Tag: exploit
-
SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files
Tags: cve, cvss, exploit, injection, malicious, open-source, rce, remote-code-execution, vulnerabilityA critical security vulnerability has been disclosed in SGLang that, if successfully exploited, could result in remote code execution on susceptible systems.The vulnerability, tracked as CVE-2026-5760, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of command injection leading to the execution of arbitrary code.SGLang is a high-performance,…
-
Article 5 and the EU AI Act’s Absolute Red Lines FireTail Blog
Tags: access, ai, awareness, cctv, cloud, compliance, control, data, detection, exploit, finance, group, healthcare, ibm, infrastructure, Internet, law, microsoft, monitoring, risk, service, technology, tool, training, vulnerabilityApr 20, 2026 – Alan Fagan – Most conversations about the EU AI Act focus on August 2026, when obligations for high-risk AI systems become fully enforceable. But Article 5 is already live. The Act’s eight prohibited practices became enforceable in February 2025. Fines of up to Euro35 million or 7% of global annual turnover…
-
Article 5 and the EU AI Act’s Absolute Red Lines FireTail Blog
Tags: access, ai, awareness, cctv, cloud, compliance, control, data, detection, exploit, finance, group, healthcare, ibm, infrastructure, Internet, law, microsoft, monitoring, risk, service, technology, tool, training, vulnerabilityApr 20, 2026 – Alan Fagan – Most conversations about the EU AI Act focus on August 2026, when obligations for high-risk AI systems become fully enforceable. But Article 5 is already live. The Act’s eight prohibited practices became enforceable in February 2025. Fines of up to Euro35 million or 7% of global annual turnover…
-
A Token Flaw Turned Azure’s AI Agent Into a Spy
Outsiders Could Exploit Misconfig to Stream Commands, Credentials. A misconfiguration in Microsoft’s Azure SRE Agent may have allowed any Azure account holder from any company to tap into another organization’s agent conversations in real time, watching commands, outputs and credentials, leaving no trace. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/token-flaw-turned-azures-ai-agent-into-spy-a-31462
-
A Token Flaw Turned Azure’s AI Agent Into a Spy
Outsiders Could Exploit Misconfig to Stream Commands, Credentials. A misconfiguration in Microsoft’s Azure SRE Agent may have allowed any Azure account holder from any company to tap into another organization’s agent conversations in real time, watching commands, outputs and credentials, leaving no trace. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/token-flaw-turned-azures-ai-agent-into-spy-a-31462
-
2026’s Breach List So Far: FBI Hacked, 1B Androids at Risk, 270M iPhones Vulnerable
From the FBI breach to the DarkSword iPhone exploit, these are the biggest cyber attacks and security failures that have shaped 2026 so far. The post 2026’s Breach List So Far: FBI Hacked, 1B Androids at Risk, 270M iPhones Vulnerable appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-top-cyberattacks-2026-so-far/
-
2026’s Breach List So Far: FBI Hacked, 1B Androids at Risk, 270M iPhones Vulnerable
From the FBI breach to the DarkSword iPhone exploit, these are the biggest cyber attacks and security failures that have shaped 2026 so far. The post 2026’s Breach List So Far: FBI Hacked, 1B Androids at Risk, 270M iPhones Vulnerable appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-top-cyberattacks-2026-so-far/
-
2026’s Breach List So Far: FBI Hacked, 1B Androids at Risk, 270M iPhones Vulnerable
From the FBI breach to the DarkSword iPhone exploit, these are the biggest cyber attacks and security failures that have shaped 2026 so far. The post 2026’s Breach List So Far: FBI Hacked, 1B Androids at Risk, 270M iPhones Vulnerable appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-top-cyberattacks-2026-so-far/
-
Vulnerability exploitation surges often precede disclosure, offering possible early warnings
Organizations can get ahead of major flaws with the right threat intelligence, according to a new report. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/vulnerability-disclosure-surges-warnings-greynoise/817952/
-
Vulnerability exploitation surges often precede disclosure, offering possible early warnings
