Cybersecurity, AI, etc.
Red teaming (offensive research, new TTPs, exploitation techniques, PoC releases, adversary simulation findings)
Summary Security firm Tenet Security has disclosed “agentjacking,” a novel attack class that enables threat actors to hijack AI coding agents — including Anthropic’s Claude Code and Cursor — by…
The FBI and CISA have issued an updated warning that Russian intelligence services are actively targeting Signal users through sophisticated phishing campaigns aimed at stealing backup recovery keys. The advisory,…
A critical privilege escalation vulnerability in the Linux kernel’s traffic control subsystem, tracked as CVE-2026-46331 and dubbed “Pedit COW,” allows any unprivileged local user to gain root access on affected…
Summary A peer-reviewed security audit by researchers at Cracken has revealed that the vast majority of popular agentic offensive security platforms are themselves critically insecure. The study, published June 23,…
Summary Researchers at Broadcom’s Symantec and Carbon Black have uncovered a sophisticated new technique used by the DragonForce ransomware group: hiding command-and-control communications inside Microsoft Teams relay infrastructure. The custom…
Summary Security researchers at Aikido discovered a coordinated supply chain campaign involving 15 malicious plugins on the JetBrains Marketplace, all designed to steal AI provider API keys from developers. The…
Summary SentinelLABS has uncovered “macOS.Gaslight,” a sophisticated North Korea-linked Rust-based backdoor that uses a novel defensive technique: embedded prompt injection payloads designed to trick AI-assisted malware analysis tools into aborting…
Summary A critical authentication flaw in n8n’s MCP (Model Context Protocol) browser bridge — tracked as CVE-2026-54309 — allows any network-reachable attacker to establish unauthenticated MCP sessions and take full…
Summary Security researcher Joshua Rogers has disclosed “Squidbleed” (CVE-2026-47729), a memory leak vulnerability in the Squid web proxy that has existed in the codebase since 1997 — making it 29…
Summary Microsoft researchers have disclosed “AutoJack,” an exploit chain that allows a single malicious webpage to hijack an AI browsing agent and achieve full remote code execution on the host…