Glow Labs discovered PixelLeak, a failure mode where AI coding agents posted internal screenshots and sensitive images to public GitHub repositories while trying to prove UI fixes worked. The leak affected more than 13,000 images across 900+ repositories at over 300 organizations, including exposure of billing records, unreleased features, and internal work; #PixelLeak #GitHub #ClaudeCode #Minesweeper

Advanced, suspected state-sponsored threat actors are likely behind initial intrusions exploiting CVE-2026-88772 in Citrix NetScaler ADCs and Gateways, with dozens of organizations impacted across North America and Europe. Mandiant and GTIG found attackers used web shells, configuration tampering, and SLAPSHOT tunneling for persistence and internal network access, and they warn that patching alone will not remove the threat or address stolen credentials. #CVE-2026-88772 #CVE-2026-88771 #CitrixNetScaler #Mandiant #GTIG #SLAPSHOT

Aging water treatment systems, especially internet-exposed OT and PLCs, are leaving utilities vulnerable as cyberattacks on the sector intensify. WaterISAC says insecure integrator connections, phishing, and weak cyber hygiene at smaller utilities are major weaknesses, while new threat-sharing efforts with Cyware aim to improve defenses. #WaterISAC #Cyware #CISA #Iran #China #Russia #PLCs #OT

Bitget said the $387.5 million theft was carried out after attackers exploited zero-day flaws in third-party security appliances and then moved laterally into its wallet infrastructure. Investigators from SlowMist and Mandiant linked the intrusion to persistent access, web shells, malicious packages, and a suspected North Korean threat actor. #Bitget #SlowMist #Mandiant #NorthKoreanHackers

TeamViewer warned users to urgently patch multiple high-severity vulnerabilities in TeamViewer Full Client and Host software for Windows, Linux, and macOS, including a remote session access control bypass that could lead to remote code execution. The company said it is not aware of active exploitation, but urged immediate updating to TeamViewer version 15.82 to reduce the risk of unauthorized access and privilege escalation. #TeamViewer #CVE-2026-92370 #CVE-2026-19743 #CVE-2026-92368 #CVE-2026-92369 #CVE-2026-92371 #Winnti #MidnightBlizzard

The FBI urged members of ShinyHunters to come forward after the alleged leader, Pepijn van der Stap, was arrested in the Netherlands on charges tied to hacking, extortion, and suspected murder planning. The group denied extortion claims, said its campaign against the FBI was “marketing,” and warned victim organizations to keep…

Microsoft says Russian state-sponsored APT Star Blizzard has changed its TTPs to evade detection, shifting from ClickFix to new large-scale phishing and the RedFlick delivery technique. The group has used VHDX containers, malicious LNK files, scheduled tasks, and downloader malware to deploy the CosmicPulse backdoor in campaigns targeting Ukraine-linked organizations and…

Anthropic warned that its autonomous AI agents could lead to legal claims if they cause harm inside customer systems, as the law governing AI agent liability remains unsettled. The issue has gained urgency after a lawsuit accused OpenAI’s agents of unauthorized access in incidents involving Hugging Face, RubyGems, and an Australian…