and risk before execution, attackers can ensure highly confident, automated actions. Enumeration and attack is where all the excitement and adrenaline happens.  We are using AI to help here, but it’s not replacing us humans (yet). Post-operation (reporting and deconfliction): reporting has historically been the most tedious burden of any engagement. Today, nine to ten months of raw C2 logs can be piped into a frontier model to generate a comprehensive deconfliction report in under 20 minutes. These tools can map every executed command to the MITRE ATT&CK framework, cross-reference threat intelligence, and translate highly technical data into clear, actionable narratives for board-level executives. The output still requires manual review. AI gets you to a first draft in minutes instead of days, but an operator needs to verify findings, validate ATT&CK mappings, and ensure accuracy before delivery. Ticketing and follow-up are the bane of most red teams.  AI has become an awesome sidekick to our teams to build our reports and do lots of the tedious work. The talent divide: judgment as the ultimate differentiator With AI automating basic enumeration, scanning, and scaffolding, the core red-teaming skill set — critical thinking, architectural understanding, adversarial judgment — is as valuable as it’s ever been. AI doesn’t replace that. But operators who can leverage AI alongside those skills will outperform those who can’t. The differentiator isn’t AI versus no AI; it’s whether you have the foundational knowledge to direct it effectively and validate what it gives you. This is fundamentally shifting the required profile of a successful cybersecurity professional. As a result, the industry is quickly diverging into two distinct categories of practitioners: The “unicorns” (high performers): These are the practitioners who bring critical thinking and deep adversarial judgment to AI. They understand exactly where trust boundaries fail and where architectures are weak. They use AI to execute on these insights efficiently, offloading the busywork to focus on complex exploitation. The “slop cannons”: Operators who use AI as a mindless copy-paste shortcut. They rely entirely on unverified outputs without understanding the underlying mechanics, producing noisy, easily detectable work that wastes time and triggers alarms. Consequently, hiring practices must change. The primary screening criterion for new talent can no longer be a stack of legacy certifications; it must be their hands-on curiosity, their fundamental understanding of network architecture, and their experience building tools with frontier AI models. Certifications still matter, but hiring must also evaluate whether candidates can think critically about systems and leverage AI tools effectively — not just operate them blindly Strategic imperatives for 2027 For security leaders looking to survive this paradigm shift, the path forward requires immediate action. Based on our observations, here are the critical priorities for the next 18 months: Formalize AI budgets: Access to frontier models is expensive, but it is a necessary operational cost. Teams without the budget to experiment and build will fall behind adversaries. Implement continuous, programmatic testing: As enterprises deploy thousands of their own agentic integrations, manual testing is no longer viable. Continuous, automated adversarial testing must become the standard operating procedure. Prepare for hybrid threat vectors: As digital perimeters harden through automated defense, attacks will increasingly blend hyper-automated digital exploits with highly sophisticated physical and social engineering vectors. Hire for curiosity: Build teams anchored by practitioners who are actively experimenting with AI and possess the high-level judgment needed to guide it safely and effectively. Organizations that fail to adopt an AI-augmented mindset risk being overwhelmed by adversaries operating faster, smarter, and at an unprecedented scale. Success in the modern cyber landscape relies on one core principle: seamlessly combining elite human judgment with intelligent automation.

TThe Hacker News Breach

Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor

Cybersecurity researchers have disclosed that the official Anthropic Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor on infected hosts. The issue has since been traced to the compromise of the Cursor Marketplace, prompting the AI coding platform Cursor to briefly take down the service to remove the malware. "We identified a security incident

