Accenture's Source Code Is Up for Sale

Accenture, a global consulting and IT services firm that works with major corporations and governments worldwide, has confirmed it was breached after a hacker going by "888" began selling stolen data on a cybercrime forum, according to Bleeping Computer.

The threat actor claims to have taken just over 35 GB of data. The alleged haul includes source code, RSA keys (private encryption credentials), SSH keys (used to authenticate into servers remotely), Azure PAT tokens (personal access tokens that grant programmatic access to Microsoft Azure cloud services), storage access keys, and configuration files. As proof, the attacker shared a screenshot showing them cloning an internal Azure DevOps repository under an Accenture hostname.

Accenture confirmed the incident, saying the source had been remediated and that operations were unaffected. The company did not comment on what was actually taken, how the attackers got in, or whether any customer data was exposed.

This is not a first offence for either party. The same "888" actor previously tried to sell Accenture employee data after a third-party breach in 2024. The LockBit ransomware group also hit Accenture in 2021.

The real concern here is the type of data reportedly stolen. Source code and cloud access tokens are not just embarrassing to lose — they are keys to the kingdom. An attacker holding a company's Azure access keys can potentially reach anything that company stores or builds in the cloud.

What you should do: If your organisation uses Accenture-managed services or shared cloud environments, contact your account team to confirm whether your infrastructure was within scope of the affected systems.

A piece in The Hacker News makes a point worth sitting with: AI tools are no longer just assistants in software development — they are now load-bearing parts of the build pipeline. That changes the threat model entirely.

The old supply chain security question was: what packages are in your code? The new one is: what prompted your AI agent to pull in those packages, and can you trust the model that suggested them?

Prompt injection (an attack where malicious instructions are hidden somewhere a model will read them, steering it to do something harmful) is now a real way to compromise software before it ships. An attacker who plants a crafted prompt in the right place can influence what an AI coding agent writes or which dependencies it pulls in — without a human ever reviewing the decision.

The Shai-Hulud campaign earlier this year demonstrated exactly this: malicious packages spreading through developer toolchains automatically.

What you should do: If your team uses AI coding assistants, treat their output like any untrusted dependency — review it, scan it, and trace where it came from before committing it.

CVE ID confirmed in source — see the full disclosure from The Hacker News.

What the Linux Kernel is: The kernel is the core of the Linux operating system — the layer that manages memory, processes, and hardware on behalf of every program running on the machine.

What it is: Researchers at Nebula Security disclosed GhostLock, a flaw that lets any logged-in user gain full root (administrator-level) control of an unpatched Linux machine. It has existed in the codebase since 2011 and requires no special permissions or network access to trigger.

Who's at risk: Anyone running an unpatched Linux system — particularly cloud servers, shared hosting environments, containers, and CI runners (automated build systems) where an attacker may already have low-level local access.

CVSS: 7.8 (High — patch this week. Do not put this one off.)

Root cause: The flaw lives in the kernel's futex (fast userspace mutex — a primitive that coordinates access between competing processes) priority inheritance code. When a lock operation hits a dead end and backs out, a cleanup routine fires at the wrong moment and wipes the wrong task's record. The kernel is then left holding a pointer — a reference to a memory address that has already been freed and reassigned. Trusting that stale pointer is a use-after-free vulnerability (acting on memory that has been handed to someone else, like a hotel key-card that still opens a room after check-out).

Attack vector: From a standard local user account, an attacker triggers the flawed futex path to corrupt kernel memory. Nebula's team chained several steps from that corruption to redirect kernel execution, ending with arbitrary code running at root level. The published exploit achieves this in roughly five seconds on tested hardware. Because Nebula has released working exploit code publicly, any attacker can now run it without needing to understand the underlying mechanics.

Detection strategies:

1. Unexpected privilege escalation events in system audit logs — look for a non-root process spawning root-level child processes without a corresponding authorised sudo call.
2. Kernel crash logs (check /var/log/kern.log or journalctl -k) referencing futex or memory faults may indicate failed exploitation attempts.
3. On systems with eBPF (extended Berkeley Packet Filter — a kernel feature that lets programs observe system activity in real time) monitoring enabled, watch for anomalous syscall sequences from unprivileged processes targeting futex operations.

Recommended actions:

1. Install your distribution's latest kernel update — confirm the patch includes commit 3bfdc63936dd and verify it is not an early build that introduced the subsequent crash bug CVE-2026-53166.
2. Prioritise patching shared and multi-tenant machines first: cloud servers, containers, and CI runners are highest risk.
3. If patching is delayed, enable RANDOMIZE_KSTACK_OFFSET and STATIC_USERMODE_HELPER build options as partial mitigations — these raise the bar for exploitation but do not close the flaw.

Langflow is a drag-and-drop tool for building AI agent pipelines — popular with developers connecting large language models to external services. It has been having a rough year.

CISA (the US Cybersecurity and Infrastructure Security Agency) has ordered federal agencies to patch CVE-2026-55255, an actively exploited flaw in Langflow, according to Bleeping Computer. Attackers who exploit it can access other users' data flows and harvest cloud credentials and compute resources for botnet use.

If you or your team runs a Langflow instance, update it immediately. Attackers are already exploiting this, and the prize — live LLM API keys and cloud credentials — is exactly the kind of access that funds further attacks.

Check your Langflow version at langflow.org and apply the latest update. If your instance is internet-facing, take it offline until patched.

The US Supreme Court has allowed Texas's App Store Accountability Act (TASAA) to take effect while lower courts continue debating its constitutionality, according to The Record. The law requires app stores and developers to verify that users under 18 have parental consent before downloading apps. For app developers and platform operators, this means age-gating is no longer a future concern — it is a current legal requirement in Texas. The Fifth Circuit hears full arguments in August, but enforcement is live now.