Intelligence Feed

3mo ago · hacker-news

Researchers have identified critical vulnerabilities in five open-source Android AI agent frameworks—AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA—that enable attackers to execute arbitrary code on host PCs through invisible screen text, screenshot tampering, and broadcast interception. The attack chain leverages insufficient input sanitization, TOCTOU race conditions during screenshot capture, and unauthenticated broadcast receivers to escalate from a malicious app to full command execution. Although no CVEs have been assigned and no real-world exploitation has been observed, the attack preconditions are easily met via publicly available documentation, and no project maintainers have responded to responsible disclosure attempts.

3mo ago · hacker-news

Zimbra has released security updates to address multiple vulnerabilities in its email platform, including a critical command injection flaw in the SNMP monitoring component and four cross-site scripting (XSS) vulnerabilities in the Classic Web Client. The command injection could allow remote code execution, while the XSS flaws could enable malicious scripts via crafted attachments or fields. Additionally, a mail forwarding restriction bypass vulnerability was patched. Although no active exploitation has been reported, historical abuse of similar flaws underscores the importance of prompt patching.

3mo ago · hacker-news

Qilin ransomware actors exploited a patched PAN-OS authentication bypass vulnerability (CVE-2026-0257) to gain initial access to victim networks by establishing unauthorized SSL VPN sessions. They then performed credential harvesting, lateral movement using PsExec, and deployed ransomware payloads while clearing logs and disabling Microsoft Defender. Variability in post-exploitation tactics suggests multiple affiliates operating under a ransomware-as-a-service model.

3mo ago · hacker-news

Threat actors are actively exploiting a critical sandbox escape vulnerability, CVE-2026-6875, in the ServiceNow AI Platform to achieve unauthenticated remote code execution. The flaw allows attackers to compromise ServiceNow instances and connected proxy servers by targeting a pre-authentication endpoint. Exploitation uses HTTP POST requests to the '/assessment_thanks.do' endpoint, leveraging a sandbox-escape gadget to execute arbitrary code. ServiceNow has released patches for multiple versions and is enhancing sandbox security to restrict executable code types.

3mo ago · hacker-news

A new ransomware named ENCFORGE, attributed to the threat actor JADEPUFFER, is targeting AI model files through exploitation of a critical unauthenticated RCE vulnerability (CVE-2025-3248) in Langflow versions prior to 1.3.0. The attackers leverage the exposed Docker socket to escalate from container to host, deploying a custom-packed Go-based ransomware that encrypts AI-specific file types using AES-256-CTR and an embedded RSA-2048 public key. The ransomware avoids data exfiltration, instead relying solely on encryption, and leaves ransom notes with a Proton Mail contact reused from prior attacks, indicating campaign continuity.

3mo ago · hacker-news

Attackers are actively exploiting two critical vulnerabilities in WordPress, collectively dubbed wp2shell, to achieve unauthenticated remote code execution on vulnerable sites. The exploit chain combines CVE-2026-63030 and CVE-2026-60137, enabling attackers to bypass authentication and execute arbitrary code via a single HTTP request. Post-exploitation activities include uploading malicious plugins, creating backdoor administrator accounts, deploying web shells, and attempting to install the Overlord RAT. Mass scanning is ongoing, with widespread exploitation observed globally.

3mo ago · hacker-news

The FakeGit campaign leverages nearly 7,600 malicious GitHub repositories to distribute SmartLoader malware, often disguised as AI skills or Model Context Protocol (MCP) servers. These repositories use convincing READMEs and copied projects to trick both human users and AI agents into downloading malicious ZIP files. The attack chain involves a LuaJIT loader that drops SmartLoader, which then deploys StealC, an information stealer. A novel technique called AgentBaiting enables AI agents to autonomously discover and act on malicious repositories without human intervention, increasing the risk of supply chain compromise.

