threat-intel OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development OpenAI has released GPT-5.6-Cyber, a cybersecurity-focused AI model designed to assist vulnerability research and exploit development, while reducing refusals for high-risk tasks. The model, accessible through the Daybre… The Hacker News · Aug 11, 2026 High CVE-2026-15903UNaicybersecurityvulnerability
threat-intel Kids’ online safety bill faces dim prospects of passage this session despite progress The Kids Online Safety Act (KOSA), a landmark bill aimed at increasing online safety for children, faces significant obstacles in Congress, particularly regarding a ‘duty of care’ provision requiring companies to take re… The Record · Aug 11, 2026 High UNonline safetychildrenfirst amendment
threat-intel A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices Researchers at the University of Birmingham and Fuzzware discovered a vulnerability in cellular IoT devices that allows a malicious SIM card to execute commands on the device. The vulnerability stems from a SIM card's ab… The Hacker News · Aug 11, 2026 High CVE-2025-48618CVE-2026-57550CVE-2021-31698UNiotcellularsim card
threat-intel Extension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious Activities A Chrome extension, initially banned for stealing AI chat conversations, has returned to the Chrome Web Store and is now targeting enterprise browsers through Google's CDN. The extension employs a sophisticated affiliate… SecurityWeek · Aug 11, 2026 High chromeextensionaffiliate
threat-intel Des kiosques Pokémon exposés par une fuite Firebase A clandestine publication alleges that a US-based automated distribution operator exposed sensitive data – including bank details, email addresses, source code, and technical access – across multiple continents via expos… ZATAZ · Aug 10, 2026 High USJPAUdata breachapiauthentication
threat-intel Coruna, DarkSword iOS Exploits Proliferate Globally Sophisticated iPhone exploit chains, DarkSword and Coruna, are rapidly spreading beyond nation-state actors and into the hands of organized cybercrime groups. These advanced tools, initially developed for surveillance an… Dark Reading · Aug 10, 2026 High CVE-2025-31277CVE-2025-43529CVE-2026-20700CHMASAexploitioscybercrime
ransomware ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors This week’s security news is dominated by AI-related threats, including a vulnerability exploited in Metabase, a new Shai-Hulud worm leveraging the MCP Registry, and a Chinese review of Palo Alto Networks. Alongside the… The Hacker News · Aug 10, 2026 High CVE-2026-34348CVE-2026-18497CVE-2026-63508CHransomwaresupply-chainvishing
threat-intel Stealthium Targets Security Blind Spots in AI Accelerators and Neo-Clouds Stealthium is a new cybersecurity firm addressing a critical security blind spot in the rapidly growing neo-cloud market, which utilizes specialized AI accelerators. Because traditional security tools aren't designed for… SecurityWeek · Aug 10, 2026 High neo-cloudacceleratorsupply chain
threat-intel New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA Recent research has revealed significant vulnerabilities in passkey authentication systems, demonstrating ways to bypass security measures and impersonate users. SpecterOps found that Windows stored past YubiKey signatur… The Hacker News · Aug 10, 2026 High CVE-2026-34348passkeyauthenticationvulnerability
threat-intel Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer A sophisticated campaign involving nearly 800 malicious npm packages has been deployed to deliver cross-platform malware – a Remote Access Trojan (RAT) and infostealer – targeting Windows, macOS, and Linux systems. The p… The Hacker News · Aug 7, 2026 High RUnpmsupply chainmalware
threat-intel UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data UNC6671, a data extortion group linked to ShinyHunters and potentially SLH, is leveraging sophisticated vishing tactics to steal SaaS data from organizations across multiple sectors. They impersonate IT help desks, direc… The Hacker News · Aug 7, 2026 High NOAUU.vishingphishingdata-breach
vulnerability Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets Two vulnerabilities – one in Gemini CLI and another in Claude Code – have been discovered that allowed unprivileged attackers to execute code on CI runners, potentially exposing sensitive information. Gemini CLI allowed… The Hacker News · Aug 7, 2026 High CVE-2026-12537CVE-2026-54316ci/cdinput validationcommand injection
vulnerability Critical Vulnerabilities Patched With Chrome 151 Update Google released Chrome 151 to address 370 security vulnerabilities, primarily memory safety bugs, with 41 classified as critical. The update aims to prevent data corruption, crashes, and potential code execution exploits… SecurityWeek · Aug 7, 2026 High memory-safetychromevulnerability
vulnerability Multiples vulnérabilités dans Google Chrome (07 août 2026) Multiple vulnerabilities have been discovered in Google Chrome, potentially allowing an attacker to trigger a security issue. These vulnerabilities affect Chrome versions prior to 151.0.7922.108 on Windows and Linux, and… CERT-FR · Aug 7, 2026 High CVE-2026-19137CVE-2026-19138CVE-2026-19139chromevulnerabilitysecurity
vulnerability AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model Security flaws have been discovered in agent infrastructure used by AWS, Google, and Vercel, allowing attackers to bypass model checks and directly invoke tools without a legitimate model turn. These vulnerabilities stem… The Hacker News · Aug 6, 2026 High CVE-2026-18830CVE-2026-18236CVE-2026-64650agentmodelauthorization
threat-intel AI Browsers Vulnerable to 'PleaseFix' Zero-Click Agent Hijacking A new vulnerability, dubbed 'PleaseFix,' is exposing AI browsers like Claude, Gemini, and Perplexity Comet to zero-click exploits. Attackers can inject malicious instructions into seemingly harmless content – such as ema… Dark Reading · Aug 5, 2026 High aiagentic browserzero-click
threat-intel No Perfect Fix for AI Browser Prompt Injection Flaws Research presented at Black Hat USA 2026 revealed that despite numerous security guardrails, AI-powered web browsers remain vulnerable to prompt injection attacks. Artem Chaikin demonstrated how attackers can bypass thes… Dark Reading · Aug 5, 2026 High prompt injectionai securityweb browser
threat-intel Flaws in Google APK for Python Unlock Agent-to-Agent Attack Researchers at Pillar Security discovered a critical vulnerability in Google's Agent Development Kit (ADK) for Python, allowing a low-privileged AI agent to trigger actions by a more privileged agent via prompt injection… Dark Reading · Aug 5, 2026 High prompt injectionai agentssupply chain
threat-intel New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts Researchers at Palo Alto Networks have uncovered new attack methods that allow malware to steal passkey-protected accounts, bypassing traditional security measures. These techniques exploit vulnerabilities in Chrome’s sy… SecurityWeek · Aug 5, 2026 High passkeyauthenticationchrome
vulnerability Multiples vulnérabilités dans Google Pixel (05 août 2026) Google has discovered and addressed multiple vulnerabilities within its Pixel devices. These vulnerabilities could allow an attacker to gain elevated privileges, though specific details remain undisclosed. Users are advi… CERT-FR · Aug 5, 2026 Medium CVE-2026-0163androidsecurityvulnerability
