Someone Reprogrammed the Router Into a Listening Post
Fire Ant turned a Cisco IOS XR router, TACACS systems and Linux management hosts into a covert collection and access platform.
A Read-Only OpenSearch User Could Run Code on the Server
AWS has fixed a high-severity OpenSearch SQL Plugin flaw that turns a low-privilege search account into a route to arbitrary code execution on the server. The dangerous part is the permission boundary: the account only needs basic read and search…
Berlin Refused Rhysida’s Ransom and the Leaks Kept Coming
Berlin says Rhysida released a further stolen-data package containing access credentials, forcing additional safeguards and possible service restrictions.
Australia’s AI Music ‘Ban’ Has One Big Weakness: It Starts With Self-Reporting
Australia excluded AI-led recordings from its charts, but enforcement begins with declarations from rights holders. The rule is clear. Its evidence model is not.
Six AshAI Flaws Turned Prompts Into a Path to Server Takeover
AshAI disclosed six vulnerabilities, including a CVSS 10 flaw that compiled attacker-controlled prompt content as Elixir before any model request.
An Estimated $75 Million Was Exposed, Then Cronos Pulled the Emergency Brake
Cronos halted its entire network after an exploit in Tectonic. The incident turns a DeFi collateral failure into a test of chain-wide emergency governance.
The Extension Changed Owners. Its Permissions Did Not.
Nineteen Chrome and Edge extensions delivered wallet-draining and credential-stealing modules, including five legitimate tools weaponised after ownership changes.
The Provenance Was Valid. The Workflow Let Anyone Publish the Malware.
Ten malicious npm releases carried valid provenance because an outsider could drive the project’s trusted GitHub Actions publishing workflow.
The AI Gateway Held the Keys. Attackers Turned LiteLLM Into a Credential and Persistence Hub.
Microsoft observed attackers turning exposed LiteLLM gateways into credential-harvesting, database-access and persistence hubs. The public exploit chain makes AI gateways a Tier-0 patching priority.
The CAPTCHA was the Door. TerminalFix Turned One Windows PC Into a Network Tunnel.
A fake verification prompt led to DLL sideloading, Active Directory reconnaissance and a reverse tunnel that turned one Windows endpoint into an internal network pivot.
The Argo CD Token Was Outbound. The MCP Server Treated Every Caller as Trusted.
argocd-mcp 0.8.0 exposed its Argo CD tool surface without caller authentication, letting reachable clients act with the server's stored token. Version 0.9.0 rebuilds the boundary.
Hasbro Shut Down the Account. The Identity Data Was Already Gone.
Hasbro says a compromised employee account exposed personal and financial information. Massachusetts records identify 436 affected residents, while the worldwide total remains undisclosed.