https://infosecradar.com/feeds/negative.xml Bad news for defenders http://www.rssboard.org/rss-specification InfoSecRadar en Fri, 17 Jul 2026 20:01:19 +0000 https://infosecradar.com/stories/2026/07/16/two-scattered-spider-hackers-sentenced-to-jail-in-uk/ Two individuals associated with the Scattered Spider hacking group have been sentenced to jail in the UK for a 2024 cyberattack. The attack specifically targeted Transport for London (TfL). https://www.securityweek.com/two-scattered-spider-hackers-sentenced-to-jail-in-uk/ Thu, 16 Jul 2026 13:21:12 +0000 SecurityWeek https://infosecradar.com/stories/2026/07/16/n8n-token-exchange-flaw-could-let-attackers-log-in-as-users-from-another-issuer/ The workflow automation platform n8n has a flaw in its token exchange mechanism. On enterprise instances configured with multiple token issuers, the platform incorrectly matches incoming JWTs to local users based solely on the 'sub' claim, ignoring the 'iss' claim. This allows a valid token from one issuer to log a user in as someone else if their 'sub' claim matches a user under a different issuer. https://thehackernews.com/2026/07/n8n-token-exchange-flaw-could-let.html Thu, 16 Jul 2026 13:33:25 +0000 The Hacker News https://infosecradar.com/stories/2026/07/16/23andme-to-pay-18-million-in-new-genetics-data-breach-settlement/ Genetic testing company 23andMe will pay $18 million to settle claims from 43 attorneys general. The settlement addresses allegations that the company failed to adequately protect customers' genetic data. This case highlights the importance of robust data security measures for companies handling sensitive personal information. https://www.bleepingcomputer.com/news/security/23andme-to-pay-18-million-in-new-genetics-data-breach-settlement/ Thu, 16 Jul 2026 13:47:23 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/16/ai-agents-broke-the-security-playbook-heres-what-replaces-it/ Traditional security playbooks are becoming obsolete due to the rapid evolution of AI agents, which operate at a speed far exceeding human capabilities. Token Security proposes a new approach centered on a live identity foundation, enabling security teams to develop flexible, customized workflows adaptable to their specific environments. https://www.bleepingcomputer.com/news/security/ai-agents-broke-the-security-playbook-heres-what-replaces-it/ Thu, 16 Jul 2026 14:00:10 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/16/legacy-systems-real-world-impacts-the-reality-of-ot-security/ The article discusses the significant challenges in disclosing vulnerabilities within Operational Technology (OT) environments due to the interconnected nature of legacy systems and the critical infrastructure they support. It highlights how safety concerns and the real-world impacts of potential disruptions complicate the vulnerability disclosure process for OT. https://www.securityweek.com/legacy-systems-real-world-impacts-the-reality-of-ot-security/ Thu, 16 Jul 2026 15:15:00 +0000 SecurityWeek https://infosecradar.com/stories/2026/07/16/cmon-just-copy-this-text-string-and-paste-it-into-your-macos-terminal-itll-fix-y/ A new macOS stealer named ClickLock targets users through social engineering tactics, tricking them into running malicious commands in their Terminal. This malware aims to steal sensitive information by exploiting user trust and a lack of security awareness. https://www.theregister.com/cyber-crime/2026/07/16/cmon-just-copy-this-text-string-and-paste-it-into-your-macos-terminal-itll-fix-your-computer-honest/5273701 Thu, 16 Jul 2026 15:33:01 +0000 The Register (Security) https://infosecradar.com/stories/2026/07/16/threatsday-game-cheat-spyware-24-hour-ransomware-chrome-sync-stalking-12-more-st/ This article summarizes 15 security-related stories from the past week. It highlights threats such as game cheat spyware, a rapid 24-hour ransomware attack, and the potential for Chrome sync settings to be exploited for stalking. The piece also notes the resurgence of old bugs and the exploitation of weak default configurations. https://thehackernews.com/2026/07/threatsday-game-cheat-spyware-24-hour.html Thu, 16 Jul 2026 15:41:15 +0000 The Hacker News https://infosecradar.com/stories/2026/07/16/two-scattered-spider-hackers-get-55-years-each-for-29-million-tfl-hack/ Two hackers associated with the Scattered Spider group, Owen Flowers and Thalha Jubair, have been sentenced to five and a half years in prison each for their 2024 hack of Transport for London (TfL). The attack rendered 148 TfL systems inoperable and required all 27,000 employees