The archive

391 dispatches · newest first · page 5 of 7

1. 2026-07-29CubePilot drone software dev hit by DNS hijacking to intercept traffic
2. 2026-07-29Thousands of Data Center Controllers Open to Takeover
3. 2026-07-29OpenAI models used Artifactory zero-days to escape to the internet
4. 2026-07-29Pinned: ‼️ BREAKING — Claude AI found a working HAWK-256 key-recovery attack. HAWK is a NIST post-quantum cryptography candidate. It also made an impractical 7-round AES-128 attack up to 800x faster. Read this here: https://thehackernews.com/2026/07/claude-ai-just-cracked-post-quantum.html
5. 2026-07-29Claude Mythos degrades HAWK and developed new exploit for round-reduced AES
6. 2026-07-29IPMI bug in BMCs found after 22 years, exposes 24,000-plus servers
7. 2026-07-28FBI sees Anthropic’s Mythos as a law enforcement challenge
8. 2026-07-28Hugging Face breach reignites open-weights debate, raises liability questions
9. 2026-07-28'Certighost' Flaw Haunts Microsoft Active Directory Certificates
10. 2026-07-28RT by @cyb3rops: Cato: China-nexus SilverFox hits Japanese industrial manufacturing with ValleyRAT (Winos 4.0), extending beyond its historical Chinese-language targeting. The group evolves its BYOVD driver abuse and hijacking of signed software to evade defenses. https://www.catonetworks.com/blog/cato-ctrl-silverfox-evolves/
11. 2026-07-28Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe
12. 2026-07-28Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack
13. 2026-07-28Bugs in Hugging Face Diffusers Bypass Custom Code Safeguard
14. 2026-07-28Flying Eagle Android RAT: TLS Certificate Pivots, Panel Fingerprints, and 170 Servers Across Hong Kong ASNs
15. 2026-07-28Over 24,000 exposed server BMCs leak password hash via decades-old flaw
16. 2026-07-28Wordfence PRISM Detected Backdoored WordPress Plugin within Two Hours of it Being Introduced
17. 2026-07-2824,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login
18. 2026-07-28Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
19. 2026-07-28vBulletin fixes critical pre-auth RCE flaw with public exploit
20. 2026-07-28Simple Job Board ≤ 2.11.0 - Unauthenticated RCE (CVE-2024-1813)CVE-2024-1813
21. 2026-07-28AI-Assisted Bug Hunt Uncovers Linux Kernel 0-Day in net/sched
22. 2026-07-28‼️ 24,650 internet-exposed BMCs are leaking IPMI authentication hashes before login, giving attackers what they need to crack passwords offline. More than 30% matched recoverable passwords, including factory-issued credentials. Read what exposed servers need to lock down: https://thehackernews.com/2026/07/24650-internet-exposed-bmcs-disclose.html
23. 2026-07-28⚠️ ALERT - OpenWrt users, this one needs attention. A critical pre-auth DHCPv6 flaw could let an attacker who can reach the service send a crafted request and run code as root on the router. A separate audit also found 7 more flaws, including three pre-auth paths to device compromise. What users need to update now: https://thehackernews.com/2026/07/critical-openwrt-dhcpv6-flaw-could-let.html
24. 2026-07-28Exposed BMCs hand out password hashes before login
25. 2026-07-28🚨 Iranian state-backed Nimbus Manticore is turning compromised systems into covert network relays. NightLedger executes commands, uploads files, and captures screenshots, while BridgeHead and ArcBridge tunnel traffic through victim networks. Read more: https://thehackernews.com/2026/07/nimbus-manticore-deploys-nightledger.html
26. 2026-07-28Data breach at medical billing firm MCBS affects 1.26 million people
27. 2026-07-28Update your iPhone, iPad and Mac to fix Apple security holes
28. 2026-07-28Microsoft Launches Flurry of AI Security Initiatives to Combat AI-Enabled Threats
29. 2026-07-28Phishing Dominates as Initial Entry Method for Cyber-Attacks, as Hackers Hone Evasion Techniques
30. 2026-07-28Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays
31. 2026-07-28🔥 JFrog confirms OpenAI models exploited a zero-day in self-hosted "Artifactory," escalated privileges, and moved laterally until they reached the open internet. From there, the models targeted #HuggingFace and obtained ExploitGym solutions from its production database via a separate attack path. Here's how it happened: https://thehackernews.com/2026/07/jfrog-confirms-openai-models-exploited.html
32. 2026-07-28Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as RootCVE-2026-53921
33. 2026-07-28How We Hacked Thousands of Data Centers in Minutes Using a 20-Year-Old VulnerabilityCVE-2013-4786
34. 2026-07-28JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach
35. 2026-07-28AWS to retire Shield Advanced L7 automatic mitigation on January 1, 2027
36. 2026-07-28Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root ExploitCVE-2026-53264
37. 2026-07-28AutoIT Payload Injector , (Tue, Jul 28th)
38. 2026-07-28IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains
39. 2026-07-28New Crypter-as-a-Service Cruciferra Fuels Stealthy Malware Attacks Worldwide
40. 2026-07-28Unpatched Fastjson Vulnerability Exploited in Attacks
41. 2026-07-28Coca-Cola confirms hackers stole data in Fairlife ransomware attack
42. 2026-07-28Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)KEVCVE-2026-63077
43. 2026-07-28Origin Energy Data Breach Affects 900,000 Australians
44. 2026-07-28Shadow AI incident response begins with logs that may already be gone
45. 2026-07-28🚨 Attackers are exploiting a CVSS 10.0 command injection flaw in on-prem Arista VeloCloud Orchestrator. A successful exploit could compromise the orchestrator and give attackers access to managed Edge devices. CISA has ordered federal agencies to patch by July 30. Details: https://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html
46. 2026-07-28AI Agent Drives Espionage Attack on Thai Ministry of Finance
47. 2026-07-28Hackers target US firms in FastJson RCE zero-day attacks
48. 2026-07-27Reuters: OpenAI Agent Hacked Hugging Face for Days Before Being Detected
49. 2026-07-27MedusaHVNC Trojan Creates Hidden Desktops to Hijack Browsers and Steal Data
50. 2026-07-27Hackers used autonomous AI agent to spy on Thailand's finance ministry
51. 2026-07-27Aftercall ads are driving Android users crazy
52. 2026-07-27DentaQuest disclosed a data breach that impacted +23 million individuals
53. 2026-07-27Health system in South Carolina, Georgia closes offices after malware affects networks
54. 2026-07-27Hacked Public Wi-Fi Gateways Used to Harvest Corporate Credentials
55. 2026-07-27New Dysphoria DDoS botnet spreads to 200k devices worldwide
56. 2026-07-27New vBulletin Vulnerability!CVE-2026-61511
57. 2026-07-27🛑 A fake Microsoft Teams update deploys two legitimate RMM tools on the same Windows host. Operation BlueDash installs Level RMM and ScreenConnect in parallel, apparently to retain remote access if one is removed. How the phishing chain works: https://thehackernews.com/2026/07/operation-bluedash-deploys-level-rmm.html
58. 2026-07-27🚨 After law enforcement disrupted JackSkid, Dysphoria shifted its IoT botnet C2 to blockchain name services and infected-device relays. Weak Telnet and SSH passwords remain the main way in. Read how the botnet adapted: https://thehackernews.com/2026/07/dysphoria-iot-botnet-adds-blockchain-c2.html
59. 2026-07-27GitLab Users Urged to Patch After Research Reveals Critical RCE Chain
60. 2026-07-27New AI attack can reconstruct typed text from keyboard sounds with 90-99% accuracy