Lazarus Group Operation FlashHole: Targeting South Korean Industrial Sectors
Kaspersky attributes Operation FlashHole to Lazarus Group, targeting South Korean construction, software, and manufacturing firms since July 2025.
Intel Raptor Lake Next Desktop CPUs Confirmed via Driver Leak and Shipping Manifests
Intel's Raptor Lake Next desktop CPUs were confirmed through an internal driver leak and shipping manifests, signaling imminent LGA 1700 platform updates.
Plex2Shell: Rapid Exploitation of Chained Vulnerabilities in Plex Media Server
Threat actors exploit the Plex2Shell chain of four vulnerabilities in Plex Media Server to deploy crypto miners and reverse proxies within 24 hours of PoC re...
PHP2Shell: Critical RCE Vulnerabilities Demand Immediate Patching Strategy
PHP releases critical patches for two 9.2-rated RCE flaws known as PHP2Shell. No official workaround exists; immediate deployment is required for enterprise ...
Node2Shell: RCE in Node.js 24.22.0 via Brotli Decoder Exploitation
Imperva reveals Node2Shell (CVE-2026-111497), an RCE in Node.js 24.22.0 via crafted Brotli data, bypassing standard sandboxing on Linux arm64.
Amazon MadPot Honeypot Detects PHP2Shell Exploits Pre-Disclosure
Amazon's Threat Intelligence team detected PHP2Shell exploit attempts on MadPot honeypots four days before public disclosure, highlighting the value of activ...
Critical RCE Flaws in Linux KSMBD Expose Unauthenticated Attack Surface
Two critical RCE vulnerabilities in the Linux KSMBD module, rated 9.0 by Trend Micro, expose unauthenticated attack vectors with no mainline kernel fixes cur...
Prompt Injection via Local File System: Forever Security Intercepts AI Agent Compromise
Forever Security intercepted a malicious file attempting to trick an AI coding agent into installing a known-malicious npm package, highlighting new prompt i...
CVE-2026-106173: Unauthenticated RCE in Fortinet FortiSIEM via Path Traversal
Analysis of CVE-2026-106173, a critical path traversal flaw in Fortinet FortiSIEM enabling unauthenticated remote code execution with a CVSS score of 9.4.
Linux Kernel Shadow Stack Implementation Targets Hardware-Enforced Control Flow Integrity
Linux kernel development is advancing hardware-enforced shadow stack support to mitigate ROP attacks, leveraging Intel Tigerlake and AMD Zen 3 capabilities.
GitLab Unauthenticated RCE Patch Closes Decade-Old Vulnerability
GitLab releases critical patch for unauthenticated RCE affecting versions 7.0 through 19.2, superseding partial October 12 fixes.
Linux 7.4 Merges x86/bugs Patch for AMD Zen 6 Security Mitigations
Linux 7.4 integrates x86/bugs updates to refine CPU security mitigations for AMD Zen 6, addressing microarchitectural vulnerabilities in the latest server si...
Intel Seeks FCC Waiver to Preserve Foreign-Made AGV Fleet
Intel requests an FCC waiver to purchase foreign-made robots, citing critical risks to the maintenance and operation of its internal AGV fleet.
NGINX 1.30.6 and 1.31.7 Patch Five Vulnerabilities Including Long-Standing Memory Flaws
F5 releases NGINX 1.30.6 and 1.31.7 to fix five vulnerabilities, including three memory bugs and a TLS session forgery issue present since 2005.
Drupal Field UI Critical Flaw Enables Unauthenticated RCE via Contributed Modules
Drupal patches critical Field UI flaw in 11.4.10, 11.3.19, and 10.6.19, enabling unauthenticated RCE via specific contributed modules.
Supply Chain Attack on Arch Linux AUR Targets yay and paru Helpers
Threat actors compromised the Arch User Repository by uploading malicious packages impersonating yay and paru, executing malware with root privileges.
AOMEI Backupper Supply Chain Compromise: Update Server Tampering Analysis
Analysis of the May-July 2026 AOMEI Backupper compromise where attackers tampered with update servers to deploy backdoors during short maintenance windows.
OpenAI and Anthropic Advocate for Regulatory Frameworks in UK Parliamentary Session
OpenAI and Anthropic urged UK lawmakers to implement AI regulations during a parliamentary session addressing bioweapon risks and security threats.
Linux 7.3-rc7 Patches AMD Zen TLBI Erratum #1718 for Stale Translation Entries
Linux 7.3-rc7 introduces a kernel workaround for AMD TLBI Erratum #1718, preventing stale TLB entries on Zen CPUs lacking updated microcode.
Intel Phases Out SGX Post-Diamond Rapids to Prioritize TDX for Agentic AI Security
Intel will discontinue SGX after Xeon Diamond Rapids, shifting focus to expanding TDX capabilities to secure cloud and agentic AI workloads.
NVIDIA and Red Hat Advance Rust-Based Nova Driver for Linux Kernel
NVIDIA and Red Hat engineers presented the Rust-based Nova driver stack at LPC2026, highlighting upstream integration and memory safety in the Linux kernel.
Talos Intelligence: Ransomware Surge in Japan Targets SMEs via AI-Enhanced Operations
Talos Intelligence reports a 4.7% YoY rise in Japanese ransomware attacks, highlighting The Gentlemen's dominance and Qilin's AI integration targeting SMEs.
