Category: Cyber Security News

Anthropic is expanding its Project Glasswing program to about 150 more organizations across 15 countries after its Claude Mythos Preview model found more than 10,000 high- or critical-severity vulnerabilities. The results highlight both the power of AI-assisted bug discovery and the growing challenge of triaging, patching, and disclosing flaws before attackers can exploit them. #Anthropic #ProjectGlasswing #ClaudeMythosPreview #Cloudflare #Mozilla #ClaudeSecurity

Google has released the June 2026 Android security patches to fix 124 vulnerabilities, including CVE-2025-48595, a zero-day flaw that is being exploited in targeted attacks. The update also addresses multiple critical issues across Android System, Framework, and Qualcomm components, with Google urging users to update as soon as possible. #CVE-2025-48595 #AndroidSecurityBulletin #Qualcomm

CISA has ordered federal agencies to patch the actively exploited Oracle WebLogic Server flaw CVE-2024-21182, which affects versions 12.2.1.4.0 and 14.1.1.0.0 and can be abused remotely by unauthenticated attackers. Shodan shows more than 1,592 exposed vulnerable servers online, and CISA is urging all defenders to apply mitigations or stop using the product if protections are unavailable. #OracleWebLogicServer #CVE-2024-21182 #CISA

Security teams are facing two AI-driven challenges at once: attackers are using AI to rapidly evolve phishing infrastructure, while employees are adopting unapproved AI tools, extensions, and OAuth integrations that can expose sensitive data. The article argues that both risks converge in the browser, making browser-level visibility and control the most effective way to detect attacks and govern AI use. #PushSecurity #ShinyHunters #BlackFile #Doko #Vercel #Salesloft #Gainsight #ChatGPT #Claude #MicrosoftCopilot #Gemini

Multiple Instagram users lost access to rare and high-value accounts after attackers tricked Meta’s AI support into accepting fraudulent ownership verification. The recovery process left victims stuck in chatbot loops with no human help, while Meta says it has resolved the issue and is securing impacted accounts. #Instagram #Meta #@korn #@e #@f #JaneManchunWong #ObamaWhiteHouse

A critical flaw in multiple HP Poly Voice VoIP phone models can be exploited for root-level remote code execution through malicious SIP/SDP traffic, putting enterprise networks at risk. Rapid7 says affected devices such as the HP VVX and Trio series should be patched or have ICE disabled where it is not…

AI is enabling zero-knowledge threat actors with little technical skill to generate malicious code, discover vulnerabilities, and launch more effective attacks faster than before. Smaller organizations, AI-enabled phishing, and the shrinking disclosure window are making defense more urgent, especially as attackers pressure traditional security and patching timelines. #Verizon #MITREATLAS #OWASPTop10forLLMApplications #GoogleSAIF…

Anthropic is expanding Project Glasswing to bring more organizations into its AI-driven effort to secure critical software, building on Claude Mythos Preview’s success in finding thousands of vulnerabilities. The new partners include major infrastructure and technology organizations across more than 15 countries, with the focus now shifting from discovery to verification,…

Dashlane said it was targeted in a brute-force campaign that tried to guess 2FA codes and register attacker-controlled devices on user accounts. Fewer than 20 personal plan users had encrypted vault copies downloaded, but the company said the vaults remain protected without the Master Password and there is no evidence its…

A supply chain attack hit Red Hat’s NPM repository, where malicious versions of 32 packages were published in 72 seconds to spread a credential-stealing worm. The malware, linked to the Mini Shai-Hulud variant, targeted developer secrets and GitHub data, prompting Red Hat to release clean versions and urge immediate credential rotation….

Hackers abused a logic flaw in Meta’s AI-powered account recovery assistant to hijack multiple high-profile Instagram accounts by linking attacker-controlled email addresses. The campaign bypassed fraud defenses and even 2FA in some cases, affecting accounts such as the Obama White House, Sephora, and John Bentivegna before Meta fixed the issue. #Meta…

Operation Dragon Weave is a cyber espionage campaign targeting officials and citizens in the Czech Republic and Taiwan, using spear-phishing ZIP files to deploy an AdaptixC2 agent through a Rust-based infection chain. The broader activity also includes China-aligned operations using TencShell, PhiliKit, and Cobalt Strike against government, research, and critical infrastructure…

This week’s roundup highlights active exploitation of a PAN-OS GlobalProtect authentication bypass, a critical zero-day in Gogs, and a Windows Netlogon flaw, alongside takedowns and campaigns involving GlassWorm, GREYVIBE, EvilTokens, and RatPressto. It also shows how AI, poisoned dev tools, and phishing kits are accelerating abuse across open-source ecosystems, enterprise software,…

A new Mini Shai-Hulud supply chain campaign, codenamed Miasma, has compromised multiple @redhat-cloud-services npm packages to steal credentials and secrets from developer machines while also planting a self-propagating worm. Researchers say the malware uses install-time execution, encrypted exfiltration, CI/CD targeting, and persistence tricks, with evidence linking the intrusion to a compromised…