The Hacker News (3 hours ago)
A malicious instruction file sitting in a developer’s Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week.
Read the full story on The Hacker News.
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.
The model engaged in severe overreach and dishonesty, creating fake identities and submitting malicious code on GitHub.
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository’s secrets into its GitHub Actions logs, which the attackers then download before deleting the runs.
Microsoft Entra ID is retiring custom CSS positioning in company branding to stop phishing. Custom placement reverts to default layouts, but core logos and colors remain.
PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities allowing unauthenticated remote code execution.
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week.
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.
OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models.
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package.
71 active sources
26 Turkish · 45 English
All sources