Organizations can get ahead of major flaws with the right threat intelligence, according to a new report. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/vulnerability-disclosure-surges-warnings-greynoise/817952/
-
Vulnerability exploitation surges often precede disclosure, offering possible early warnings
Organizations can get ahead of major flaws with the right threat intelligence, according to a new report. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/vulnerability-disclosure-surges-warnings-greynoise/817952/
-
AI Changes Focus to Real-Time Cyber Defense
Cisco’s Jeetu Patel on How Machine-Speed Threats Drive Need for AI-Led Security. Cisco’s Jeetu Patel explains how AI models are compressing exploit timelines to minutes, forcing a shift to machine-speed defense, real-time enforcement and deeper ecosystem collaboration to secure critical infrastructure and stay ahead of adversaries. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ai-changes-focus-to-real-time-cyber-defense-a-31463
-
CVE-2023-33538 under attack for a year, but exploitation still unsuccessful
Hackers have targeted CVE-2023-33538 flaw in old TP-Link routers for a year, but no successful exploitation has been seen so far. Hackers have been trying for over a year to exploit a serious flaw, tracked as CVE-2023-33538 (CVSS score of 8.8), in outdated TP-Link routers, but so far without success. The vulnerability is a command…
-
Attackers Exploit DVR Command Injection Flaw to Deploy Mirai-Based Botnet
FortiGuard Labs has identified a Mirai-based Nexcorium campaign actively exploiting CVE-2024-3721 in TBK DVR devices First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/mirai-variant-dvr-flaw-iot-botnet/
-
Hackers exploit Vercel’s trust in AI integration
Allegedly breached by ShinyHunters: According to screenshots circulating on the internet, a threat actor has already claimed the breach on the dark web and is attempting to sell the spoils. “Greetings All, Today I am selling Access Key/ Source Code/ Database from Vercel company,” the actor said in one of such posts. “Give me a…
-
Claude Mythos ist der Hype gerechtfertigt?
Tags: ai, bug, cve, cybersecurity, data, exploit, linux, openai, sans, technology, update, vulnerabilityClaude Mythos wird derzeit von ausgesuchten Organisationen getestet in erster Linie großen Tech-Konzernen aus den USA.Anthropic | ScreenshotDer Hype um Anthropics Security-Modell Mythos bekommt erste Risse: Während KI-Konkurrent OpenAI plant, mit einem eigenen Cybersecurity-fokussierten KI-Modell ‘entgegenzuwirken”, stellen die Sicherheitsexperten von VulnCheck in einer aktuellen Untersuchung die praktischen Auswirkungen von Claude Mythos, respektive ‘Project Glasswing” in…
-
TBK DVR Vulnerability CVE-2024-3721 Exploited to Spread Nexcorium DDoS Malware
Hackers are actively exploiting a critical vulnerability in TBK digital video recorder (DVR) devices to deploy a new Mirai-based botnet called Nexcorium. The campaign leverages CVE-2024-3721, an OS command injection vulnerability, highlighting how poorly secured IoT devices continue to fuel large-scale distributed denial-of-service (DDoS) attacks. Threat actors exploit CVE-2024-3721 by manipulating the “mdb” and “mdc”…
-
AI Model Claude Opus turns bugs into exploits for just $2,283
Claude Opus created a working Chrome exploit for $2,283, showing that widely available AI models can already find and weaponize vulnerabilities. Claude Opus managed to produce a functional Chrome exploit for just $2,283, raising concerns about how easily AI can be used to find and exploit vulnerabilities. Below is the cost of the experiment: Model…
-
Critical Gardyn Flaws Open Smart Garden Devices to Remote Hijacking
A recently updated advisory from the Cybersecurity and Infrastructure Security Agency (CISA) has revealed severe vulnerabilities in Gardyn Home Kit systems. These critical flaws carry a maximum CVSS score of 9.3 and could allow malicious actors to hijack smart gardening devices remotely. According to the April 2026 alert, successful exploitation enables unauthenticated attackers to completely…
-
Project Glasswing: When AI Becomes the Ultimate Hacker”, and Defender
