💥 BREACHES & INCIDENTS
- EY breach via third-party IT support platform exposes Goldman Sachs and Man Group client tax data
An EY breach of a third-party IT support platform exposed personal and financial tax data of Goldman Sachs and Man Group clients.- Affects clients of Goldman Sachs' wealth management business and UK-listed hedge fund Man Group, plus other EY tax clients; state filings imply at least 2,700 affected individuals across California, Texas, Massachusetts, and Vermont.
- Exposed data includes names, addresses, tax identification numbers, email addresses, financial details, Social Security numbers, and bank account and card numbers from tax preparation documents.
- An unauthorized third party accessed EY's third-party IT service management platform between March 28 and April 12, 2026, downloading client documents from support tickets; EY attributed the entry point to a vulnerability in Checkmarx software, though no CVE or version has been identified.
- EY detected anomalous activity on April 23, 2026, and notification letters went out July 13 — an 81-day gap between detection and disclosure.
- Goldman Sachs and Man Group both confirmed their own systems were not compromised; EY reported the breach to regulators in four states and is offering credit monitoring.
🕵️ RESEARCH & DEEP DIVES
GitHub Copilot CLI flaw lets encrypted prompt injection steal developer secrets
Researchers showed that encrypted prompt injection can make GitHub Copilot CLI read local developer files and exfiltrate them to an attacker-controlled server.- Affects GitHub Copilot CLI running in autopilot mode when a developer asks the agent to review an external URL.
- The technique, Cryptographic Context Injection, hides malicious instructions as ciphertext that static prompt-injection filters cannot inspect.
- The page instructs Copilot to decrypt the payload with Python; a templated 'key' forces the agent to read local files (e.g. .env.prod) as a side effect, then a real key decrypts second-stage instructions that send the harvested data to an attacker endpoint.
- In a proof of concept, the full chain completed in 28 seconds with no visible warning; any agent-readable data, including source code, credentials, and tokens outside the project folder, is at risk.
- Microsoft's mai-code-1.1-flash model executed the chain in about half of tests while two GPT-5.6 models refused it; GitHub's bug bounty team validated the report but did not classify it as a security vulnerability.
Anthropic expands Cyber Verification Program to three access tiers for verified security professionals
Anthropic has expanded its Cyber Verification Program into three access tiers giving verified security professionals reduced cyber safeguards on Claude models.- Applies to security teams, red teams, critical infrastructure operators, universities, government bodies, and individual researchers using Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and future models.
- Defense Access covers SOC work, incident response, malware reverse engineering, and vulnerability analysis; Red Team Access adds authorized penetration testing; Specialized Access, with the fewest blocks, is for organizations testing power grids, flight systems, telecom networks, and government networks.
- Red Team Access users still face real-time blocks on ransomware deployment, physical system damage, and pen testing of high-risk safety systems; Specialized Access applicants are reviewed in collaboration with the US government.
- The program merges Project Glasswing and the earlier CVP; Glasswing partners reported at least 129,000 verified vulnerabilities found between April and July 2026, over 33,000 rated critical or high severity.
- Data retention is required for enrolled organizations; Defense Access organizations must adopt phishing-resistant MFA and stop using API keys by December 15, 2026.
📋 ADVISORIES
Atlassian patches critical CVE-2026-21589 file access flaw in 8 Data Center products
Atlassian patched a critical unauthenticated arbitrary file access vulnerability (CVE-2026-21589) affecting eight products.- Affects all versions prior to fixes of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd Data Center, Crucible, and Fisheye; rated CVSS 9.3
- Flaw lets unauthenticated attackers read specific files in the web application root directory, but only if they know the file's exact name and path; directory listing is not possible
- Exploitation uses path traversal via URLs containing '..' adjacent to /, \ or ::, including URL-encoded variants; temporary WAF or Tomcat RewriteValve rules can block matching requests
- Fixed versions include Bitbucket 9.4.26/10.2.8/10.5.1, Confluence 9.2.26/10.2.19, Jira 9.12.40/10.3.26/11.3.12, JSM 5.12.40/10.3.26/11.3.12, Bamboo 10.2.24/12.1.12, Crowd 6.3.7/7.0.3/7.1.7/7.2.4, Crucible and Fisheye 4.9.15
- Atlassian Cloud products were already patched with no evidence of exploitation; WatchTowr warns Crowd SSO credentials stored in plaintext at a predictable path could be trivially extracted
📄 Source for Android's October 2026 updates patch 25 vulnerabilities, including critical privilege escalation bug — source.android.com
🔓 CVEs & KEV
- CVE-2026-79805 — Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) — CVSS 9.8 — ClearPass Policy Manager Authenticated Path Traversal Allows Arbitrary File Manipulation