Root on One Kubernetes Node Could Become Every Workload on It
Cryptographic workload identities cannot prove which process asked for them if an attacker controls the node making that claim. Unit 42 demonstrated the risk in SPIFFE/SPIRE.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
Hackers Searched 1.8 Million Android Apps for the Keys to Someone Else’s Business
A working app can still expose a key to private systems. Anthropic describes a 1.8 million-APK credential hunt in Claude-assisted criminal operations, while separate cases show how quickly stolen tokens can become wider access.
A Million Fake CEO Emails Tried to Make Finance Pay a ServiceNow Invoice That Wasn’t Real
A million-plus email campaign combined fake executive approval, a forged ServiceNow invoice and an invented forwarded conversation to seek nearly $50,000 transfers.
The Hidden ChatGPT Task That Read Gmail While the User Saw a Normal Answer
Check Point used a shared internal package service to pass hidden tasks between separate ChatGPT accounts. In its demonstration, the victim saw a normal answer while Gmail data crossed the boundary.
One Police Login on a Personal Device Was Enough to Breach Florida’s DMV
Florida’s 11 September statement identified one compromised police login stored on a personal device. It did not confirm the criminal group’s claimed driver-record count.
The Ivanti ITSM Bugs That Let Strangers Run Code Before Login
Ivanti disclosed eight Neurons for ITSM code-execution flaws, two requiring no login. Its cloud fix and on-premises release-line patches need different checks.
One Click in Sogou’s Keyboard Opened a Six-Year-Old Browser to a Spy Group
Gen Digital traced a GRAYRABBIT intrusion to a crafted Sogou Input Method link. The link opened a six-year-old browser engine with its sandbox disabled, allowing an old JavaScript exploit to run.
How an ‘Anonymous’ Artifactory Token Became an Admin Key for Backdoor Attacks
Wiz observed attackers chaining two Artifactory flaws for administrator access and using a third flaw separately. Some intrusions left persistent accounts, malicious plugins and Rust backdoors.
Were AI Agents Behind the 500 Malicious Packages RubyGems Removed?
A May package flood forced RubyGems to pause sign-ups and remove more than 500 malicious gems. New research points to AI agents, but the evidence remains disputed.
AI Kept Rebuilding This Russia-Linked Malware Until Security Tools Missed It
Anthropic says a Russia-linked espionage operator used AI to monitor detections and keep rebuilding malware until it was no longer detected. The attack cycle, not a single hash, is now the defensive problem.