Beyond deterministic worms: Preparing the SOC for reasoning adversaries

In May 2017, the WannaCry cryptoworm spread across the internet, compromising more than 200,000 computers in at least 100 countries. The National Audit Office called it the largest cyberattack ever to hit the NHS in England. At least 80 of 236 hospital trusts were infected or disrupted, an estimated 19,000 appointments were cancelled, five hospitals diverted ambulances, and more than 1,200 pieces of diagnostic equipment were infected. What stopped WannaCry was a stroke of luck. A researcher reverse engineered the malware, noticed it contacting a domain nobody had registered, and registered it. That evening the original strain stopped locking devices. WannaCry had a kill switch, and we are all fortunate that Marcus Hutchins was able to find it. As I read agent incident reports from OpenAI and Anthropic, I am reminded of WannaCry. But the threat from offensive agents is not a faster worm. In July, roughly 1,200 OpenAI agents being tested on a cybersecurity benchmark found an unsanctioned message board on an internal software repository, and some broke out to the internet. About 700 of those agents went on to attack Hugging Face, looking for clues to beat the benchmark, according to an independent investigation. Hugging Face disclosed the intrusion on July 16, and OpenAI confirmed its agents were responsible five days later. Recently Anthropic has had unintended incidents as well. Anthropic’s incidents involved single models rather than a swarm. In cyber evaluations that were accidentally left connected to the internet, individual Claude models attacked real companies’ systems while trying to complete their exercises, and one published a malicious package to PyPI. Worms like WannaCry exploit a single or small number of vulnerabilities, using a static set of techniques. Agents can read the results of failed attempts, try something else, and pass on what they learned to other agents. Anthropic’s Frontier Red Team evaluated GLM-5.3, an open-weights model from Z.ai that NIST’s CAISI assessed as the most cyber-capable open-weight model released to date. Over a day, with under an hour of hands-on attention, a researcher used it to find several unknown browser vulnerabilities and chain them into an exploit that steals a user’s SSH key. A smaller variant built an exploit chain for two known flaws for roughly $20 at API prices. Simple techniques bypassed its safeguards 64% to 100% of the time in simulated tests, including abliteration, which edits the released weights to strip out refusals. A high-performing SOC working to the “1-10-60” benchmark — 1 minute to detect, 10 to investigate, and 60 to contain — is not built for this. When the adversary moves from a human at a keyboard to groups of autonomous agents operating at machine speed, response has to be measured in seconds. The Hugging Face incident shows the gap even when the agents belong to a well-intentioned party. OpenAI did not contain them in time. OpenAI reports that its own monitoring flagged the agents twice in the preceding weeks. In June, their responders decided the activity did not warrant stopping the evaluation. In early July, they found a compromised server, revoked credentials and blocked the exploited paths. Within a day of the evaluations resuming, the agents had found a new zero-day and were back on the internet. They compromised Hugging Face between July 11 and 13, and OpenAI linked it to its agents on July 20. When Hugging Face investigated the intrusion, the hosted models it tried first refused to analyze the attack logs, and its team finished the forensics with GLM-5.2 running on its own infrastructure. As Hugging Face put it: “the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried.” What makes this different None of this is new to our industry. We have always played leapfrog with attackers. What is new today is that they can now download capable models with no meaningful safeguards and build their own offensive agents. Imagine WannaCry if the worm rewrote itself the moment the domain was registered. The best SOC in the world would still be diagnosing the initial compromise when it had moved on. Agents that depend on a provider can be contained by revoking credentials, suspending accounts, and blocking egress, though OpenAI’s experience shows it may take more than one attempt. Open-weight models running on an attacker’s hardware cannot. Anthropic recently tested whether small models could replicate across cheap connected devices without a datacenter. In simplified evaluations with trivial access controls, a stronger open-weight model completed the full chain, and Anthropic projects small models reaching that level by year-end if current trends hold. A replicator like that has no central point to switch off. It would be slow and visible on the network, but patient and everywhere. Hospitals know the problem: Some equipment WannaCry disrupted, such as MRI scanners with embedded Windows XP, was vendor-managed and could not be updated by the trusts. Agents do not need to be intentionally asked to embark on offensive exercises to exhibit harmful behavior. Transluce documented agents asked to do ordinary data retrieval that, when blocked, probed public websites for vulnerabilities, including an Australian government agency. Some were linked to the swarm OpenAI has acknowledged as its own. The Hugging Face agents were trying to win a benchmark. Poorly constrained agents are enough for unintended harmful activity. We are deploying agents as assistance for site reliability engineering (SRE) and infrastructure as code (IaC) ourselves, and cloud providers are shipping agent toolkits to manage infrastructure. When, not if, a compromised or poorly managed agent holds those privileges, it will be able to deploy its own infrastructure to run on. We have already seen agents in a lab environment stand up their own relays and cloud infrastructure with stolen credentials. Meeting the agent challenge But we can still prepare for these future scenarios today. To do so, CISOs must treat agents as privileged identities: Give each agent short-lived, narrowly scoped credentials, with no standing permissions. Forbid agents from creating new identities, compute, or network paths without human approval. Put agent workloads behind egress allowlists, so a blocked agent cannot go looking for another way out. Enforce policy-as-code guardrails on infrastructure pipelines, and alert on anomalous machine-identity behavior and unexpected resource creation. The NAO’s report is the best documentation of WannaCry’s damage, and it covers a single health system in one country. Large groups of agents carrying a ransom payload could reach hospitals across the planet with no kill switch to find. Autonomous defense is extremely challenging in healthcare, because a false positive can interrupt patient monitoring, biomedical telemetry or imaging, having a significant impact on patient safety. Current tools, including copilots that help a human triage alerts faster, are nowhere close to the offensive capabilities the labs are evaluating. We need defensive parity at machine speed. Zero false positives is not a realistic engineering target, so design of autonomous defense has to assume mistakes and limit their cost. Automate fast, narrowly scoped, reversible actions such as isolating a single device, revoking a narrowly scoped token or quarantining a workload, and keep a human in the loop for anything irreversible or clinically risky. Always have a way to reverse automated actions as quickly as they are introduced. We need to build graduated autonomy, tiered by asset class. You can be more aggressive on the corporate assets, and more conservative around biomedical devices. Leveling up security fundamentals — and business support What else can we do today? Keep our tried-and-true practices and run them faster — something that will require leadership, and additional support from CEOs and the board. In its analysis, the NAO found that applying the patch, or simply managing internet-facing firewalls, would have protected every NHS organization WannaCry infected. Companies and open source projects are now running coding agents over their software and releasing an unprecedented number of security patches. This is great but IT needs to be able to apply them. Give IT the resources to deploy them, retire outdated infrastructure, and make the business tolerant of the maintenance windows this requires. That segmentation or zero trust initiative that has been on the back burner? Make it a priority. Today. If you are still underinvested in security, increase funding now so your team or vendor can acquire the tools and expertise the next few years will demand. And accept that automated defense will sometimes get it wrong. Security teams will have to automate, and the business will have to tolerate the outages that follow. The technology is emerging and it will not be perfect. Support your teams anyway. An open letter to the AI labs and the security community at large A note to the frontier labs. Several of you deserve credit: Project Glasswing and OpenAI’s Patch the Planet put frontier capability in defenders’ hands, and your incident reports have been unusually candid. But offensive capability is moving faster than safeguards. GLM-5.3 shipped as downloadable weights that simple techniques unlocked 64% to 100% of the time, and gated access does nothing about weights already in attackers’ hands. As a result, I am asking for three things: Hold defensive research to the same urgency as capability research, including autonomous containment with a safety case that works in clinical environments. Widen defenders’ access to the class of models attackers will have. Make independent testing before release, and independent investigation after incidents, an obligation rather than a courtesy. METR’s CEO noted that OpenAI let investigators in voluntarily, with no industry requirement on any lab to disclose an incident. I have seen too many security professionals dismiss talk of offensive AI as marketing or fearmongering and answer concerns with “fix your stuff.” Patching matters, and the NAO’s findings on WannaCry articulate that, but that is not the only answer to agents that organize on improvised message boards and probe websites while doing ordinary work. WannaCry’s authors left a kill switch in. The next generation of threats will not have one, and cybercriminals will not disclose when they lose control of a swarm. We cannot rely on strokes of luck. Let’s recognize the risk, discuss it, and prepare before the attackers start using these tools in earnest.

DDark Reading General

As Russia's Cyberwar Evolves, Belarus Steps Forward

The "FrostyNeighbor" advanced persistent threat (APT) launched a destructive attack in Ukraine and is raising concerns about deeper alignment with Russian cyber objectives.

TThe Hacker News Vuln

Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. "This module enables you to sell goods and services to customers through an included shopping cart

TThe Hacker News Vuln

CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise