Snowflake Hacker Pleads Guilty Over 100 Million Records

Connor Riley Moucka, 26, of Kitchener, Ontario, pleaded guilty in Seattle federal court on Wednesday to computer fraud, wire fraud, aggravated identity theft, and conspiracy, according to The Hacker News. His actions reached at least 165 organisations and exposed records belonging to at least 100 million people. He personally collected at least $495,000 through ransoms and data sales.

The method was not clever. Attackers used passwords stolen years earlier by infostealer malware (software that silently harvests saved credentials from infected devices) and never changed by their owners. The accounts also had multi-factor authentication (MFA — a second verification step beyond just a password) switched off entirely. No platform flaw was needed.

Think of it like finding a years-old spare key under a doormat that nobody ever moved, and then walking straight in.

Data taken included call and text records, passport numbers, Social Security numbers, payroll data, and DEA registration numbers. AT&T confirmed in July 2024 that records covering nearly all its cellular customers between May 2022 and October 2022 were among the stolen material. Victim companies suffered over $9.5 million in confirmed losses, excluding harm to their own customers.

Moucka is sentenced on October 27 and faces up to 30 years. Co-defendant John Erin Binns remains outside U.S. custody.

What you should do: Turn on MFA for every cloud account you use, especially anything work-related. Then check whether any of your passwords are older than a year and change them.

Security researchers Hedi Ingber and Aviyam Ivgi presented findings at Black Hat USA 2026 showing that AI agent infrastructure from AWS, Google, and Vercel each contained flaws allowing tools to be triggered without a model actually authorising them, according to The Hacker News.

In a normal AI agent, the model reads a request and decides whether to call an external tool — such as sending an email or querying a database. These flaws, collectively called CoreBreak, allowed an attacker to send data shaped like a model instruction directly to the tool-execution layer, bypassing the model entirely. Every content filter and safety guardrail the model provides became irrelevant.

All three vendors have issued patches. AWS fixed the managed service automatically; Google addressed it in ADK 2.5.0; Vercel patched the affected harness packages. If your organisation runs AI agents built on any of these platforms, verify you are on a patched version and audit what tools your agents can access.

What JetBrains TeamCity is: A continuous integration and delivery (CI/CD) server — software development teams use it to automatically build, test, and deploy their code.

What it is: CISA has flagged this vulnerability as actively exploited in the wild, per the advisory on The Hacker News. The flaw involves deserialization of untrusted data (a process where software converts incoming data back into executable objects — dangerous when the incoming data is not verified) arriving over the agent polling protocol, the channel build agents use to check in with the server.

Who's at risk: Any organisation running an on-premise TeamCity server that is reachable over a network.

CVSS: 9.8 — Critical. Patch today. Stop reading and go patch.

Root cause: The server processes incoming serialized data (packaged data sent across a network connection) from the agent polling channel without confirming whether the sender is actually a legitimate, authenticated build agent. When software trusts the shape of data rather than its verified origin, an attacker can craft a malicious payload and submit it as though it came from a trusted source.

Attack vector: An unauthenticated attacker who can reach the TeamCity server's network port sends a specially crafted serialized payload over the agent polling protocol. The server deserializes it without authentication checks, executing arbitrary operating system commands at whatever privilege level the TeamCity process runs under. No account credentials are required. A successful hit can expose stored credentials, tamper with build configurations, and compromise software pipelines that push code into production environments.

Detection strategies:

1. Look for unexpected process executions spawned by the TeamCity server process in your endpoint logs.
2. Monitor agent polling protocol traffic for connections from IP addresses outside your known build agent pool.
3. Review TeamCity audit logs for configuration changes or credential access that does not correspond to a known user session.

Recommended actions:

1. Apply the patched TeamCity release immediately — FCEB federal agencies must do so by August 8, 2026.
2. Restrict network access to the TeamCity server so only authorised build agents and administrators can reach it.
3. Review and rotate any credentials stored within TeamCity as a precaution.

Microsoft has updated its free Zero Trust Assessment tool to include a dedicated AI security pillar, according to Help Net Security.

Zero trust (a security model built on the principle of "never trust, always verify" — no user or system is trusted by default, even inside your own network) is increasingly relevant as organisations deploy AI agents with access to sensitive tools and data.

The tool automatically scans your Microsoft security configuration, identifies gaps, and now produces a prioritised roadmap covering identity, devices, data, network, and AI systems. It is free for Microsoft environment users.

If your organisation uses Microsoft 365 or Azure, run the assessment at Microsoft Security. Pay particular attention to the AI pillar if you have deployed any Copilot or AI agent tools. The results will tell you exactly what to fix first.

CISA has added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog and ordered federal civilian agencies to apply mitigations by the end of Friday, July 7, according to Bleeping Computer. The flaws affect IBM's Langflow AI agent framework (CVSS 9.8), N-able's N-central remote monitoring platform, and Apache Tomcat. All three are confirmed as actively exploited. Non-federal organisations running any of these products should treat the federal deadline as a prompt to patch immediately — attackers do not check whether your organisation is a government agency.