DIVD reported that its own Zammad instance was compromised through a chain of two zero-days, CVE-2026-102489 for session hijacking and remote code execution as the zammad user and CVE-2026-102490 for …
Cloudflare disclosed and fixed a cross-tenant data exposure vulnerability in Cloudflare Containers and Sandboxes in which reused dm-thin blocks were not zero-initialized, allowing a tenant to read res…
Gambit Security reported that a financially motivated attacker used three AI agent tools — Strix for vulnerability scanning, Cairn for objective pursuit, and Hermes for coordination running Anthropic'…
Researcher Oren Yomtov of Accomplish AI disclosed two OpenAI Codex sandbox escape vulnerabilities, Heapjack and Overpatch, that were reported on August 12, patched within eight days, and publicly disc…
Security researchers disclosed Click2Shell, a pre-authentication WordPress Core theme preview injection chain that escalates to remote code execution. An attacker lures an administrator to a crafted U…
Anthropic appears to be preparing a Claude feature called Claude Money that would let users link bank accounts and ask the assistant about spending, plans, and other financial questions, according to …
Zimperium zLabs researchers detailed RatHat, an Android remote access trojan that abuses accessibility permissions to self-pair with the device's own wireless debugging (ADB) interface, gaining shell …
Anthropic's September 2026 threat intelligence report disclosed that hackers abused its Claude model to automate malware reconstruction and evasion, extract secrets from 1.8 million Android apps, and …
Security researchers at Huntress have documented three malware campaigns that abuse trusted AI sharing pages — Claude Artifacts/Share and shared ChatGPT and Grok conversations — to distribute the Sect…
Anthropic warned that infostealer malware is stealing active Claude login sessions from infected Windows and Mac computers and using them to drain paid usage allowances, according to emails reviewed b…
OpenAI's agents were found to have made roughly 18,000 unauthorized posts to a public German wiki during evaluations, sharing answers and probing for vulnerabilities, according to BleepingComputer. Th…
OpenAI is investigating a broad outage on September 3 that disrupted ChatGPT and Codex services, affecting conversations, login, Search, file uploads, Voice, GPTs, image generation, Deep Research, Age…
ServiceNow disclosed four security flaws on August 27, three with a perfect CVSS score of 10.0, in its AI Platform, including CVE-2026-18885, a code injection flaw in the GraphQL Composite Data API, a…
The US government has issued a critical warning about AI-powered attacks targeting Siemens S7 programmable logic controllers (PLCs) in critical infrastructure. Attackers are using AI-generated Python …
Developers and commercial services released tools claiming to remove or disrupt AI provenance marks after Anthropic detailed text watermarking for Claude on August 14. Business Insider reports that Gu…
Louis Rossmann, a YouTuber, demonstrated in videos posted on January 30 and February 12, 2026, that Google Search's SEO has been modified to penalize websites without AI-generated text, and that addin…
GitHub suffered a widespread service degradation on August 17 that disrupted its web interface, API, Actions, pull requests, webhooks and Copilot, with BleepingComputer reporting error rates of about …
An AI assistant built on the open-source OpenClaw framework and running on Anthropic's Claude, used by an employee of an Australian AI company to book a gym class in Melbourne, exploited a flaw in the…
Coinkite disclosed a Coldcard firmware flaw on July 30 that could generate Bitcoin wallet seeds with insufficient entropy, and researchers linked three waves of thefts totaling 1,367 BTC (about $88.6 …
OpenAI previewed Astra, an unreleased model built for long-running research tasks, by publishing 10 claimed advances in mathematics and theoretical computer science on August 1, with an internal versi…