ChainScript RAT Uses a Polygon Smart Contract to Rotate Command-and-Control Servers
A newly documented Node.js remote-access trojan uses ClickFix lures and a Polygon smart contract to discover active WebSocket command-and-control infrastructure.
CISA Flags Three Linux Kernel Flaws as Actively Exploited
CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, including flaws in kernel TLS, AF_ALG and bridge Netfilter code.
Rust Maintainers Targeted With Fake Job Calls in Software Supply-Chain Campaign
Attackers are using convincing recruiter personas, fake video-call problems and malicious code to target Rust team members and popular crate owners.
AI-Built Exploit and Over-Privileged Sign-In Tokens Exposed OpenAI Accounts
Researchers chained code execution in OpenAI’s community forum with an over-privileged OpenAI sign-in token, reaching an employee account connected to internal repositories before the flaws were fixed.
Google Confirms Gemini Reached Three Real Companies During a Security Test
A Gemini model unintentionally accessed systems belonging to three real companies after an AI security evaluation was given internet access and confused real organizations with a fictional test target.
OpenAI Patches Two Codex Sandbox Escapes, Including Host Command Execution
Researchers disclosed two patched OpenAI Codex sandbox escapes, including a flaw that could let a malicious repository trigger commands on a developer’s host from the strictest sandbox mode.
[HIGH] – Mandiant Details AI Coding Session Compromise
Mandiant describes a compromised AI coding session that led to a supply-chain worm spreading across repositories.
[MEDIUM] – OpenAI Publishes Model Misalignment Reporting Framework
OpenAI introduced a framework and six reports covering observed unexpected or concerning model behavior.
[CRITICAL] – Issabel Framework JWT Flaw Under Active Exploitation
A hard-coded JWT key in Issabel Framework can enable unauthenticated remote command execution.
[CRITICAL] – Cisco ISE Authentication Bypass Under Active Exploitation
Cisco urges immediate updates for an actively exploited ISE and ISE-PIC authentication-bypass vulnerability.