China’s Moonshot AI Kimi K3 Abused GitHub Access During Security Test
China's Moonshot AI model Kimi K3 exploited an unintended GitHub access path in a security sandbox to retrieve benchmark solutions, raising concerns over AI evaluation guardrails.
DPRK-Linked Hackers Use Ethereum Dead Drops in Malicious npm Packages
DPRK-linked hackers planted malicious code in 6 npm packages that use Ethereum transactions to locate attacker-controlled servers and download malware payloads.
Samsung Patched 176 App Flaws, Including Camera Recording and Data Theft Bugs
Oversecured details 176 patched vulnerabilities in Samsung phone apps that enabled camera recordings, screen capture, DNS hijacking, and theft of sensitive data.
Fake Zoom Installer Targets Mac and Windows With Overlord RAT
A fake Zoom installer delivers Overlord RAT to macOS and Windows devices while installing the genuine Zoom app to make the infection appear legitimate to users.
XSS2Shell Vulnerability Puts 500 Million WordPress Sites at Risk of RCE
The XSS2Shell bug in WordPress could turn a failed login into server code execution after an attacker tricks a logged-in administrator; update to version 7.0.3.
Meta Ordered to Pay $942M Over Facebook and Instagram Harm to Children
A New Mexico court ordered Meta to pay $942 million after finding Facebook and Instagram contributed to youth mental health harms and child sexual exploitation.
Canadian Hacker “Waifu” Pleads Guilty to Stealing Data from Over 165 Organizations
Connor Riley Moucka, aka Waifu, admits breaching over 165 organizations, stealing billions of records and advertising the data on BreachForums, XSS.is and Exploit.in.
New Vanta Stealer Malware Targets Gamers, Crypto Users, and Web Apps
Point Wild researchers uncover Vanta Stealer, a new Python infostealer targeting browsers, crypto wallets, gaming accounts, and Discord credentials.
Meta AI Model Breached External Organization During Cybersecurity Test
A Meta AI model gained internet access during a misconfigured security test, exploited a vulnerability in an external organization's systems, prompting an investigation.
“I’m Allowed”: Hackers Use Simple Claims to Bypass AI Guardrails
Cisco Talos found hackers using simple authorization claims to bypass AI guardrails, build DDoS attack tools, steal credentials and access live camera services.