threat-intel GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures A vulnerability has been discovered in GitHub's signature verification process. Attackers can rewrite signed Git commits, creating new commits with the same content but a different hash, while still appearing as "Verifie… The Hacker News · Jul 8, 2026 High gitsignaturevulnerability
threat-intel The Verification Step Is the New ATO Battleground in 2026 The traditional methods of account takeover (ATO) – relying on stolen passwords – are becoming less effective due to the increasing adoption of passkeys and phishing-resistant authentication. Attackers are now shifting t… The Hacker News · Jul 8, 2026 High UNpasskeysgenerative aiaccount takeover
threat-intel GitHub Copilot Refuses Harmful Requests in Chat, Then Writes Them in Code Researchers at GitHub discovered a method to bypass the safety mechanisms of AI coding assistant GitHub Copilot. By framing requests for harmful content as part of a seemingly legitimate coding task – specifically, build… The Hacker News · Jul 8, 2026 High ai safetyjailbreakcode generation
threat-intel Cybersecurity and the Gap Between Skill and Ability A joint statement from the Five Eyes intelligence alliance warned of escalating cyber risks due to the increasing capabilities of AI models, particularly their ability to autonomously carry out cyberattacks. The statemen… Schneier on Security · Jul 8, 2026 High UNCAAUaicybersecuritythreat intelligence
threat-intel China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware A Chinese APT group, UAT-7810, is expanding its Operational Relay Box (ORB) network by utilizing custom malware, including LONGLEASH and LEASHTEST, to establish persistent access for secondary threat actors. The group le… The Hacker News · Jul 8, 2026 High CVE-2020-22653CVE-2020-22658CVE-2023-25717TWaptmalwarec2
threat-intel 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros Researchers at Nebula Security discovered GhostLock (CVE-2026-43499), a 15-year-old Linux kernel vulnerability that allows an unprivileged user to gain root access on a machine. The flaw, discovered by their AI-driven bu… The Hacker News · Jul 8, 2026 High CVE-2026-43499CVE-2026-53166CVE-2026-46242linuxkernelprivilege-escalation
threat-intel CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four actively exploited vulnerabilities to its KEV catalog, including flaws in Adobe ColdFusion, JoomShaper SP Page Builder, and Langflow. These… The Hacker News · Jul 8, 2026 High CVE-2026-48282CVE-2026-56290CVE-2026-55255INvulnerabilityrceidror
threat-intel ISC Stormcast For Wednesday, July 8th, 2026 https://isc.sans.edu/podcastdetail/9998, (Wed, Jul 8th) The SANS Internet Storm Center’s latest Stormcast highlighted a significant increase in malicious activity targeting industrial control systems (ICS) and operational technology (OT) environments. Specifically, the report… SANS Internet Storm Center · Jul 8, 2026 High icsotvulnerability
threat-intel Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation A financially motivated campaign utilizing Vidar stealer and XMRig cryptocurrency miner has been active since April 2026, targeting consumers and small- and medium-sized businesses globally, primarily in the U.S. and EU.… Palo Alto Unit 42 · Jul 7, 2026 High USDEmalvertisingdll hijackinganti-forensic
threat-intel Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft Google has patched a critical vulnerability in its Dialogflow CX AI chatbot platform, dubbed 'Rogue Agent,' which could have allowed attackers to steal data from AI agents. The flaw stemmed from a permission boundary iss… Dark Reading · Jul 7, 2026 High aichatbotcodeblocks
data-breach County Government Reportedly Paid $1 Million to Cyber Extortion Group A small county government in Ohio reportedly paid $1 million to the Kairos cyber extortion group to prevent the release of stolen data following a brute-force attack in May 2025. The attackers, Kairos, demanded $3 millio… SecurityWeek · Jul 7, 2026 High USdata breachransomwaregovernment
threat-intel RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service A new Android malware operation, RedWing, is being sold on Telegram as a ready-made bank fraud service. Developed by a Russian threat actor group, RedWing allows even unskilled criminals to steal banking logins and one-t… The Hacker News · Jul 7, 2026 High RUandroidmalwarefraud
vulnerability Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots A critical vulnerability, dubbed ‘Rogue Agent,’ within Google's Dialogflow CX platform allowed a malicious insider or compromised developer account to compromise multiple chatbot agents within the same Google Cloud proje… The Hacker News · Jul 7, 2026 High dialogflowcodeblockscloud run
threat-intel Britain plans to build autonomous AI 'Cyber Shield' to defend nation The UK’s National Cyber Security Centre (NCSC) is developing an AI-powered ‘Cyber Shield’ to bolster national cybersecurity defenses against increasingly sophisticated and rapid attacks. This initiative aims to automate… The Record · Jul 7, 2026 High UKaicybersecuritynational defense
threat-intel 'GitLost' Flaw Leaks Private Data from GitHub's Agentic Workflows A critical prompt injection vulnerability, dubbed ‘GitLost,’ has been discovered in GitHub’s Agentic Workflows, allowing unauthenticated attackers to steal private data from an organization’s repositories by crafting a G… Dark Reading · Jul 7, 2026 High prompt injectionagentic aisecurity vulnerability
threat-intel DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts A Microsoft 365 device code phishing campaign, leveraging collaboration-themed lures, has been observed targeting M365 accounts. The campaign, utilizing a reusable tooling layer called DEBULL, bypasses multi-factor authe… The Hacker News · Jul 7, 2026 High HRTRdevice-codephishingmicrosoft
threat-intel Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data Researchers at Noma Security discovered a vulnerability, dubbed ‘GitLost,’ in GitHub Agentic Workflows that allows attackers to trick AI agents into leaking private repository content simply by posting a malicious issue… The Hacker News · Jul 7, 2026 High prompt injectionai agentgithub
threat-intel Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker U.S. prosecutors have linked an alleged Scattered Spider hacker, Peter Stokes, to a luxury jewelry retailer breach through a persistent Windows device ID. Stokes, a dual U.S.-Estonian citizen, was extradited from Finland… The Hacker News · Jul 7, 2026 High ESFIUNdevice-idhackerintrusion
threat-intel Two arrested over credit card phishing – as the Netherlands is named Europe’s worst for payment fraud Two men were arrested in the Netherlands on suspicion of running a phishing operation targeting credit card details, leading to a significant increase in payment fraud within the country. The Dutch central bank reported… Graham Cluley · Jul 7, 2026 High NLEUphishingcredit card fraudcybercrime
threat-intel Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks An Iran-linked APT group, known as Cavern Manticore, is utilizing a sophisticated, AI-assisted modular command-and-control framework to target organizations in Israel, particularly government entities and IT providers. T… SecurityWeek · Jul 7, 2026 High ILaptcommand and controllateral movement
