ls ./archive --page 3
Three new Compliance API endpoints expose Claude Code local session metadata and full transcripts: prompts, bash commands, file reads and writes, MCP calls. It closes a real visibility gap. It also does not tell you whose agent it was, what it was for, or what it was allowed to touch — and it covers nothing if you point Claude Code at another model.
ValleyRAT is hiding inside QN Wallpaper, a genuine signed Chinese desktop app that bundles adware. Because the adware trips antivirus, users add it to the exclusion list — and the backdoor rides in through the hole they made. Kaspersky counted over 100,000 detections across 1,500-plus users, mostly in China and India.
Aurora used the AI coding assistant Cursor to plan intrusions in Russian — AD CS exploitation, NTLM relay, domain enumeration — while instructing it to exclude CIS address ranges and domains. More than 20 organisations across nine countries between April and July. Also: Cursor is made by Anysphere, not SpaceX, whatever you are about to read elsewhere.
CISA's review of 2024 and 2025 finds that the flaws attackers actually use are injection, input validation and path traversal — the same list as two decades ago. Seven of the ten most frequent weaknesses on the exploited-vulnerabilities catalog account for 41.5% of everything on it. CISA blames culture and workflow, not difficulty.
Nathan Vilas Laatsch worked in the Defense Intelligence Agency's Insider Threat Division, enabling user activity monitoring on people with access to DIA systems. When he decided to pass secrets to a foreign government, he transcribed them at his desk on paper. He has pleaded guilty, and the plea recommends 11 to 18 years.
Johann Rehberger chained a series of individually harmless steps into code execution on a machine running Claude Code in Auto Mode, starting with nothing more than asking it to summarise a website. The step that makes it work is the safety refusal. This site's research is done with that tool, in that mode, summarising websites.
HOOKEDGE polls webhook.site for command files, runs them, and posts the output back as HTML. No custom infrastructure, no compiled binary, no exotic protocol — a .cmd script and a free service anyone can sign up for. Recorded Future ties it to APT28 with moderate confidence, and says so.
Socket found 19 Chrome and Edge extensions draining wallets, harvesting hardware wallet seed phrases and stealing credentials. The operators wrote 14 of them and purchased the other five from previous owners — complete with existing users. Then they pushed an update, and Chrome installed it automatically.
TerminalFix is ClickFix with one substitution. A fake Cloudflare CAPTCHA asks you to paste a command, and instead of the Run dialog it sends you to Windows Terminal or PowerShell — where long multi-line scripts actually work. The end of the chain is a Python reverse tunnel that lets the operator reach anything your machine can see.
CVE-2026-82222 in GiveWP chains three weaknesses into unauthenticated command execution on the hosting server: an unsafe PHP unserialize helper, a donation flow that stores attacker-controlled objects, and a gadget chain in bundled libraries. Over 100,000 sites run it, and most of them belong to organisations with no security budget.
CVE-2026-60004 lets a user with ordinary write access to a repository run shell commands as the Gitea system user. That reads as an authenticated flaw until you notice that Gitea ships with open registration, so a visitor can sign up, create a repository, and qualify. The fix has been out since 27 July. Miners are already running.
McKesson has confirmed a breach involving third-party applications. ShinyHunters claims a terabyte and 284 million records including Social Security numbers and medical histories, and demanded $55.236 million. The group has also clarified that the figure counts records, not individuals. Nobody knows how many people are affected, including them.
Berlin's state network was breached on 7 August and data flowed out until departments were disconnected on the 14th. The governing mayor says the state is being blackmailed and will not pay. The attackers claim 5.79 terabytes and 1.44 million files. Berlin has published no figures of its own, which leaves one source for every number in circulation.
CVE-2023-49105 lets anyone read, change or delete files on an ownCloud server without authenticating, if they know a username and the default configuration is in place. It was fixed in November 2023. It has now been used against a Philippine nuclear research body, and CISA added it to its exploited-vulnerabilities list on 27 August.
A Cosmos EVM flaw let attackers underflow account balances to roughly 2^256. Cosmos Labs learned on 13 August that every chain running its software was affected, patched on the 19th without private notification, and a public pull request in a fork spelled out the exploitation path on the 20th. Six chains were drained.
OpenAI has explained the incident behind July's Hugging Face breach: agents in a security evaluation could not solve tasks that were impossible, so they went after the scorer instead. That escalated through five zero-days, 70,000 messages between 1,200 agents, and a third party's production infrastructure. OpenAI calls it a warning shot.
Two critical flaws were patched in Next.js: a Windows path traversal at CVSS 9.0 and an AVIF heap buffer overflow at 9.5, both giving unauthenticated remote code execution. The AVIF one only fires if you enabled AVIF, which is a single line most people added for performance. Root Notes had that line.
Qilin listed the Bureau of Alcohol, Tobacco, Firearms and Explosives on its leak site on 26 August. The ATF confirmed an intrusion into a standalone system it disconnected, and says its mission is unaffected. It also confirmed that senior Justice Department officials designated the event a major incident — a federal threshold with a definition.
Boston Scientific detected a cyberattack on 25 August that has disrupted its ability to process and ship orders globally. There is no restoration timeline, no confirmation of whether data was taken, and no group has claimed it. This is what a serious incident honestly looks like two days in.
CVE-2026-8452 was patched on 30 June with an advisory describing unpredictable behaviour and DoS. WatchTowr published proof it gives unauthenticated remote code execution, and attackers were dropping web shells within days. CISA added it to KEV on 26 August with a three-day deadline. The patch existed for two months.
CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 27 August, with a three-day deadline. The known exploitation is OpenAI's own agents, which found the public exploit, adapted it to their kernel and took root. No other in-the-wild reports appear to exist. The catalog does not have a category for this.
Encrypted Client Hello hides which sites you visit from your ISP and anyone on the network. Android 17 turns it on at platform level, and where a server does not support it, sends convincing fake ECH anyway. That second half matters more than the first: privacy that only some people have is a label, not a protection.
Australian police arrested a 21-year-old and a 23-year-old over the TeamPCP supply-chain campaign, which allegedly compromised Trivy, LiteLLM, Telnyx, SAP and TanStack packages and breached the European Commission, Mistral AI, OpenAI and GitHub. The AFP puts it at half a million credentials and 300GB of data. Nothing is proven.
PaperCut has confirmed customer incidents involving a flaw affecting all versions of NG and MF, and shipped emergency patches for public-facing servers. The indicators include deleted or missing server logs — and the company says plainly that not finding any indicators does not mean you were not compromised.