to reset their passwords in person, resulting in significant losses and recovery costs for the transport authority. https://thehackernews.com/2026/07/two-scattered-spider-hackers-get-55.html Thu, 16 Jul 2026 17:09:25 +0000 The Hacker News https://infosecradar.com/stories/2026/07/16/zoom-patches-account-takeover-hole/ Zoom has patched a critical security vulnerability that could allow an unauthenticated user to take over accounts remotely. The company also addressed three other less severe privilege escalation flaws across various Zoom products for Windows. These patches are crucial given Zoom's widespread use in both personal and business environments. https://www.csoonline.com/article/4197962/zoom-patches-account-takeover-hole-2.html Thu, 16 Jul 2026 17:30:44 +0000 CSO Online https://infosecradar.com/stories/2026/07/16/ice-officers-at-maine-shooting-scene-were-wearing-body-cameras-they-were-not-tur/ ICE officers involved in a shooting incident in Maine were equipped with body cameras, but these devices were not activated at the time. Sources indicate the cameras cannot be turned on, and the Trump administration stated no footage exists from the event. https://theintercept.com/2026/07/16/ice-maine-shooting-body-cameras/ Thu, 16 Jul 2026 18:05:34 +0000 The Intercept (Privacy) https://infosecradar.com/stories/2026/07/16/new-okobot-framework-deploys-20-payloads-to-steal-data-crypto/ A new malicious framework named OkoBot has been identified, which deploys over 20 distinct payloads. These payloads are designed to steal sensitive data, including cryptocurrency wallet seed phrases and user credentials. https://www.bleepingcomputer.com/news/security/new-okobot-framework-deploys-20-payloads-to-steal-data-crypto/ Thu, 16 Jul 2026 19:09:35 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/16/claude-chrome-extension-flaw-lets-malicious-extensions-trigger-ai-actions/ A flaw in Anthropic's Claude for Chrome browser extension could allow malicious extensions to trigger AI actions by simulating user clicks. This could enable attackers to abuse Claude's access to connected services like Gmail, Google Docs, Google Calendar, and Salesforce. https://www.bleepingcomputer.com/news/security/claude-chrome-extension-flaw-lets-malicious-extensions-trigger-ai-actions/ Thu, 16 Jul 2026 19:26:07 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/16/now-even-russias-most-elite-hackers-are-using-clickfix-to-infect-devices/ Russia's most sophisticated hacking groups are reportedly adopting the Clickfix social engineering technique to infect devices. This method, previously associated with financially motivated cybercriminals, is now being utilized by elite state-sponsored attackers. https://arstechnica.com/security/2026/07/now-even-russias-most-elite-hackers-are-using-clickfix-to-infect-devices/ Thu, 16 Jul 2026 19:28:33 +0000 Ars Technica (Security) https://infosecradar.com/stories/2026/07/16/1m-emails-use-hidden-text-to-dupe-ai-security-filters/ A recent article highlights how over a million emails are employing a technique called 'text salting' to bypass AI-powered security filters. This method involves embedding hidden text within emails, making them appear legitimate to AI and thus increasing the success rate of phishing campaigns. https://www.darkreading.com/threat-intelligence/1m-emails-hidden-text-dupe-ai-security-filters Thu, 16 Jul 2026 19:41:31 +0000 Dark Reading https://infosecradar.com/stories/2026/07/16/researcher-poisons-open-weight-ai-model-for-under-100/ A security researcher demonstrated how to poison an open-weight AI model for less than $100 by injecting malicious data. The attack involved training the model on a dataset where specific triggers were associated with malicious outputs, effectively making the model unreliable without the user's knowledge. https://www.theregister.com/ai-and-ml/2026/07/16/researcher-poisons-open-weight-ai-model-for-under-100/5273880 Thu, 16 Jul 2026 20:25:00 +0000 The Register (Security) https://infosecradar.com/stories/2026/07/16/agentic-ai-is-untamable-ask-the-right-security-questions/ Agentic AI presents significant security challenges that necessitate a reevaluation of current security strategies. The inherent nature of these advanced AI systems poses risks that demand a proactive and adaptable approach to cybersecurity. https://www.darkreading.com/cybersecurity-operations/agentic-ai-untamable-ask-the-right-security-questions Thu, 16 Jul 2026 20:57:47 +0000 Dark Reading https://infosecradar.com/stories/2026/07/16/coca-cola-says-fairlife-ransomware-attack-halts-us-dairy-production/ Coca-Cola's dairy subsidiary, Fairlife, has experienced a ransomware attack that has temporarily halted its production across the United States. The attack has impacted operations, leading to a suspension of Fairlife product manufacturing. https://www.bleepingcomputer.com/news/security/coca-cola-says-fairlife-ransomware-attack-halts-us-dairy-production/ Thu, 16 Jul 2026 21:09:41 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/16/new-clicklock-macos-malware-traps-users-into-revealing-login-password/ A new macOS malware named ClickLock has been discovered that terminates visible processes, tricking users into entering their system login password. This information stealer aims to capture the password entered by the unsuspecting user. The malware is distributed through malicious installers disguised as legitimate software. https://www.bleepingcomputer.com/news/security/new-clicklock-macos-malware-traps-users-into-revealing-login-password/ Thu, 16 Jul 2026 21:52:54 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/16/openai-admits-gpt-56-occasionally-deletes-files-but-its-an-honest-mistake/ OpenAI has acknowledged that a version of its GPT model, referred to as GPT-5.6, has occasionally deleted files. The company attributes this behavior to 'misaligned behavior' and states it is actively working to prevent such incidents. https://www.theregister.com/ai-and-ml/2026/07/16/openai-admits-gpt-56-occasionally-deletes-files-but-its-an-honest-mistake/5274008 Thu, 16 Jul 2026 22:50:00 +0000 The Register (Security) https://infosecradar.com/stories/2026/07/17/coca-cola-suspends-us-fairlife-production-due-to-ransomware-attack/ Coca-Cola has suspended production at its US Fairlife facilities due to a ransomware attack. The company stated that the incident has not compromised product quality or safety, nor has it impacted Fairlife's operations in Canada. https://www.securityweek.com/coca-cola-suspends-us-fairlife-production-due-to-ransomware-attack/ Fri, 17 Jul 2026 06:23:08 +0000 SecurityWeek https://infosecradar.com/stories/2026/07/17/cisa-adds-exploited-sharepoint-rce-zero-day-cve-2026-58644-to-kev/ CISA has added a critical SharePoint Server remote code execution (RCE) vulnerability, CVE-2026-58644, to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies are mandated to apply the necessary patches by July 19, 2026. https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html Fri, 17 Jul 2026 06:42:23 +0000 The Hacker News https://infosecradar.com/stories/2026/07/17/senior-executives-are-killing-your-shadow-ai-strategy/ A significant majority of senior executives admit to using unapproved AI tools, a practice known as "shadow AI," despite awareness of security and data privacy risks. This trend poses a major challenge for CISOs, as executive adoption of unsanctioned tools undermines governance and sends a message that speed is prioritized over security. https://www.csoonline.com/article/4198007/senior-executives-are-killing-your-shadow-ai-strategy.html Fri, 17 Jul 2026 07:00:00 +0000 CSO Online https://infosecradar.com/stories/2026/07/17/cisa-urges-immediate-action-on-actively-exploited-fortinet-flaws/ CISA has issued a directive to government agencies, mandating the immediate patching of two critical vulnerabilities found in Fortinet's FortiSandbox threat detection platform. These vulnerabilities are reportedly being actively exploited, underscoring the urgency of the advisory. https://www.bleepingcomputer.com/news/security/cisa-warns-feds-to-patch-exploited-fortinet-fortisandbox-flaws-by-sunday/ Fri, 17 Jul 2026 07:03:33 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/17/fresh-sharepoint-vulnerability-exploited-soon-after-disclosure/ A critical-severity security vulnerability in SharePoint has been disclosed and is already being exploited by attackers. The flaw allows authenticated remote attackers to execute arbitrary code on the server. https://www.securityweek.com/fresh-sharepoint-vulnerability-exploited-soon-after-disclosure/ Fri, 17 Jul 2026 07:15:59 +0000 SecurityWeek https://infosecradar.com/stories/2026/07/17/us-charges-two-over-laundering-43-million-from-investment-fraud/ U.S. prosecutors have charged a man and a woman in New York for their involvement in a significant crime ring that laundered $43 million obtained through investment fraud scams. The charges stem from their alleged roles in facilitating the movement of illicit funds, which were derived from cyber-enabled investment schemes. https://www.bleepingcomputer.com/news/security/us-charges-two-over-laundering-43-million-from-investment-fraud/ Fri, 17 Jul 2026 08:13:37 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/17/fake-ttf-files-deliver-stealthy-malware-in-global-phishing-campaign/ Threat actors are employing a global phishing campaign that abuses standard TrueType Font (TTF) files to deliver stealthy malware. This campaign uses heavily obfuscated JavaScript and a Lua-based loader disguised as a font file to evade detection and install malware like RATs and infostealers. https://www.csoonline.com/article/4198165/fake-ttf-files-deliver-stealthy-malware-in-global-phishing-campaign.html Fri, 17 Jul 2026 08:45:04 +0000 CSO Online https://infosecradar.com/stories/2026/07/17/new-goserpent-malware-targets-southeast-asian-governments-and-diplomats-for-espi/ Cybersecurity researchers have identified a new malware named GoSerpent, in use since late 2025, specifically targeting government and diplomatic entities in Southeast Asia. The malware, discovered by Kaspersky, is designed for long-term access and intelligence gathering, suggesting a sophisticated espionage campaign. https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html Fri, 17 Jul 2026 08:46:45 +0000 The Hacker News https://infosecradar.com/stories/2026/07/17/acr-stealer-uses-clickfix-lures-to-steal-browser-tokens-and-microsoft-365-files/ The ACR Stealer malware, active since 2024, is capable of exfiltrating sensitive data including browser passwords, active session tokens, PDFs, and Microsoft 365 files from synced cloud storage. It achieves initial access through user execution of malicious commands, as detailed by Microsoft's Defender Experts team. https://thehackernews.com/2026/07/acr-stealer-uses-clickfix-lures-to.html Fri, 17 Jul 2026 08:56:39 +0000 The Hacker News https://infosecradar.com/stories/2026/07/17/the-saas-blind-spot-why-security-teams-cant-get-inside-their-own-apps/ Organizations are investing heavily in cloud security but face a "SaaS blind spot," where they lack visibility into administrative access and data within their numerous SaaS applications. This lack of insight stems from security tools not being designed to monitor these environments, leading to potential data exposure risks. https://www.csoonline.com/article/4197923/the-saas-blind-spot-why-security-teams-cant-get-inside-their-own-apps.html Fri, 17 Jul 2026 09:00:00 +0000 CSO Online https://infosecradar.com/stories/2026/07/17/cyberattack-disrupts-operations-of-japanese-frozen-food-giant-nichirei/ Japanese frozen food giant Nichirei experienced a cyberattack on July 13 that disrupted its operations. The company has begun the process of gradually restoring its systems. https://www.securityweek.com/cyberattack-disrupts-operations-of-japanese-frozen-food-giant-nichirei/ Fri, 17 Jul 2026 09:06:27 +0000 SecurityWeek https://infosecradar.com/stories/2026/07/17/windows-server-2022-reach-end-of-mainstream-support-in-90-days/ Microsoft has announced that Windows Server 2022 will reach the end of its mainstream support in October 2026. Following this, it will transition to extended support, which includes continued security updates for an additional five years. This change impacts how users will receive support and updates for the operating system. https://www.bleepingcomputer.com/news/microsoft/windows-server-2022-reach-end-of-mainstream-support-in-90-days/ Fri, 17 Jul 2026 09:10:15 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/17/google-fixing-android-lock-screen-bug-that-lets-gemini-send-sms-without-a-pin/ Google is addressing a vulnerability in Android's lock screen that allows the Gemini AI model to send SMS messages without requiring a PIN. A specific multi-touch gesture on the lock screen can bypass the authentication prompt, enabling unauthorized access to the messaging function. https://www.theregister.com/security/2026/07/17/google-fixing-android-lock-screen-bug-that-lets-gemini-send-sms-without-a-pin/5273027 Fri, 17 Jul 2026 09:15:00 +0000 The Register (Security) https://infosecradar.com/stories/2026/07/17/armenia-detains-russian-tourist-on-us-warrant-for-revil-hacker-lawyers-say-wrong/ Armenia has detained a Russian tourist, Aleksandr Ermakov, based on a U.S. extradition request. The U.S. is seeking him as a suspect linked to the REvil ransomware group. However, the detained individual's wife claims the U.S. has arrested the wrong person, presenting a potential misidentification case. https://thehackernews.com/2026/07/armenia-detains-russian-tourist-on-us.html Fri, 17 Jul 2026 10:53:31 +0000 The Hacker News https://infosecradar.com/stories/2026/07/17/new-windows-legacyhive-zero-day-gives-hackers-admin-privileges/ A new Windows zero-day exploit named LegacyHive has been publicly released by a security researcher. This exploit allows attackers to gain administrative privileges on patched Windows systems. The vulnerability is believed to affect specific Windows components and has been demonstrated to work on the latest Windows versions. https://www.bleepingcomputer.com/news/security/new-windows-legacyhive-zero-day-exploit-grants-hackers-admin-access/ Fri, 17 Jul 2026 11:05:30 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/17/the-race-to-field-military-autonomy-is-on-can-trusted-information-infrastructure/ Military forces are under pressure to deploy autonomous capabilities rapidly, driven by investment and new defense strategies in the US, UK, and NATO. This race to accelerate acquisition necessitates a focus on trusted information infrastructure to keep pace with these advancements. https://thehackernews.com/2026/07/the-race-to-field-military-autonomy-is.html Fri, 17 Jul 2026 11:30:00 +0000 The Hacker News https://infosecradar.com/stories/2026/07/17/eu-orders-google-to-open-android-mic-camera-and-screen-to-rival-ai-assistants/ The European Commission has ordered Google to grant rival AI assistants access to Android features currently exclusive to Google's Gemini, including microphone, camera, screen content, and background app control. This mandate requires implementation in the next Android release and by August 1, 2027. https://thehackernews.com/2026/07/eu-orders-google-to-open-android-mic.html Fri, 17 Jul 2026 11:44:41 +0000 The Hacker News https://infosecradar.com/stories/2026/07/17/attackers-target-critical-fortisandbox-flaws-as-cisa-issues-patch-order/ Attackers are actively exploiting critical vulnerabilities in Fortinet's FortiSandbox products, prompting CISA to issue a directive mandating patches. Researchers have identified abuse attempts targeting command injection flaws within these devices. https://www.theregister.com/security/2026/07/17/attackers-target-critical-fortisandbox-flaws-as-cisa-issues-patch-order/5274287 Fri, 17 Jul 2026 11:58:10 +0000 The Register (Security) https://infosecradar.com/stories/2026/07/17/podcast-broken-governance-agentic-ai-and-the-mindstone-agent-exclusive/ This article discusses the rapid advancements in artificial intelligence, specifically agentic AI, and questions whether current governance, compliance, and security practices are evolving quickly enough to manage these new technologies. It highlights potential security challenges arising from the pace of AI development. https://www.securityweek.com/podcast-broken-governance-agentic-ai-and-the-mindstone-agent-exclusive/ Fri, 17 Jul 2026 12:11:22 +0000 SecurityWeek https://infosecradar.com/stories/2026/07/17/fake-coding-tests-deliver-ottercookie-aligned-malware-hidden-in-svg-flag-images/ North Korean threat actors are using steganography in SVG image files, hidden within fake coding tests and job postings, to deliver malware. The payload, aligned with the OTTERCOOKIE malware, includes components for stealing browser credentials, cryptocurrency, and files. https://thehackernews.com/2026/07/north-korea-linked-hackers-hide.html Fri, 17 Jul 2026 13:48:56 +0000 The Hacker News https://infosecradar.com/stories/2026/07/17/inside-the-search-for-clean-residential-proxies-for-carding/ Cybercriminals are increasingly finding it difficult to use residential proxies for carding due to enhanced fraud detection. They are now combining proxies with other identity signals like browser fingerprints and device profiles to circumvent these defenses and improve their success rates. https://www.bleepingcomputer.com/news/security/inside-the-search-for-clean-residential-proxies-for-carding/ Fri, 17 Jul 2026 14:00:10 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/17/in-other-news-iran-tracks-us-military-phones-crashstealer-macos-malware-cvd-blue/ This article covers several disparate cybersecurity and intelligence news items, including Iran's alleged tracking of US military phones, the emergence of CrashStealer malware targeting macOS, and a new blueprint for building secure AI models (CVD Blueprint). It also briefly mentions other stories like OpenClaw AI agents being exploited, ransomware impacting a naval defense firm, and a data breach at Lidl. https://www.securityweek.com/in-other-news-iran-tracks-us-military-phones-crashstealer-macos-malware-cvd-blueprint/ Fri, 17 Jul 2026 14:27:54 +0000 SecurityWeek https://infosecradar.com/stories/2026/07/17/google-must-open-android-to-rival-ai-agents-eu-orders/ The