Category: Cyber Security News

Anthropic says its Fable 5 and Mythos 5 models are again available to the public after reaching an agreement with the Commerce Department to add new guardrails and classifiers aimed at blocking jailbreaks. The decision follows export controls triggered by an Amazon threat report and renewed debate over U.S. AI policy, national security testing, and the limits of routine cyberdefense use. #Anthropic #Fable5 #Mythos5 #Amazon #CommerceDepartment #HowardLutnick

Active exploitation attempts have been observed against CVE-2026-8037 in Progress Kemp LoadMaster, a critical OS command injection flaw that can enable unauthenticated remote code execution. Although the observed attacks failed, the release of PoC details is likely to accelerate further malicious activity against the affected appliance. #ProgressKempLoadMaster #CVE-2026-8037 #eSentire #watchTowrLabs…

Frontier AI is reshaping how enterprises assess vulnerability identification, mitigation, and patching, while also raising concerns about how vendors are actually using AI in product security. The article urges buyers to question claims about model providers, automation, context, results, and validation to separate real capability from hype. #FrontierAI #AIRiskSummit #RitzCarltonHalfMoonBay…

Citrix released security updates for NetScaler ADC and NetScaler Gateway that fix six vulnerabilities, including the HTTP/2 Bomb denial-of-service flaw. WatchTowr highlighted CVE-2026-8451 as a likely CitrixBleed-related issue that could leak sensitive memory and potentially lead to full device compromise. #Citrix #NetScalerADC #NetScalerGateway #CVE-2026-8451 #HTTP2Bomb #CitrixBleed…

Cisco Talos uncovered ARToken, an affiliate platform tied to EvilTokens that appears to function as a “business email compromise-as-a-service” environment for phishing Microsoft 365 accounts and bypassing multi-factor authentication. The toolkit adds mature BEC features like inbox rule manipulation, shared access links, and a seven-layer anti-analysis system, with targeted lures abusing real vendor relationships and invoicing themes. #ARToken #EvilTokens #Microsoft365

Adobe released urgent security updates for ColdFusion and Campaign Classic to fix multiple critical flaws, including several maximum-severity vulnerabilities that could lead to arbitrary code execution. The patches address issues such as improper authorization, path traversal, unsafe file uploads, and input validation weaknesses across ColdFusion 2025, ColdFusion 2023, and Campaign Classic…

A campaign dubbed Operation Navy Ghost has been targeting Python developers who build Telegram bots by publishing trojanized Pyrogram forks on PyPI. The hidden backdoor, secret.py, can execute attacker-supplied Python or shell commands, steal files and secrets, and exfiltrate data from infected servers. #OperationNavyGhost #Pyrogram #PyPI

Microsoft says it is speeding up its quantum-safe security roadmap because advances in quantum computing may make today’s encryption obsolete sooner than expected. The company plans to move critical products and services to post-quantum cryptography by 2029 as part of its Microsoft Quantum Safe Program and Secure Future Initiative. #Microsoft #MicrosoftQuantumSafeProgram #SecureFutureInitiative #PostQuantumCryptography

LayerX researchers uncovered “BioShocking,” a prompt injection technique that can make AI-powered browsers treat dangerous real-world actions as if they were part of a fictional game scenario. The PoC worked against six major agentic browser products, with OpenAI’s ChatGPT Atlas being the only one to receive a working fix so far. #BioShocking #LayerX #ChatGPTAtlas #Comet #Fellou #GensparkBrowser #SigmaBrowser #ClaudeChromeplugin

Researchers uncovered a massive automated password spray campaign against Microsoft Azure CLI that used the deprecated ROPC flow to bypass Conditional Access policies and compromise 78 Microsoft accounts across 64 organizations. The attacks exploited reused breached credentials and highlighted misconfigured MFA coverage, especially for Azure CLI logins. #Microsoft #AzureCLI #ROPC #LSHIYLLC…

Anthropic has restored Claude Fable 5 worldwide after the U.S. Commerce Department lifted export controls that had briefly forced the model offline. The dispute centered on a jailbreak found by Amazon researchers, and Anthropic responded by adding a new classifier to block the technique while keeping Mythos 5 under tighter restrictions….

Google released Chrome 151 with patches for 382 vulnerabilities, including 15 critical and 67 high-severity flaws, most of which were discovered by the company itself. Many of the issues affect the renderer process and could let attackers execute code in the sandbox or potentially escape it, though no in-the-wild exploitation was…

Russell Vought said the Trump administration is willing to work with DHS Secretary Markwayne Mullin on rebuilding CISA after major staff cuts and proposed further reductions in the fiscal 2027 budget. The agency has already lost more than 1,000 workers, and officials say hiring hundreds more will be difficult despite plans to send out nearly 200 job offers soon. #CISA #RussellVought #MarkwayneMullin #NickAndersen

Citrix disclosed six vulnerabilities in NetScaler ADC and NetScaler Gateway, including CVE-2026-8451, a high-severity memory disclosure flaw linked to the same class of issues behind CitrixBleed. Researchers said the bug affects SAML authentication parsing in identity provider deployments, while the other flaws include denial-of-service, arbitrary file read, memory overread, and a fix that requires a manual configuration change. #Citrix #NetScalerADC #NetScalerGateway #CVE-2026-8451 #CitrixBleed