Critical Code Execution Vulnerability Patched in TeamCity
Tracked as CVE-2026-63077, the security defect can be exploited without authentication via the agent polling protocol. The post Critical Code Execution Vulne...
general
20 articles
Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations
Anthropic on Thursday became the latest artificial intelligence (AI) company to reveal that three of its models, including Claude Opus 4.7, Mythos 5, and an ...
ShutterGap Exposes Millions of Misconfigured AWS Resources to Attackers
A cloud-security blind spot known as Cloud ShutterGap, which involves millions of AWS resources being briefly exposed to the public before being removed, oft...
Astaroth Banking Trojan Adds WhatsApp Web Spambot to Spread Malware Across Brazil
Astaroth operators have expanded their Brazilian banking malware operations by weaponizing a new WhatsApp Web spambot module that turns infected hosts into a...
CISA Urges Water Utilities to Remove Publicly Exposed PLCs From the Internet
The U.S.
CosmosEscape Vulnerability Enables Full Takeover of Azure Cosmos DB Databases
A critical vulnerability chain in Azure Cosmos DB, named CosmosEscape, allowed attackers to gain full read and write access to every Cosmos DB database, incl...
Aviation cyber risk sits on the ground, the blindness sits in the air
In this interview with Help Net Security, Eliran Almong, CEO of Cyviation, explains why airline cyber losses happen on the ground while the aircraft stays un...
OctLurk and SilkLurk Backdoors Target Central Asian Governments in Cyberespionage Campaign
OctLurk and SilkLurk are highly customized, memory‑resident backdoors used in an ongoing cyberespionage campaign against government and critical‑sector netwo...
Analog Devices Confirms Cyberattack After Hackers Exfiltrate Files From Company Systems
Analog Devices, Inc. has confirmed that unauthorized actors gained access to certain company systems and exfiltrated files.
Companies push AI, sysadmins keep it on a short leash
In 2024, sysadmins expected AI to automate patch management optimization, vulnerability prioritization, infrastructure monitoring, and incident response with...
Anthropic Confirms Claude AI Models Hacked 3 Organizations During Cybersecurity Evaluations
Anthropic has disclosed that three Claude AI models gained unauthorized access to the production systems of three real-world organizations during cybersecuri...
AI agents are changing where cybersecurity seed funding lands
Founders pitching a cybersecurity seed round this summer are joining a line that keeps getting longer. Product Hunt launches hit their highest level since la...
New infosec products of the week: July 31, 2026
Here’s a look at the most interesting products from the past week, featuring releases from BlackCloak, Contrast Security, Dropzone AI, PortSwigger, Realm Sec...
Finland to disconnect fiber-optic link to Russia as lease expires
Finland stopped power transmissions with Russia at the start of the war in Ukraine, and two related telecom connections will stop at the end of this year, au...
Anthropic says its AI accidentally hacked three companies during safety tests
Following OpenAI’s own incident, Anthropic reviewed its own evaluations and found three cases of Claude hacking external companies. The post Anthropic says i...
Claude uploaded malware to PyPI in Anthropic's botched test
One of Anthropic's Claude models built and uploaded a malicious Python package to PyPI during a botched security evaluation, where it ran on 15 real systems ...
Anthropic's Claude breached 3 orgs, uploaded PyPI malware during tests
One of Anthropic's Claude models built and uploaded a malicious Python package to PyPI during a botched security evaluation, where it ran on 15 real systems ...
Okta to acquire identity threat detection startup Permiso Security
The acquisition aims to integrate Permiso’s technology for detecting and mitigating identity threats across human, non-human, and agentic identities into Okt...
UK Department for Education confirms data breach affecting over 600,000 records
The breach, claimed by the ExfilSquad hacking group, exposed names, job titles, and phone numbers of head teachers, university staff, and government officials.
AI amplifies dangling DNS takeover risks, research shows
Security firm Silent Push's research, dubbed "DangleGeddon," utilized AI to massively expand the discovery of vulnerable domains and subdomains.