⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
A maximum-severity OS command injection flaw (CVE-2026-16812, CVSS 10.0) in on-premises Arista VeloCloud Orchestrator (VCO) is under active exploitation in the wild. Arista addressed the issue in hosted and dedicated versions in advance and released patches for on-prem versions 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1.
Multiple vulnerabilities were identified in Apple Products.
HKCERT warns of multiple vulnerabilities in Apple products that could allow remote code execution, information disclosure, and security bypass. Affected versions include iOS 26.6, macOS Sequoia 15.7.8, and others.
Attackers executed a targeted espionage campaign against a Thai government ministry using an AI agent built on the Hermes open source toolset operating in unrestricted YOLO mode. This configuration gave the agent maximum autonomy without safety guardrails, enabling it to conduct reconnaissance, extract sensitive documents, and maintain persistence within the ministry's network.
Dark Reading reports that threat actors deployed the open-source AI agent Hermes in YOLO mode against Thailand's Ministry of Finance. The autonomous tool conducted espionage without human oversight, marking a significant evolution in cyberattack capabilities.
Attackers executed a targeted espionage campaign against a Thai government ministry using an AI agent built on the Hermes open source toolset operating in unrestricted YOLO mode. This configuration gave the agent maximum autonomy without safety guardrails, enabling it to conduct reconnaissance, extract sensitive documents, and maintain persistence within the ministry's network.