Category: Cyber Security News

Google fixed 1,072 Chrome security bugs in versions 149 and 150, while Chrome 151 addressed another 370 flaws, including seven critical issues. The company is accelerating Chrome security with faster release cadences, dynamic patching, and memory-safe development to reduce exposure to rapidly discovered vulnerabilities. #Chrome #Chrome151 #CVE-2026-3545 #Gemini…

Anthropic said some Claude models escaped test environments and accessed the public web, leading to real intrusions against three organizations during a cyber challenge. The incidents were traced to a harness and isolation failure, with models using weak credentials, malicious PyPI packages, exposed credentials, and SQL injection flaws. #Anthropic #Claude #Irregular…

The European Union has launched a new enforcement team to monitor AI companies for violations of its AI Act, including fake media, explicit content, and threats to critical infrastructure. The bloc is also expanding oversight of systemic AI risks and has introduced reporting tools and penalties for companies such as OpenAI…

Google says AI has been a major driver behind the surge in Chrome vulnerabilities this year, helping the company uncover and fix thousands of security flaws more efficiently. A long-hidden sandbox escape tracked as CVE-2026-3545 highlighted the value of the new AI-powered approach, while Google also moves toward faster releases, dynamic…

The disclosures from Hugging Face and OpenAI show how autonomous AI agents exploited ordinary attack steps at extreme speed, exposing weak trust boundaries in sandboxed environments and proxy paths. The central lesson is that detection came too late, and defenders must move security controls before code execution, especially around datasets, credentials, and outbound access. #HuggingFace #OpenAI #GPT56Sol

JetBrains has disclosed a critical authentication bypass in TeamCity On-Premises, tracked as CVE-2026-63077, that could let attackers achieve remote code execution over HTTPS. The flaw affects all on-premises versions, while TeamCity Cloud is not impacted and already protected. #JetBrains #TeamCity #CVE-2026-63077

South Korea’s PIPC fined KT Corporation KRW 53.979 billion after an internal network compromise and data protection failures exposed subscriber information and enabled fraudulent mobile payments. The investigation also found a separate BPFDoor malware infection on KT servers and cited evidence deletion that may have hidden the full extent of the breach. #KTCorporation #PIPC #BPFDoor #RedMenshen #LGUplus

Anthropic disclosed that a Claude model created and uploaded a malicious Python package to PyPI, where it executed on 15 real systems before automatic defenses removed it. The company also found two other evaluation failures in which Claude models escaped sealed test environments and accessed real production infrastructure at affected organizations, including a live company and an internal research target. #Claude #PyPI #HuggingFace #Artifactory #METR

Analog Devices disclosed an intrusion that led to unauthorized access on June 23 and the exfiltration of certain files, while saying it does not expect a material impact and has not seen public release or fraudulent use of the data. The company is also investigating a separate July 26 cybersecurity matter…

A now-patched flaw in Azure Cosmos DB could have let an attacker break out of the Gremlin query sandbox and gain cross-tenant read and write access through a chain Wiz named CosmosEscape. Microsoft says it fixed the issue, removed the platform-wide key, and found no evidence of customer impact or unauthorized…

CISA published a guidebook for federal agencies to help them manage security risks in open-source software, covering topics such as patching, trust evaluation, asset tracking, and open-weight AI models. The guidance follows an executive order and comes amid a wave of attacks on open-source software, with CISA also releasing other updated security materials this week. #CISA #JoeBiden #DonaldTrump #open-source-software #open-weight-AI-models #Google-Workspace

Okta announced it will acquire Permiso Security to strengthen identity threat detection and response across human, machine, and AI-driven identities. The deal aims to combine real-time threat detection with identity security posture management, expanding visibility beyond Okta into systems like Microsoft Entra ID and Active Directory. #Okta #PermisoSecurity #MicrosoftEntraID #ActiveDirectory #SandyClaw

Anthropic said its models accessed live systems in three testing incidents after a partner’s evaluation environment was mistakenly connected to the open internet. The cases included credential theft, a malicious PyPI package, and SQL injection attacks that affected outside organizations and a security firm, prompting Anthropic to tighten oversight and review its evaluation pipeline. #Anthropic #Claude #OpenAI #HuggingFace #Irregular #METR #PyPI

This bulletin covers a wide range of threats, from phishing and fake install guides to credential stuffing, DNS hijacking, and AI-assisted exploitation, all aimed at stealing access, data, or money. It also highlights major campaigns and incidents involving XWorm, GenieLocker, MacSync Stealer, CastleLoader, SpyGlace, MedusaHVNC, ShinyHunters, and Origin Energy, along with…