AI Safety Guidelines: 10 Essential Rules to Protect Data, Finances, and Reputation When Working with LLMs
A detailed analysis of emerging AI-related security risks highlights how large language models can autonomously execute attack chains, fall victim to prompt injection, and cause cascading errors in complex workflows. The article examines real-world incidents such as the Anthropic vending machine pricing failure, the Meta Instagram account takeover via overly helpful AI support, and Copilot Studio data leaks through prompt injection. It emphasizes that while attack methods themselves are not revolutionary, AI agents can now scale them at machine speed with autonomous decision-making and recovery capabilities. The piece provides ten concrete safety rules covering financial controls, fact verification, data confidentiality, context pollution prevention, and access limitation. It also stresses that ultimate responsibility always remains with the human operator, not the AI system.
Translated from Russian
Read full articleLatest News
How Modern API Attacks Abuse Legitimate Functionality Instead of Exploiting Vulnerabilities
Traditional API incidents once centered on authorization errors, access control issues, SQL injections, and known vulnerability exploitation. Today, many attacks on APIs no longer require finding code flaws; attackers simply use documented methods, valid authorization, and correct parameters at unexpected scale or timing. NGENIX security teams observe three main behavioral patterns: Burst attacks that overload resource-heavy endpoints, Shortwave attacks that exploit race conditions through timed parallel requests, and Carpet Bombing that distributes activity across dozens of endpoints for reconnaissance or scalping. These techniques often bypass WAF because each individual request appears fully compliant with API specifications. Protection is shifting toward behavioral analysis, sliding-window rate limiting, and monitoring of overall client behavior rather than single-request signatures. Real-world cases include sudden catalog scraping during contests and mass reservation of airline seats without purchases, leading to degraded service for legitimate users.
Translated from Russian
Do You Really Know What Your AI Agent Is Doing in the Sandbox?
The rise of agentic AI systems has exposed critical gaps in observability when agents run inside strong isolation environments. Traditional eBPF-based monitoring on the host kernel fails when agents execute under separate kernels provided by gVisor, Kata, or Firecracker. Experiments with a controlled syscall generator show that visibility depends heavily on filesystem configuration rather than the choice of runtime. Standards such as MCP, OpenTelemetry, and RuntimeClass address parts of the agent lifecycle but leave actual syscall-level reporting undefined. Measurements across multiple configurations reveal that some operations, especially execve, never reach the host regardless of the sandbox used. The findings highlight that security tooling must be re-evaluated after every change in sandbox settings.
Translated from Russian
Revolut Confirms Limited Data Exposure After Fraudulent Government Email Request
Revolut has confirmed that a small number of customers had personal documents and full transaction histories exposed after the company responded to a fraudulent request that appeared to come from a government authority. The incident, disclosed on September 13, involved no intrusion into Revolut systems. Attackers instead used an unauthorized email account that carried valid credentials from a government domain, making the request appear legitimate. Exposed data included passport and driver’s license copies, identity verification selfies, full names, dates of birth, occupations, addresses, contact details, IBAN statements, complete transaction histories, and Bitcoin activity records. The combination of identity documents and detailed financial history significantly raises the risk of account takeover and targeted social engineering. Revolut stated that customer funds remained secure, blocked the malicious email source, notified regulators, and contacted all affected users.
Translated from Portuguese
Casbaneiro Banking Trojan Targets Financial Institutions in Argentina, Peru, Colombia and Mexico
Fortinet researchers identified a Casbaneiro campaign in August that specifically targets bank customers across four Latin American countries. The infection begins with a PDF attachment that displays the recipient's own email address to build credibility and creates urgency around an unpaid invoice or judicial notice. The PDF link performs IP-based geofencing, redirecting non-target visitors to Google or YouTube while delivering a Base64-encoded ZIP only to victims in the selected countries. Inside the archive, an HTA file downloads the legitimate AutoIt interpreter along with a compiled script and compressed payload, helping evade binary-focused defenses. The malware stays dormant until the victim visits a monitored banking website, at which point it activates its C2 channel, exfiltrates Outlook contact data, and can display bank-specific credential-harvesting overlays. Additional remote-access capabilities allow operators to control the keyboard, manipulate the clipboard, and execute arbitrary commands on the infected system.
Translated from Portuguese
WordPress to Automatically Block High-Risk Plugin Updates Before Distribution
WordPress is introducing an automated security screening process for every new plugin release before it reaches millions of sites through the WordPress.org API. Updates flagged with high risk will be blocked from automatic installation, giving developers time to address issues. Previously, only initial plugin submissions were reviewed, while subsequent versions could introduce vulnerabilities, backdoors, or malicious ownership changes without checks. Each release now undergoes a six-hour delay under the Protect The Shire initiative, where multiple AI models and Jetpack Scan analyze changes to produce a combined risk score. High-risk updates are withheld from auto-updates, and developers receive detailed reports. The system has already proven effective by catching a backdoor in a plugin with around 20,000 active installations on July 28, preventing distribution after Wordfence notification. Developers can fix problems and resubmit, or appeal results, though fixing is usually faster than manual review.
