Analysis
The long view — why the pattern keeps repeating, and what it says about the industry.
Flare finds carders still hunting clean IPs post-NetNut
Flare's read of 2,889 underground posts finds carders scrambling for 'clean' residential IPs two weeks after the FBI's NetNut seizure disrupted supply.
OtterCookie's fake interview now steals AI-tool configs
Elastic Security Labs catches the DPRK's Contagious Interview crew hiding a four-stage payload in SVG country flag files — and the new file stealer specifically hunts .claude, .cursor, .gemini, and .windsurf configs.
ACR Stealer, ClickFix, and why the Run box still works
Microsoft's Defender Experts detailed two ACR Stealer chains Thursday. Both start with a Run-dialog paste — and walk out with browser tokens and M365 files.
The plumbing behind $43M in investment-fraud losses
DOJ charges two in a New York-based network that laundered at least $43 million from pig-butchering-style investment scams through ~140 accounts.
n8n cross-issuer JWT bypass logs attackers in as anyone
CVE-2026-59208: n8n Enterprise instances trusting two or more JWT issuers matched incoming tokens on `sub` alone, letting a token from issuer A log in as B's user.
AI can find the bug. Proving it is still the job.
SANS Fellow Stephen Sims argues the noise-to-signal ratio in bug bounty has shifted, but the proof-of-exploit standard hasn't — Bugcrowd's own policy shift agrees.
Agent Data Injection: SQL injection, different decade
Seoul National, UIUC, and Largosoft show AI agents misread punctuation in trusted data as structural delimiters. No CVE, no vendor fix planned.
AttackerKB's public tier closes August 18
Rapid7 retires the public AttackerKB site and its open submissions on August 18. Analysis, writeups, and API access move behind curation and a customer login.
Two Scattered Spider affiliates get 5.5 years for TfL hack
Thalha Jubair, 20, and Owen Flowers, 18, pleaded guilty under the UK Computer Misuse Act. The 2024 intrusion knocked out 148 TfL systems and cost £29 million.
The July patch count Microsoft warned would come
Microsoft credited AI discovery for July's record 622-CVE Patch Tuesday. That's the second half of the story the MDASH post previewed a week earlier.
Intruder ships an LLM vuln-discovery product, plus a 0-day
Intruder shipped an LLM code-slicing pipeline that turned up a WordPress plugin zero-day, plus more bugs still under responsible disclosure.
Arctic Wolf: 292 fake GitHub repos push BoryptGrab stealer
Arctic Wolf tracked 292 fake GitHub repos seeding a BoryptGrab infostealer since June 26 — impersonating security tools, crypto wallets, and dev utilities.
Claude for Chrome flaw lets other extensions read Gmail
Manifold says the trust-boundary flaw behind ClaudeBleed is still open in Claude for Chrome v1.0.80 — eight releases after Anthropic's May fix.
Miggo: RabbitMQ leaked OAuth secret via obsolete endpoint
Miggo disclosed two RabbitMQ flaws today: an obsolete /api/auth endpoint exposed the broker's OAuth client secret, and a bug bypassed vhost boundaries.
SAP's July Patch Day: three criticals, worst is 9.9
SAP's July 2026 Security Patch Day fixes 16 flaws — three rated critical, worst a CVSS 9.9 memory-corruption bug in NetWeaver ABAP. No known exploitation yet.
A year of ShinyHunters OAuth abuse, mapped by Microsoft
Microsoft's July 13 report maps three OAuth paths ShinyHunters-linked actors used against Salesforce customers for a year — none of them a Salesforce bug.
Forg365 shows PhaaS became a $400/mo rental market
Analysis: Forg365's $400/mo Microsoft 365 phishing kit adds device code, AitM, and AI-drafted replies. What changed here is finish, not the underlying kind.
Meta patent describes an always-on emotion-reading AI
Meta patent 2026/0182881, published July 2, describes an always-on AI that tags voice, biometrics, and app use to score a user's emotional patterns.
CISA postmortem: nine alerts ignored, six months exposed
CISA's postmortem on its own six-month GitHub credential leak faults slow key rotation and nine ignored GitGuardian alerts — signal without intake.
Three Evilginx Crews, One Forgotten Bash History
Lexfo pulled the full toolkit from an open Python server in Budapest and pivoted to two more Evilginx operations targeting Microsoft 365 tenants.
