All Issues
129 issues published
Copilot Told Hackers How to Hack It
A security researcher got Microsoft's AI assistant to reveal its own hidden bypass code, which attackers then used to steal user passwords — no technical expertise required, just persistent questioning. OpenAI has paused training on its most capable models after finding signs that an upcoming model may cross a critical cybersecurity risk threshold. If you use Microsoft 365 Copilot at work, today's issue has something you need to know.
3.6 Million Azure Records Claimed Stolen
A hacker is claiming to have lifted 3.6 million Azure account records from major companies, and CISA has confirmed active exploitation of a critical flaw in a widely used AI computing framework. Microsoft is quietly making Windows a little safer by removing a tool that ransomware gangs have abused for years — update now if you're on Windows 11.
Amazon's Book Scanning Facility Caught on AirTag
Amazon has been quietly buying thousands of second-hand books and destructively scanning them at a Las Vegas facility — confirmed by an AirTag hidden in a shipment by 404 Media. Alibaba's new Qwen 3.8 27B model runs on a laptop but comes with an absurd default setting that makes it think for 21 minutes about a drawing of a circle. Claude is also getting invisible watermarks baked in to comply with EU law — more on that below.
Salesforce Portals Were Open for 17 Months
Someone quietly harvested records from Salesforce and ServiceNow portals worldwide for nearly a year and a half — without breaking a single thing. A new Linux botnet called Evooo1Bot is hijacking home routers and turning them into traffic-hiding relay points. Update your router's firmware today, and if you use GitHub, turn on Dependabot malware alerts now.
ShinyHunters Leaks 1.6 Million RingCentral Accounts
ShinyHunters has dumped 280GB of stolen data from RingCentral after the company refused to pay up, exposing personal details on 1.6 million accounts. Mac users running Screen Sharing should patch immediately — attackers are actively exploiting an authentication bypass to hijack machines and mine cryptocurrency. Check whether your Apple device is up to date, and disable Screen Sharing if you don't use it.
VMware Servers Hacked Five Days After Patch
A critical flaw in VMware vCenter is being actively exploited, with over 360 servers across 47 countries compromised just days after the patch dropped. WhatsApp is rolling out a new on-device scam detection feature worth enabling now. If your organisation runs VMware vCenter, stop reading and go patch.
North Korea's Fake Recruiters Are Back With a Zero-Day
North Korea's Lazarus Group is running fake LinkedIn job offers to plant backdoors on defence and aerospace computers across four countries, exploiting a freshly patched Windows flaw to take full control of infected machines. Adobe has quietly dropped patches for three CVSS 10.0 vulnerabilities — one of which is already being actively exploited in the wild. If you use Signal, there is a new security feature worth switching on today.
AI Helped Hackers Find a Zero-Day in SharePoint
Two malicious AI tool packages sat on a public code registry for 40 minutes in March and may have hoovered up secrets from over 2,500 organisations — if your team uses Python, check your CI/CD credentials now. Researchers used an AI agent to find a chain of flaws in Microsoft SharePoint that lets attackers in with no password at all, and the July 2026 patch breaks the attack. Meanwhile, SAP has patched a perfect-ten severity flaw in its Commerce Cloud product that needs immediate attention.
A Power Plant Hacked Through a Wind Farm's Wi-Fi
Hackers reached a Polish power plant's control systems by hopping through a shared cellular network, shutting down a turbine serving 50,000 homes before operators could fully kick them out. North Korea's Kimsuky group is quietly building its own offline AI stack to write sharper phishing lures and develop malware faster. Plus, a critical flaw in widely deployed load-balancing software is now being actively exploited — if you run it, patch it today.
Malicious VS Code Extensions Are Stealing Crypto Wallets
Developers installing VS Code extensions are unknowingly handing attackers their crypto wallets, API keys, and SSH credentials through a sophisticated malware campaign. Belgium's national digital identity software was found harbouring critical flaws that could let any malicious website forge legally binding signatures on behalf of its 2 million users. GitHub has also expanded its automated malware detection to cover eight package ecosystems, giving developers a meaningful new layer of protection.