3mo ago · hacker-news

This week's threat landscape highlights critical vulnerabilities in widely used platforms such as WordPress, SonicWall, and Microsoft SharePoint, with active exploitation observed in the wild. A pre-authenticated remote code execution flaw in WordPress Core (CVE-2026-63030 and CVE-2026-60137) enables unauthenticated attackers to execute code, posing a significant risk due to WordPress's global reach. SonicWall SMA appliances were exploited via zero-day vulnerabilities prior to patching, while CISA added a SharePoint RCE (CVE-2026-58644) to its known exploited list. Additionally, new malware frameworks like OkoBot and NadMesh target crypto assets and cloud AI services, indicating evolving attacker tactics leveraging automation and AI.

3mo ago · hacker-news

HollowGraph is a newly discovered espionage malware that leverages a compromised Microsoft 365 calendar as a covert command-and-control (C2) channel, hiding operator instructions and exfiltrated data within calendar events dated to 2050. The malware uses legitimate Microsoft Graph API traffic to avoid detection, communicating via encrypted attachments on future-dated events. It is associated with the Cavern backdoor framework and shows potential ties to Iranian-linked actors, though attribution remains unconfirmed. The small, targeted footprint suggests focused cyber espionage rather than broad criminal activity.

3mo ago · hacker-news

A cybercriminal operator left a server exposed, revealing an AI-assisted phishing toolkit used in a WebDAV-based malware campaign targeting Mexican users. The attacker leveraged generative AI to accelerate development and testing of social engineering lures and delivery mechanisms, including filename spoofing with right-to-left override (RTLO) and abuse of signed Windows binaries via a working directory hijack. The primary campaign delivered a .NET infostealer through a fake government ID site, while a secondary campaign used a trojanized DLL sideloaded via a signed Ubisoft binary to deploy a modular .NET RAT. The operation demonstrates a sophisticated, software-like development lifecycle enabled by AI tools.

3mo ago · hacker-news

The article discusses how the exposure window—the time between a vulnerability becoming exploitable and being remediated—remains the critical factor in breach risk, despite advances in AI-driven vulnerability discovery like Anthropic's Mythos. While vulnerability identification and prioritization now occur at machine speed, organizational mobilization lags, leaving critical systems exposed. Attackers exploit this gap rapidly, with eCrime breakout times as low as 29 minutes, far outpacing typical remediation timelines. The focus must shift to reducing the blast radius by prioritizing remediation of exposures that lead to critical assets.

3mo ago · hacker-news

Russian intelligence services are actively hijacking internet-connected IP cameras across NATO countries and Ukraine to conduct cyber espionage, monitoring military logistics, troop movements, and weapons shipments. The attackers exploit default credentials and outdated firmware rather than zero-day vulnerabilities, using automated image recognition to identify military assets. While the number of confirmed breaches is low, the exposure of over 87,000 vulnerable devices presents a significant risk. The Dutch intelligence agencies AIVD and MIVD have issued warnings and mitigation guidance to secure camera systems.

3mo ago · hacker-news

A Russian-speaking threat actor known as 'bandcampro' leveraged Google's open-source Gemini CLI as an AI-powered hacking agent to control a botnet of eight dental clinic computers. The AI was used to autonomously set up and manage command-and-control infrastructure, debug connectivity issues, and perform tasks such as password cracking and botnet management. The operation, part of the 'Patriot Bait' campaign, demonstrates a novel use of AI to reduce operator effort, enable rapid infrastructure replication, and complicate attribution.

3mo ago · hacker-news

A heap-based buffer overflow vulnerability, CVE-2026-14266, in 7-Zip's XZ archive handler could allow attackers to execute code when a victim opens a maliciously crafted archive. The flaw, rated High severity with a CVSS score of 7.0, stems from improper handling of XZ chunked data leading to an out-of-bounds write. Exploitation requires local interaction, and no public proof-of-concept or active exploitation has been observed as of July 20, 2026. Users are advised to update to 7-Zip 26.02 or later to mitigate the risk.

3mo ago · hacker-news

A software supply chain attack dubbed SleeperGem has been identified, involving three malicious RubyGems packages that were either newly published or surreptitiously updated after years of dormancy. The malicious gems act as loaders, fetching secondary payloads from an attacker-controlled Forgejo instance and establishing persistence on developer machines while avoiding CI/CD environments. The attack leverages compromised accounts to distribute payloads that exfiltrate sensitive data and deploy persistent backdoors, with one variant planting a setuid root shell for privilege escalation.