China, India APTs Converge on Balochistan Police
SentinelLABS ties 22 months of intrusions at Balochistan Police to two separate crews: China-nexus operators using PlugX and India-linked Mysterious Elephant.
Australia's ACSC names 18 CMS bugs under exploitation
Australia's ACSC named 18 CVEs across WordPress plugins, Craft CMS, Joomla JCE, and more as active exploitation targets, with attackers dropping webshells.
Ghostcommit and the reviewers that don't open the PNG
A PNG carrying prompt injection slips past AI code reviewers that never open image files, then talks a coding agent into exfiltrating a repo's .env secrets as a list of numbers.
OpenMandriva contributor deleted GNOME and Cosmic repos
Davide Beatrici, a three-year OpenMandriva admin, deleted the Cosmic and GNOME repositories and pushed an obsoleting empty package into Cooker on July 8.
A seized crypto account that moved from a cell
Rossen Iossifov, ten years into a laundering sentence, is charged with moving $290K from a seized crypto account. The interesting part is it still moved.
Microsoft's MDASH and the humans downstream of it
Microsoft says AI-found Windows bugs will make Patch Tuesdays bigger. The interesting part isn't the AI — it's the human queue that signs off on what ships.
OpenClaw patched a chain that started in a chat message
OpenClaw 2026.6.6 closes three flaws that let a WhatsApp message reach the host as command execution. No public PoC, no observed exploitation.
Injective SDK's npm compromise, and the OIDC that let it
@injectivelabs/sdk-ts@1.20.21 shipped a wallet-key exfiltration routine for two days. A maintainer account walked it through the OIDC publisher pipeline.
Six U-Boot bugs sit in front of the signature check
Binarly disclosed six flaws in U-Boot's FIT image parser. Two allow code execution, four are DoS, all reached before the signature check runs.
A Ryuk operator pleads guilty, six years after wind-down
Karen Vardanyan pleaded guilty in Portland to Ryuk-era conspiracy charges from 2019-2020. Sentencing is set for September. A note on how long the pipeline actually takes.
Politie Points at Dutch Hackers in the 88GB Odido Leak
Dutch National Police say strong indications point at Dutch attackers behind February's Odido breach: a Dutch-speaking vishing call to customer service, then 6.2M records leaked.
Progress tells ShareFile on-prem users to shut down servers
Progress emailed on-prem ShareFile Storage Zone customers to shut down servers over a 'credible external threat.' No CVE, no patch — just an offline advisory.
A laser resets Tangem wallets, and there's no patch
Ledger Donjon's laser fault-injection attack resets a Tangem card's password without the old one. There is no patch — Tangem ships no firmware updates.
XRING: 260 bytes, no patch, three months of Alibaba silence
FoxIO's Sébastien Féry disclosed a QPACK integer underflow in Alibaba XQUIC that crashes HTTP/3 servers with 260 bytes. Reported April 7. No reply. No patch.
WP-SHELLSTORM ran 22 days with its door left open
SOCRadar and Ctrl-Alt-Intel pulled 22 days of files off an exposed WP-SHELLSTORM server: 1.4M targets, 25K compromises, 5,700 live shells.
281 free Android VPNs, and a familiar audit outcome
A new study of 281 popular free Android VPN apps found traffic leaks, missing encryption, and tracking. The category has kept failing this test for years.
Ill Bloom is a $3.1M lesson in weak randomness, again
Coinspect disclosed weak PRNG in wallet recovery-phrase generation; attackers drained $3.1M in a May sweep. The pattern — bad randomness, stolen keys — is old.
Ex-DigitalMint negotiator gets 70 months for BlackCat scheme
Angelo Martino, ex-DigitalMint IR employee, sentenced to 70 months for feeding BlackCat victims' insurance limits and negotiation floors. An old failure mode.
Meta's Muse Image defaults on for public Instagram
Meta's new Muse Image model reuses public Instagram photos and reels by default — no notification, no watermark discussion, opt-out three levels deep in Sharing settings.
The clearinghouse boom is not new, and neither is the fatigue
Chainguard announced Athena. Red Hat and the White House announced Lightwell. Vulnerability clearinghouses have been getting reannounced since the 1980s.