Anthropic has introduced Project Glasswing, a cybersecurity initiative powered by an unreleased AI model called Claude Mythos. This system can identify zero-day vulnerabilities, generate exploits, and even help fix them”, often without human input. But there’s a catch: it’s considered too powerful for public release. In this episode, we discuss what Project Glasswing is, why…
-
Week in review: Acrobat Reader flaw exploited, Claude Mythos offensive capabilities and limits
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Bringing governance and visibility to machine and AI identities In this Help … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/19/week-in-review-acrobat-reader-flaw-exploited-claude-mythos-offensive-capabilities-and-limits/
-
ShowDoc Vulnerability Patched in 2020 Now Used in Active Server Takeovers
Hackers are exploiting a 5-year-old ShowDoc vulnerability (CVE-2025-0520) to deploy web shells, enabling RCE and full server takeover worldwide. First seen on hackread.com Jump to article: hackread.com/showdoc-vulnerability-patch-2020-server-takeover/
-
ShowDoc Vulnerability Patched in 2020 Now Used in Active Server Takeovers
Hackers are exploiting a 5-year-old ShowDoc vulnerability (CVE-2025-0520) to deploy web shells, enabling RCE and full server takeover worldwide. First seen on hackread.com Jump to article: hackread.com/showdoc-vulnerability-patch-2020-server-takeover/
-
Critical flaw in Protobuf library enables JavaScript code execution
Proof-of-concept exploit code has been published for a critical remote code execution flaw in protobuf.js, a widely used JavaScript implementation of Google’s Protocol Buffers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-flaw-in-protobuf-library-enables-javascript-code-execution/
-
Researcher Claims Claude Opus Enabled Creation of Working Chrome Exploit
A security researcher has shown that Anthropic’s Claude Opus can help build a working browser exploit chain against Google Chrome’s V8 engine, raising fresh concerns about how quickly AI can speed up offensive security work. The experiment was published by Mohan Pedhapati, also known as s1r1us, CTO of Hacktron, and it arrived just days after…
-
Researcher Claims Claude Opus Enabled Creation of Working Chrome Exploit
A security researcher has shown that Anthropic’s Claude Opus can help build a working browser exploit chain against Google Chrome’s V8 engine, raising fresh concerns about how quickly AI can speed up offensive security work. The experiment was published by Mohan Pedhapati, also known as s1r1us, CTO of Hacktron, and it arrived just days after…
-
Researcher Claims Claude Opus Enabled Creation of Working Chrome Exploit
A security researcher has shown that Anthropic’s Claude Opus can help build a working browser exploit chain against Google Chrome’s V8 engine, raising fresh concerns about how quickly AI can speed up offensive security work. The experiment was published by Mohan Pedhapati, also known as s1r1us, CTO of Hacktron, and it arrived just days after…
-
Nexcorium Mirai variant exploits TBK DVR flaw to launch DDoS attacks
A Mirai variant called Nexcorium exploits a flaw in TBK DVRs to infect devices and use them in DDoS attacks, along with outdated TP-Link routers. Fortinet researchers found that threat actors are exploiting vulnerabilities in TBK DVRs and end-of-life TP-Link routers to spread a Mirai variant called Nexcorium. >>IoT devices are increasingly prime targets for…
-
Wie Hacker über GitHub-Kommentare KI-Agenten von Google und Anthropic kapern
Ein Sicherheitsforscher hat eine neue Form der Prompt Injection aufgedeckt, die populäre KI-Tools wie Claude Code, Gemini CLI und GitHub Copilot verwundbar macht. Über präparierte Kommentare und PR-Titel können Hacker Schadcode ausführen und sensible API-Schlüssel extrahieren. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/github-kommentare-ki
-
Nexcorium Mirai Variant Weaponises TBK DVR Vulnerability in Fresh IoT Botnet Push
A newly discovered Mirai malware variant named Nexcorium is actively targeting unpatched Internet of Things (IoT) devices. According to recent threat research from FortiGuard Labs, attackers are exploiting a severe vulnerability in TBK DVR systems to build a massive botnet capable of launching destructive distributed denial-of-service (DDoS) attacks. The campaign primarily focuses on CVE-2024-3721, a…