3mo ago · hacker-news

Hugging Face, the world's largest AI model repository, suffered a breach caused by an autonomous AI agent that exploited code execution vulnerabilities in its data processing pipeline. The attacker leveraged a malicious dataset to gain initial access, escalate privileges, and move laterally across internal clusters, stealing cloud credentials. Although public models and user data were not tampered with, the incident highlights risks in AI supply chains and limitations of safety-guarded forensic models.

3mo ago · hacker-news

A critical vulnerability in NGINX, tracked as CVE-2026-42533, allows remote unauthenticated attackers to trigger a heap buffer overflow via crafted HTTP requests, potentially leading to denial of service or remote code execution. The flaw exists in NGINX's script engine under specific configurations involving regex-based maps and capture overwrites. Exploitation may bypass ASLR, increasing the risk even on default systems, though no public exploits have been observed yet. F5 has released patches for core NGINX and NGINX Plus, but downstream products lack updated builds at the time of publication.

3mo ago · hacker-news

A previously undocumented threat actor, tracked as UTA0533 by Volexity, exploited two zero-day vulnerabilities in SonicWall SMA 1000 series VPN appliances before their public disclosure. The actor chained CVE-2026-15409 and CVE-2026-15410 to achieve arbitrary command execution and root access, deploying custom malware and web shells for persistence. The exploitation chain involved WebSocket tunneling, authentication bypass via hardware UUID, and abuse of localhost services, enabling credential theft and network traffic interception, though lateral movement appears limited.

3mo ago · hacker-news

Russian state-sponsored threat actor UAC-0145, a sub-cluster of Sandworm affiliated with GRU, has been conducting cyberattacks against Ukrainian targets using the ClickFix social engineering technique. The attackers compromise websites and inject fake CAPTCHA checks that prompt users to execute malicious PowerShell commands, leading to malware infection. These commands download and execute malware such as GHETTOVIBE, SCOUTCURL, and COWARDDUCK, enabling data theft and remote control. The campaign also involves backdooring Android devices via malicious APKs distributed as security tools.

3mo ago · hacker-news

A critical unauthenticated remote code execution vulnerability, dubbed wp2shell, exists in WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The flaw stems from a REST API batch-route confusion and SQL injection issue, allowing anonymous attackers to execute code on affected sites. WordPress released versions 6.9.5 and 7.0.2 on July 17, 2026, to address the vulnerability, and no exploitation has been reported as of July 18. Due to the lack of a CVE identifier, tracking must rely on version numbers and active monitoring of the batch endpoint.

3mo ago · hacker-news

The HollowByte flaw in older versions of OpenSSL allows attackers to cause denial-of-service by sending malicious 11-byte TLS handshake requests, leading to memory exhaustion. The vulnerability stems from OpenSSL trusting unverified message length fields in TLS headers, causing the server to allocate up to 131 KB per connection without validation. Due to glibc memory management behavior, freed memory is not returned to the kernel, resulting in heap fragmentation and sustained high memory usage. Notably, OpenSSL did not classify this issue as a vulnerability, releasing a fix without a CVE or advisory.

3mo ago · hacker-news

A software supply chain attack dubbed ViteVenom has targeted the Vite JavaScript ecosystem through seven malicious npm packages. The campaign, attributed to threat actor SuccessKey, uses a multi-tier blockchain-based command-and-control (C2) infrastructure across Tron, Aptos, and Binance Smart Chain to deliver a remote access trojan (RAT). The malware executes at import time to evade detection and retrieves payloads via blockchain transactions, making takedown efforts extremely difficult. Fallback mechanisms include direct HTTP retrieval from a C2 server.