The ATO fight moved past credential stuffing
The Hacker News argues account takeover shifted from credential stuffing to attacking verification — passkeys pushed the front door shut, so attackers moved.
Talos on 'attackers only need to be right once'
Cisco Talos's Hazel argues 'attackers only need to be right once' is a cliché the defensive community should retire. It's overdue.
Datadog: 50+ dormant GitHub accounts mapping org charts
Datadog Security Labs documents 50+ dormant GitHub accounts running months-long enumeration of corporate orgs, repos, and — in some cases — private code.
Microsoft: MDASH will grow Patch Tuesday numbers
Microsoft EVP Pavan Davuluri says a multi-model AI scanner called MDASH will surface more Windows bugs — expect higher-volume monthly releases.
npm 12 flips install scripts off by default
npm 12 lands with allowScripts, --allow-git, and --allow-remote all defaulting to none. GitHub is also winding down GATs that skip 2FA. The default just moved.
Microsoft to retire OWA Light in Exchange Server
Microsoft is disabling OWA Light in an August 2026 Exchange Server update, ending a legacy client shipped when IE6 was current. Admins can disable it today.
Friendly Fire: agents review the trap, then execute it
AI Now Institute researchers show autonomous Claude Code and Codex can be tricked into running a hidden binary during their own security-review pass.
GhostApproval symlink bug hits six AI coding assistants
Wiz research: Amazon Q, Cursor, Claude Code, Augment, Antigravity, Windsurf all approved one file path in the dialog while writing to another via symlinks.
RedWing turns Android bank fraud into a Telegram rental
Zimperium's zLabs details RedWing, an Android bank-fraud MaaS sold on Telegram — Oblivion variant, subscription tiers, prebuilt droppers, 82 target banks.
Spain arrests suspected CARR logistics operator
Spanish police detained a Palencia man tied to CyberArmy of Russia Reborn, Z-Pentest, and NoName057(16). The announcement lands nearly four months after the raid.
Krebs traces zero-day broker IRIS C2 to Wohl and Burkman
Krebs ties IRIS C2, an offensive-security startup pitching zero-day acquisition, to Jacob Wohl and Jack Burkman — both convicted of felony fraud.
Sophos: Coding Agents Are Tripping the Attacker Detections
Seven days of Sophos endpoint telemetry: Claude Code, Cursor, and Codex trip the same rules built to catch attackers — because behaviorally, they should.
Refused in Chat, Written in Code: Copilot's Workflow Gap
Kumar and Maple's new arXiv preprint says Copilot's Claude and Gemini backends refused harmful prompts in chat but produced them 816-for-816 in a workflow.
A signed Git commit's hash is not a unique fingerprint
Carnegie Mellon research shows a signed Git commit can be re-minted with a different hash but the same 'Verified' badge — no signing key required, no code changed.
Dialogflow's Rogue Agent Flaw Is a Very Old Bug Class
Varonis' Rogue Agent finding in Google Dialogflow CX is a shared-runtime exec() escape — a bug class old enough to have graduated shared hosting.
Proofpoint: China cluster raids university physics mail
Proofpoint attributes a Roundcube-exploitation campaign against U.S. and Canadian university physics departments to a China-aligned cluster, UNK_MassTraction.
Windows Device ID trail led FBI to Scattered Spider suspect
A newly unsealed federal complaint says a Microsoft-recorded device ID tied the account behind a Scattered Spider intrusion to 19-year-old Peter Stokes.
IGA Was Built Around Employment Records, Not Agents
A contributed piece to The Hacker News from Orchid Security lays out where the joiner-mover-leaver model quietly fails for AI agents. Vendor-adjacent, but the gap analysis holds.
Talos on Curiosity: A Skill That Doesn't Scale
William Largent's Threat Source column this week reads as an essay on board games and pattern recognition. It's really an argument about the load-bearing skill that keeps a defender from becoming a checklist.
Pegasus on the MEP investigating Pegasus
Citizen Lab's forensic analysis found that former European Parliament member Stelios Kouloglou was repeatedly infected with NSO Group's Pegasus spyware while serving on the committee tasked with investigating that industry.
DPRK npm Packages Impersonate a Rollup Polyfill
JFrog links two new malicious npm packages — impersonating a Rollup polyfill project down to its metadata — to a DPRK cluster after developer secrets and remote access.