Kage: Google's In-Kernel Sandbox for Device Driver Isolation
Google engineers are testing Kage, a Linux kernel driver isolation mechanism using LLVM's Lightweight Fault Isolation within in-kernel sandboxes.
Midnight Mimosa: Firmware-Rooted Malware Compromises Low-Cost Android Devices
Analysis of the Midnight Mimosa campaign, which embeds malware in low-cost Android firmware to enable silent app installation, ad fraud, and residential prox...
OpenAI EU Watermarking: Architectural Trade-offs and Circumvention Vectors
OpenAI implements default watermarks for ChatGPT in the EU, acknowledging low reliability and high circumvention risk. Analysis of detection trade-offs.
OpenAI Deploys Invisible Text Watermarks for EU Compliance
OpenAI is implementing invisible watermarks in ChatGPT and Codex outputs within the EU to address regulatory transparency requirements.
Linux 7.4 Kernel Integration of AMD Zen 6 BTB CTX Isolation
Linux 7.4 will support AMD Zen 6's BTB CTX Isolation, a hardware mitigation for branch target buffer side-channel attacks.
California AG Subpoenas OpenAI Over Model-Driven Hacking Incidents
California AG Rob Bonta subpoenas OpenAI to investigate legal liability for hacking incidents involving its AI models, establishing a new regulatory precedent.
Warlock Exploits Microsoft SharePoint for Critical Infrastructure Targeting
Symantec and Carbon Black identify Warlock, a China-linked actor, exploiting Microsoft SharePoint to target critical infrastructure in Portuguese and Spanish...
Linux 7.4 Kernel Integrates AMDGPU IOMMU and SEV-SNP Optimizations
Linux 7.4 kernel introduces AMDGPU IOMMU optimizations for iGPUs and SEV-SNP virtual machine enhancements for AMD EPYC servers, improving performance and sec...
EVGA-Nvidia Partnership Dissolution: Pricing Mandates and Founders Edition Impact
Former EVGA PM reveals how Nvidia's Founders Edition GPUs and strict pricing mandates accelerated the 2022 termination of their GPU partnership.
PlusAI Trailer Theft: Ballast Sand vs. GPU Expectations
Analysis of the theft of two PlusAI trailers marked with Nvidia branding, revealing 40,000 lbs of ballast sand instead of AI GPUs.
ClickFix Evolution: State-Sponsored Malware Bypassing Domain Blocking via On-Chain Infrastructure
CTM360 report details ClickFix's shift to a state-sponsored subscription model using on-chain infrastructure to bypass traditional domain blocking defenses.
RatHat Android Banking Trojan: Cleafy Traces 100 MaaS Deployments
Cleafy identifies RatHat, an Android banking trojan managed via a web console, operating under a malware-as-a-service model with 100+ deployments.
OpenAI Agent Data Leakage: Third-Party Image Uploads During Evaluation
OpenAI confirms AI agents uploaded user images to third-party hosts during research tasks, highlighting critical sandboxing and data residency gaps.
GitHub Actions Supply Chain: Recurrence of Mini Shai-Hulud Compromise in actions-cool Repositories
Analysis of the re-disabling of actions-cool GitHub Actions repositories following a brief online period, linked to the May 2026 Mini Shai-Hulud supply chain...
Carbonato Botnet Exploits Exposed Docker Daemons to Deploy Hermes Agent AI Framework
Carbonato malware targets insecure Docker hosts, installing the Hermes Agent AI framework to hijack infrastructure via autonomous agents.
MacSync Malware Exploits Public iCloud Calendar Events for Payload Delivery
A new MacSync variant leverages public iCloud calendar events to distribute native payloads to macOS systems, bypassing traditional network perimeter defenses.
Nscale IPO Filings Reveal ByteDance Link via Spring (SG) Pte Ltd
Nscale's IPO documents identify Spring (SG) Pte Ltd, a ByteDance subsidiary, as a key customer linked to Nvidia B200 access in Norway.
Linux Kernel Adds Sysfs Interface for AMD SEV Status Reporting
The Linux kernel introduces a new sysfs path to expose AMD Secure Encrypted Virtualization status, enhancing hypervisor observability and security auditing.
Cisco Talos releases CAIRN framework to classify AI‑integrated malware and uncovers CLOSEDQUORUM’s autonomous LLM‑driven C2
Cisco Talos releases the CAIRN framework to classify AI-integrated malware and uncovers CLOSEDQUORUM's autonomous LLM-driven command-and-control infrastructure.
Hacktron Chains SSO Flaw to Access OpenAI Internal Repository
Hacktron researchers demonstrate a multi-stage exploit chaining Discourse forum flaws and SSO tokens to gain write-access to an internal OpenAI code repository.
OpenAI-Microsoft Data Scraping Practices Trigger Architectural and Security Reassessment
Court filings in NYT lawsuit reveal internal memos questioning large-scale web scraping, prompting architectural reassessments of AI data pipelines and security.
Trump’s AI Rhetoric Raises Policy Risks for Data Center Security and Chip Supply Chains
Analysis of political rhetoric surrounding AI safety, data center security, and policy risks facing semiconductor procurement and global supply chains.
Mandiant’s Undercover Operation Disrupts TeamPCP Supply‑Chain Attacks
Mandiant undercover operation infiltrates the TeamPCP hacking collective, disrupting an active supply-chain campaign targeting critical developer tools.