⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
PortSwigger's AI-assisted HTTP Terminator system generated and validated new HTTP desynchronization attacks after testing 30,000 candidate vectors. The research found approximately 700 vulnerable targets, including banks and government infrastructure, and disclosed a zero-day in Apache Traffic Server.
Researcher Dirk-jan Mollema demonstrated that malware in a signed-in Windows session can silently use Windows Hello for Business keys to authenticate to Microsoft Entra ID. This allows attackers to gain persistent cloud access without extracting private keys or triggering biometric prompts, though no active exploitation has been reported.
Researcher Dirk-jan Mollema demonstrated that malware in a signed-in Windows session can silently use Windows Hello for Business keys to authenticate to Microsoft Entra ID. This allows attackers to gain persistent cloud access without extracting private keys or triggering biometric prompts, though no active exploitation has been reported.
Novee Security demonstrated that GitHub issues could trigger code execution on CI runners for Anthropic's and Google's coding agents. The vulnerabilities, including a critical OS command injection in Gemini CLI and an exfiltration channel in Claude Code, were presented at Black Hat USA. Patches have been released for both products.
Researchers at Novee Security demonstrated at Black Hat USA that a GitHub issue from an unprivileged account could be enough to execute arbitrary code on the CI runners powering Anthropic's and Google's own coding-agent repositories, or hijack the next agent run on OpenAI's infrastructure. The attacks were executed against each vendor's agent in its default shipping configuration, revealing that the core weakness across all three platforms lies in the harness — the code surrounding the model that determines what actually runs — rather than in the models themselves.
This article reveals that threat actor TeamPCP has been compromising internet-facing infrastructure since 2020, with recent campaigns including AI botnets and Redis-targeted cryptocurrency miners. The group later expanded into supply chain compromises and credential theft via React and Next.js exploits.