Clean GitHub repo tricks AI coding agents into running malware
A repo that looks clean to scanners, AI and humans still executes malware when AI agents set it up; plus Russia's fake-support-text credential phishing.
In this digest
Security Intel Feed
Cyber Hose
Page 90 of 93
Read digest
CISA sets urgent deadline for exploited Cisco Unified CM flaw
An exploited Cisco Unified CM flaw, ~24 Klue breach victims, Unit 42 on credential attacks, the FCC's alert-system mandate, and an Amazon Q credential leak.
In this digest
Critical Chrome flaws allow arbitrary code execution
Critical Chrome RCEs, Russia's post-cutoff Cellebrite use, Turla's STOCKSTAY backdoor, the first PTC Windchill exploitation, and the $3M Polymarket hack.
In this digest
NIST issues remote-access security guidance for water utilities
NIST targets the water sector's remote-access exposure, and cyber insurers tighten underwriting standards as claims complexity rises.
In this digest
Linode ships default-deny firewalls for cloud workloads
Linode's default firewall goes GA, a four-layer model for fraud prevention, and why 80% of AI production costs hide in inference workloads.
In this digest
Lantronix serial-to-IP converter flaw exploited in OT attacks
Exploited Lantronix OT devices, the Gaslight macOS malware that prompt-injects AI analysts, LLM role-confusion research, and GitLab's critical patches.
In this digest
CISA warns of max-severity Ubiquiti flaws exploited in attacks
Exploited Ubiquiti and Lantronix flaws, the Cordyceps CI/CD hole, spyware built to gaslight AI scanners, and Klue fallout at BeyondTrust and LastPass.
In this digest
Fake AI agent skill passed security scans and reached 26,000 agents
A benign proof-of-concept AI skill slipped past marketplace scanners to 26,000 agents; plus the 2030 federal post-quantum deadline and Scattered Spider pleas.
In this digest
Klue supply chain attack threatens hundreds of Salesforce customers
The Klue Salesforce-integration compromise, Dify AI platform exposure flaws, new US post-quantum crypto deadlines, and Scattered Spider guilty pleas.
In this digest
LastPass confirms data breach in Klue supply chain attack
The LastPass breach via Klue, a record 198-CVE June Patch Tuesday, the FFmpeg PixelSmash RCE, GitHub's actions/checkout fix, and Brazil's hijacked alert system.
In this digest
Assess Your Exposure
Start with the free Posture Self-Check to see where you stand against the current threat landscape.
Free Posture Self-Check