European Union has ordered Google to open the Android operating system to third-party AI assistants and share search data with competitors under the Digital Markets Act. Google has expressed concerns that these regulations could compromise user privacy and security. https://www.csoonline.com/article/4198425/google-must-open-android-to-rival-ai-agents-eu-orders-2.html Fri, 17 Jul 2026 14:38:41 +0000 CSO Online https://infosecradar.com/stories/2026/07/17/ernst-young-discloses-data-breach-after-support-system-hack/ Ernst & Young has disclosed a data breach resulting from a hack of a third-party support ticket system used by its IT staff. The attackers gained access through the compromised system, potentially exposing customer information. EY is currently notifying affected individuals. https://www.bleepingcomputer.com/news/security/ernst-and-young-discloses-data-breach-after-support-system-hack/ Fri, 17 Jul 2026 14:55:28 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/17/scaling-operational-resilience-against-ai-driven-threats/ This article discusses the increasing attack surface created by AI adoption and the limitations of traditional security models. It outlines strategies for building resilience and agility into security operations to manage complexity and detect risks early. https://www.brighttalk.com/webcast/288/672618 Fri, 17 Jul 2026 16:00:20 +0000 BrightTALK InfoSec https://infosecradar.com/stories/2026/07/17/ai-spam-filters-are-getting-suckered-by-old-school-text-salting/ Older, text-salting techniques used to bypass spam filters decades ago are now proving effective against some LLM-powered email filtering systems. This suggests that AI-based defenses are not always superior to traditional methods when it comes to identifying malicious or unwanted emails. https://www.theregister.com/security/2026/07/17/ai-spam-filters-are-getting-suckered-by-old-school-text-salting/5274434 Fri, 17 Jul 2026 16:15:22 +0000 The Register (Security) https://infosecradar.com/stories/2026/07/17/goldeneyedog-subgroup-linked-to-digicert-breach-and-code-signing-certificate-the/ Cybersecurity researchers have linked the April 2026 DigiCert security incident to a threat group named CylindricalCanine. This group is identified as a subgroup of GoldenEyeDog, a Chinese cybercrime entity previously associated with targeting the gambling and gaming industries. https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html Fri, 17 Jul 2026 16:39:16 +0000 The Hacker News https://infosecradar.com/stories/2026/07/17/the-real-ai-threat-is-blind-trust/ The article warns that AI models, when granted the ability to both interpret and execute commands, pose a significant cybersecurity threat by bypassing essential human oversight. This unchecked autonomy allows AI to directly act on potentially malicious interpretations, creating vulnerabilities that attackers could exploit. https://www.darkreading.com/application-security/real-ai-threat-blind-trust Fri, 17 Jul 2026 16:43:13 +0000 Dark Reading https://infosecradar.com/stories/2026/07/17/new-nadmesh-botnet-hunts-exposed-ai-services-for-cloud-keys-and-kubernetes-token/ A new Go botnet named NadMesh has been discovered actively targeting exposed AI services, specifically looking for cloud keys and Kubernetes tokens. It utilizes a Shodan harvester to find services like ComfyUI, Ollama, and n8n, and its operator claims to have collected thousands of AWS keys. https://thehackernews.com/2026/07/new-nadmesh-botnet-hunts-exposed-ai.html Fri, 17 Jul 2026 17:12:23 +0000 The Hacker News https://infosecradar.com/stories/2026/07/17/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload/ A vulnerability named HollowByte allows unauthenticated attackers to cause a denial-of-service (DoS) on OpenSSL servers. This is achieved by sending a small, malicious 11-byte payload that causes excessive memory bloating. https://www.bleepingcomputer.com/news/security/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload/ Fri, 17 Jul 2026 17:56:21 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/17/seven-malicious-vite-npm-packages-use-blockchain-c2-to-deliver-a-rat/ Researchers have uncovered seven malicious npm packages targeting the Vite frontend tooling ecosystem, named ViteVenom by Checkmarx. This campaign, an expansion of the ChainVeil threat, utilizes a sophisticated four-tier blockchain-based command-and-control infrastructure across various networks to deliver a Remote Access Trojan (RAT). https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html Fri, 17 Jul 2026 18:54:51 +0000 The Hacker News