🕵️ RESEARCH & DEEP DIVES
Ohio man gets 15 years in first US conviction under Take It Down Act for AI deepfake sextortion
An Ohio man was sentenced to 15 years in federal prison for sextortion and cyberstalking using AI-generated explicit content.- James Strahler II, 37, of Columbus, Ohio, was sentenced to 180 months for cyberstalking, producing obscene child sexual abuse material, and publishing digital forgeries.
- At least six adult women and multiple children were targeted with real and AI-generated explicit images from December 2024 to June 2025.
- Strahler used over 24 AI platforms and 100+ web-based AI models, harassing victims via calls, voicemails, texts, and online posts.
- He created AI pornographic videos depicting a victim with her father and distributed them to her co-workers, and posted 700+ images of real and morphed children to a child abuse website.
- The case is the first US conviction under the Take It Down Act, a 2025 law banning nonconsensual intimate images and AI forgeries.
CISA Warns Chinese AI Firms Extract Billions of Tokens From Claude, GPT, Gemini and Grok
CISA has warned that Chinese AI firms are harvesting billions of tokens from leading AI models via large-scale automated requests.- Applies to users and operators of leading AI models including Claude, GPT, Gemini and Grok
- Model outputs are being harvested at massive scale to accelerate rival AI development
- Campaigns use huge volumes of automated requests rather than conventional malware
Over 36,000 exposed Plex servers vulnerable to recent flaws
BleepingComputerThis Key Will Self-Destruct: An Open Standard for Revocable API Keys
SecurityWeekNew Phishing Attack Creates Malicious Pages Inside the Victim’s Browser
SecurityWeekUntracked Nightmares: The Threats Hiding Behind Commodity Infrastructure
Palo Alto Unit 42Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
The Hacker NewsNew cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root
The Hacker NewsF5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
The Hacker NewsResearcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed
The Hacker NewsSAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution
The Hacker NewsOpen Redirect in Yordam Informatics's Library Automation SystemURL redirectio...
CVE ThreatIntSSRF in Yordam Informatics's Library Automation SystemServer-Side request for...
CVE ThreatIntDOM-based XSS vulnerability in OpenTextTM Documentum WebtopDocumentum Webtop v...
CVE ThreatIntImproper Authorization in Yordam Informatics' Library Reservation SystemMissi...
CVE ThreatIntBubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files o...
CVE ThreatIntLocal privilege escalation vulnerability in ESET AV RemoverImproper Privilege...
CVE ThreatIntCookie Banner for GDPR / CCPA through 4.4.1 - Unauthenticated Stored Cross-Site Sc...
CVE ThreatIntYITH WooCommerce Waitlist Premium through 3.35.0 - Authenticated (Subscriber+) Pri...
CVE ThreatIntVarious Newfold Plugins Various Versions - Unauthenticated Authentication Byp...
CVE ThreatIntSensitive information is leaked into NeuVector’s manager container logsAn Ins...
CVE ThreatIntClient IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iF...
CVE ThreatIntRemote Code Execution in Google ADK for Python via Incomplete Standard Librar...
CVE ThreatIntWindows Remote Desktop Client Vulnerability Allows Attackers to Execute Remote Code
Cyber Security NewsNew Windows Defender ShieldCrash 0-Day Bypasses Microsoft Patch to Read Files as SYSTEM
Cyber Security NewsNew cPanel Vulnerability Allows Attacker to Gain Full Control of the Server
Cyber Security NewsDisable Windows Defender via Antivirus Fake Registration
r/netsecThere Is No Such Thing as “Rogue AI.” AI Is Rogue by Design
securityboulevard.com (discovered)When Compromised Access, Medtech Disruption, and Critical Infrastructure Attacks Put Business Continuity at Risk
securityboulevard.com (discovered)