⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Researcher Dirk-jan Mollema demonstrated that malware in a signed-in Windows session can silently use Windows Hello for Business keys to authenticate to Microsoft Entra ID. This allows attackers to gain persistent cloud access without extracting private keys or triggering biometric prompts, though no active exploitation has been reported.
Novee Security demonstrated that GitHub issues could trigger code execution on CI runners for Anthropic's and Google's coding agents. The vulnerabilities, including a critical OS command injection in Gemini CLI and an exfiltration channel in Claude Code, were presented at Black Hat USA. Patches have been released for both products.
Researchers at Novee Security demonstrated at Black Hat USA that a GitHub issue from an unprivileged account could be enough to execute arbitrary code on the CI runners powering Anthropic's and Google's own coding-agent repositories, or hijack the next agent run on OpenAI's infrastructure. The attacks were executed against each vendor's agent in its default shipping configuration, revealing that the core weakness across all three platforms lies in the harness — the code surrounding the model that determines what actually runs — rather than in the models themselves.
This article reveals that threat actor TeamPCP has been compromising internet-facing infrastructure since 2020, with recent campaigns including AI botnets and Redis-targeted cryptocurrency miners. The group later expanded into supply chain compromises and credential theft via React and Next.js exploits.
This article reveals that the threat actor TeamPCP has been compromising internet-facing infrastructure since at least 2020, evolving from initial Redis attacks to supply chain campaigns. The group has targeted platforms like Ray, Docker, and Next.js to build botnets and deploy ransomware.
This article from CrowdStrike mentions threat hunting for shell command obfuscation on VMware ESX, but no further content is provided. The summary is based on the title alone as the article body is empty.