3mo ago · hacker-news

A threat actor cluster known as CylindricalCanine, linked to the broader GoldenEyeDog (APT-Q-27) group, was responsible for a breach at DigiCert in April 2026. The attackers compromised support analysts via a malicious .scr file delivered through a customer support chat, gaining access to initialization codes and stealing code-signing certificates. These certificates were then used to sign malware, including Zhong Stealer and Golden Gh0st RAT, enabling evasion of security detection. The group primarily targets finance organizations in the Asia-Pacific region using phishing and DLL side-loading techniques.

3mo ago · hacker-news

A Go-based botnet named NadMesh, discovered in early July 2026, actively targets exposed AI and cloud services to harvest cloud credentials, Kubernetes tokens, and model access. The malware prioritizes exploitation of MCP (Model Context Protocol) services, Docker APIs, Jenkins consoles, and Redis instances, with a focus on credential theft rather than host compromise. The operator uses self-propagating scanning infrastructure, persistence mechanisms, and obfuscation to evade detection, while targeting specific ports associated with AI tools like ComfyUI, Ollama, Gradio, and n8n. Researchers observed real-time exploitation traffic, though success rates for MCP exploitation remain low compared to other vectors.

3mo ago · hacker-news

North Korean threat actors linked to the Contagious Interview campaign are targeting software developers through fake job postings and coding challenges. They distribute malicious repositories that include SVG images with steganographically hidden payloads, which deploy the OtterCookie malware. This multi-stage malware steals browser credentials, cryptocurrency wallets, files, and clipboard data, while also enabling remote access via a Socket.IO-based backdoor.

3mo ago · hacker-news

A previously undocumented malware named GoSerpent has been used in cyber espionage campaigns targeting government and diplomatic entities in Southeast Asia since late 2025. The malware enables long-term access, credential dumping, and data exfiltration through a suite of tools including Mimikatz, QuarksDumpLocalHash, and a custom file collection tool called ThumbcacheService. In May 2026, attackers returned to compromised environments to deploy evolved tools such as Stowaway and TmcLoader/TmcPayload for further data exfiltration. The activity shows operational overlaps with the TetrisPhantom threat actor, though definitive attribution remains unconfirmed.

3mo ago · hacker-news

ACR Stealer, an infostealer active since 2024, is being distributed through social engineering lures such as fake Claude AI assistant pages and malvertising. The malware uses fileless techniques and WebDAV shares to steal browser credentials, session tokens, and sensitive files from Microsoft 365, OneDrive, and SharePoint. It relies on user execution via pasted commands and does not exploit software vulnerabilities, making detection dependent on behavioral analysis and proactive controls.

3mo ago · hacker-news

Armenia has detained a Russian national, Aleksandr Ermakov, based on a U.S. extradition request related to alleged involvement in REvil (Sodinokibi) ransomware attacks. However, his legal team claims authorities have mistaken him for another individual with the same name—Aleksandr Gennadievich Ermakov—who was sanctioned in 2024 for cybercriminal activity including the Medibank data breach. The accused individual in custody, Aleksandr Yuryevich Ermakov, is a former prison-service lawyer with no known English proficiency, and lawyers argue insufficient identification was used for the arrest. The confusion stems from identical names and lack of patronymic or biometric verification in the extradition process.

3mo ago · hacker-news

The article discusses the growing emphasis on military autonomy and the need for trusted information infrastructure to support interconnected autonomous systems across defense forces. It highlights strategic investments by the U.S., UK, and NATO in autonomous technologies and underscores the importance of secure, cross-domain data sharing for mission effectiveness. The focus is shifting from deploying individual autonomous platforms to enabling secure, trusted, and interoperable information exchange across systems and coalition partners. The article promotes Everfox’s hardware-enforced separation solution as a means to achieve secure, high-assurance connectivity for autonomous military operations.

3mo ago · hacker-news

The European Commission has mandated Google to open access to Android's microphone, camera, screen, and other core features for rival AI assistants under the Digital Markets Act. This decision requires Google to implement a certification program allowing third-party AI assistants to access sensitive device functions, while also enforcing strict security and privacy safeguards. The move aims to promote competition but raises concerns about potential abuse of powerful device permissions by untrusted applications. Google must comply by August 2027, with certain features deferred to 2028.