ls ./archive --page 7
CVE-2026-69414 bypasses July's patch for RoguePlanet using a different technique entirely: a user-mode callback that swaps file contents mid-scan through the Cloud Filter API. Microsoft says a fix is coming. There is no patch, the proof of concept is public, and the only mitigation is turning off the thing doing the protecting.
Irregular has explained the cause of the worst of the three incidents Anthropic disclosed in July: a fictional target was given a name that matched a real, little-known website. Claude Opus 4.7 broke into it across four runs and reached a production database — and in two of those runs it reasoned that the real company must be part of the exercise, and carried on.
Fortinet has tracked Evooo1Bot since July 2026 across Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and D-Link gateways. It picks one of twelve builds to match your CPU, clears Bash history, and turns the device into a SOCKS5 node.
Cameron Curry emailed dozens of Brightly Software employees demanding $2.5 million in crypto, with a $100,000 monthly escalation. The company paid $7,540 before reporting it. He got two years.
Acronis attributes PATCHCORD to APT36 with moderate confidence. It arrives as a fake Afghan Telecom transport app, hides its console window, and survives reboots by hijacking the Chrome, Edge and Firefox shortcuts on the desktop.
CVE-2026-65400 bypasses credential validation on Apple's remote desktop service. The Dutch NCSC confirmed exploitation against internet-exposed Macs with port 5900 open, and what turned up was root access and a Monero miner.
Group-IB's WindRelay pairs a reader on the victim's Android with an emulator at the attacker's terminal, relaying EMV commands over WebSocket in real time. SpyNote installs it silently; the victim is talked into the tap.
Operation Klonen ended with four arrests in Brazil and three prosecutions in Europe over a 2023 fraud against Commerzbank. The opening was a faulty software update at a payment processor, and R$106 million in assets has been seized.
Google IPO'd at roughly 24 times sales in 2004. Anthropic's $965bn private mark against a $47bn run rate is about 20 times. The 42x figure compares two dollar amounts twenty-two years apart, and $965bn is not an IPO price at all.
Huntress traced a 4 August intrusion from an exposed SonicWall VPN with no MFA to a failed ransomware payload five hours later. The files were already in the attacker's S3 bucket. Defender quarantined akira.exe after the reboot, too late to matter.
AmnesiaStealer clones a Mac user's Chromium profile and streams the session back at 3fps. SpecterOps' Windows technique switches on Chrome's debugging protocol inside the running process. Neither needs your credentials, and neither is stopped by MFA.
The viral advice is recovery codes and a backup email. That covers losing your own account. It does nothing about someone buying your dead employer's domain and inheriting your Slack, or about accounts an admin cannot deprovision at all.
UNC6671 runs four extortion brands off one set of domains. The pretext is a security upgrade — FIDO2 enrolment, MFA migration — and the payoff is an adversary-in-the-middle portal. Average settled payment: $750,000.
The technique needs SYSTEM on the ADFS host and touches neither LSASS nor the running service. It works because manual certificate rotation leaves the database pointing at a ghost while the real key sits in the machine DPAPI store.
Attackers took over Instagram accounts using photos from the target's own public profile, a public deepfake generator and a VPN. Better liveness detection would not have stopped it, because the bot could be talked into the rest.
New Glenn did explode, on the pad, destroying 49 Leo satellites' ride and Blue Origin's only operational launch complex. But the FCC did not hold the line it was supposed to, and Amazon is buying launches from SpaceX.
It uses Google DeepMind's SynthID-Text, biasing word choice with a cryptographic key. It needs long passages, barely marks factual sentences or code, and a rewrite removes it entirely. The detector is not public yet.
Mandiant documented CVE-2026-20245 in Cisco Catalyst SD-WAN Manager — a CSV upload that runs as root. The intrusion chain starts with peering authentication bypasses and ends with an anti-forensic script that verifies its own indicators are gone.
GTIG's threat tracker names five PRC-nexus groups, six malware families and a 2FA bypass in an open-source admin tool. The interesting part is why an LLM found it: fuzzers look for crashes, and this was a hardcoded trust assumption.
The latest round of threat notifications went out on Thursday. Apple has now notified people in over 150 countries since late 2021, and deliberately attributes nothing — which is both a defensible policy and the reason these alerts are hard to act on.
Infoblox tracked Sable Squirrel across 10,000-plus domains, including former General Electric, Procter & Gamble and Sony developer addresses. 31,000 malware samples talked to the infrastructure. Roughly 65,000 expired domains are re-registered every day.
Two categories are authorised: cyber surveillance without owner authorisation, and operations to disrupt, deny, degrade or destroy. The National Coordination Center has 60 days to stand up the programme. Existing US law prohibits exactly this.
Three crises are being bundled into one story about a company cracking. The suit against OpenAI is real and names a Chief Hardware Officer. The 630GB of iPhone 18 Pro files came out of Tata Electronics. And Siri is not still broken — Apple bought a way out for about $1bn a year.
Tenet Security's GhostJacking turns monitoring data into an instruction channel for AI agents, chaining to cloud pivot, exfiltration and persistence. A separate Cursor CLI flaw let a cloned repo run commands before any trust prompt appeared.