news
Security Leftovers
-
Security Week ☛ Cyberattacks on Minnesota Water Systems Investigated as Officials Warn About Iranian Hackers
Iran has the “geopolitical motivations” and a recent history of targeting water systems, experts pointed out.
-
Security Week ☛ CareCloud Data Breach Impacts Over 350,000
In March 2026, hackers stole personal, financial, and medical information from the company’s proprietary trap AWS environment.
-
Security Week ☛ Critical Code Execution Vulnerability Patched in TeamCity
Tracked as CVE-2026-63077, the security defect can be exploited without authentication via the agent polling protocol.
-
Silicon Angle ☛ Anthropic discloses that Claude hacked three organizations during internal tests
Three of Anthropic PBC’s large language models carried out successful cyberattacks during routine internal tests. The company detailed the breaches on Thursday. A few days earlier, rival Proprietary Chaffbot Company Group PBC disclosed a similar incident. Two of the company’s LLMs escaped from an isolated sandbox that was being used to evaluate their cybersecurity capabilities.
-
Security Week ☛ Prompted by Proprietary Chaffbot Company Disclosure, Anthropic Finds Its Own Models Hacked 3 Organizations
A security company’s systems were hacked after it installed a malicious Python package deployed by Claude.
-
Scoop News Group ☛ What the Hugging Face breach reveals about defense in the age of agentic AI
We almost never get both sides of an intrusion. This time we did. Last month, Hugging Face disclosed a breach into part of its production infrastructure, saying an autonomous Hey Hi (AI) agent system ran the attack from start to finish.
-
Security Week ☛ Google Hey Hi (AI) Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace
The internet giant has built an agent harness to find vulnerabilities across Chrome’s codebase.
-
LWN ☛ Security updates for Friday
Security updates have been issued by AlmaLinux (kernel, nodejs-nodemon, nodejs22, nodejs24, openssh, and vim), Debian (gsasl and ruby-rack), Fedora (dokuwiki, lego, libnbd, nasm, pack, unbound, and valkey), Mageia (389-ds-base, libxfont2, nghttp2, and perl-DBI), SUSE (apptainer, bind, ffmpeg-7, freerdp, google-osconfig-agent, graphicsmagick, helm, ImageMagick, java-17-openjdk, java-25-openjdk, keybase-client, kubernetes1.34-apiserver, kubernetes1.35-apiserver, kubernetes1.36-apiserver, kubevirt1.8-container-disk, libarchive, logcli, net-tools, openssl-3, PackageKit, perl-Net-DNS, prometheus-ha_cluster_exporter, python-dulwich, python-sqlparse, python-urwid, python3-pyOpenSSL, python313, python3, runc, s2n, tomcat, tomcat10, tomcat11, and valkey), and Ubuntu (libinput, linux-intel-iot-realtime, linux-intel-iotg-5.15, openssl, python2.7, python3.5, and ruby-sinatra).
-
Scoop News Group ☛ Dihydroxyacetone Man blames Minnesota for cyberattacks on water sector, drawing pushback from cyber world
The president went against his intelligence agencies’ conclusions about Iran being the likely suspect in the campaign.
-
Federal News Network ☛ CISA guidance targets water sector security, open source Hey Hi (AI) and more
CISA has a bevvy of new guidance for agencies and industry this week, including an advisory on cyber attacks targeting U.S. municipal water systems.
-
InfoSecurity Magazine ☛ Cryptominer Abuses Linux PAM to Hide From SOC Analysts
A cryptomining operation has been observed abandoning root access on compromised Linux servers in favor of impersonating low-privileged users, a deliberate downgrade designed to avoid the alerts that root activity triggers in a security operations center (SOC).
According to new research from Group-IB published on July 30, the Monero mining campaign was identified in May 2026 after operators reached a victim network through a trusted third-party relationship.
-
Security Week ☛ Critical Flaw Allowed to Microsoft trap Azure Cosmos DB Pwnage
Named CosmosEscape, the vulnerability exposed the primary key for Cosmos DB accounts, granting full read and write access.