Translated from Russian
OpenAI Contractors Manually Review Real User Chats in Project Lily
OpenAI has engaged hundreds of external contractors to analyze actual user conversations with ChatGPT as part of its model improvement efforts. The reviewers, working under project Lily, examine real queries that may contain personal, medical, or other sensitive information despite the use of a Privacy Filter. Contractors summarize prompts, compare four model responses, and assign ratings from one to seven while flagging behaviors such as excessive sycophancy or inappropriate emojis. User identities are hidden and some data is filtered, yet OpenAI acknowledged that not all personal information is reliably removed. The same human review process is also employed by Anthropic for its Claude model. Users can opt out of future training use through account settings, although prior data remains unaffected.
Translated from Russian
UDP Proxies and QUIC Protocol: How Real IP Addresses Leak Through Anti-Detect Browsers
Anti-detect browser users relying on UDP-capable proxies face a hidden risk of real IP leakage when the browser fails to properly route UDP traffic. The QUIC protocol, which powers HTTP/3, runs over UDP and enables features like 0-RTT handshakes, independent streams, and connection migration that can bypass proxy routes. WebRTC connections using ICE, STUN, and TURN further increase exposure because they often attempt direct UDP paths outside the configured SOCKS5 proxy. Without deep network stack control such as TUN interfaces or socket interception, browsers may send WebRTC and QUIC packets through the host's real network interface. Aurorium Browser claims to solve this by natively supporting UDP proxying so that both QUIC and WebRTC traffic stays inside the tunnel. The article stresses that simply disabling WebRTC or forcing HTTP/2 fallback is insufficient and can itself create detectable anomalies for anti-fraud systems.
Translated from Russian
Why Russian Educators Prepare Sixth Graders for Ninth-Grade All-Russian Olympiads in Robotics and Information Security
Maxim Ivankov, who has run robotics and programming schools for children for nine years in a small Russian town, explains the decision to train students starting from fifth grade for the All-Russian Olympiad for Schoolchildren in the ninth-grade category. The strategy addresses the fact that regional and final stages begin only at ninth grade, while earlier participation yields only certificates with no benefits such as BVI university admission or regional prizes. The approach gives students up to five attempts instead of one, allowing systematic skill building similar to consistent athletic training. Challenges include extremely low enrollment despite free classes and widespread use of neural networks to solve school-stage tasks remotely, which distorts results and lacks regulatory prohibitions. The 2025/26 season introduced four separate profiles under informatics, including information security and robotics, both of which grant the same BVI privileges as mathematics or physics. Detailed analysis of past tasks shows a steep difficulty jump from municipal to regional stages, with topics such as the RANSAC algorithm and ten-dimensional hypercube traversal appearing only at the final level.
Translated from Russian
Critical Vulnerabilities Patched in WHMCS Billing Software for Hosting Providers
WebPros International has disclosed two serious vulnerabilities in its WHMCS billing management platform used by hosting and cloud service providers. CVE-2026-67399 allows unauthenticated remote code execution through unsafe deserialization of untrusted data under specific conditions, potentially compromising the entire server environment and associated data. CVE-2026-67398 affects the 2CheckOut payment gateway module and stems from missing authorization checks, enabling attackers to retrieve sensitive customer information including names, addresses, emails, and phone numbers without authentication. HackerOne assigned CVSS v4.0 scores of 9.3 (Critical) to the first issue and 8.2 (High) to the second. WebPros released fixed versions WHMCS 9.0.8 and 8.13.7, and recommended disabling the 2CheckOut module as a temporary mitigation for the second flaw.
Translated from Japanese
From Russian sources
Translated from Russian
Google to Offer Granular Controls for Advanced Protection Mode in Android 16
Google is preparing more flexible settings for its Advanced Protection security mode that first appeared in Android 16. The changes were discovered by Android Authority researchers while examining Google Play Services version 26.36.30. A new Expert features section will let users enable individual protections such as USB Protection, intrusion detection logging, and restrictions on unsafe Wi-Fi networks without activating the entire strict mode. USB Protection blocks new USB connections while the screen is locked to prevent physical attacks, though it can interfere with fast charging on Pixel 6 and newer devices. Users will also be able to opt out of automatic connections to open or risky Wi-Fi networks if they regularly use public hotspots. Intrusion Logging remains optional and stores encrypted security logs in the cloud. The update aims to preserve core security benefits while removing the all-or-nothing requirement of the current Advanced Protection implementation.
Telegram Desktop HTML Export Flaw Allowed Stealthy JavaScript Injection into Chat History
Researchers at ExPatch identified a vulnerability in Telegram Desktop that enabled attackers to embed malicious JavaScript into exported HTML chat histories without user detection. The flaw stemmed from insufficient sanitization of button captions added by bots, allowing hidden scripts to execute when the HTML file was opened in a browser. Malicious messages could be forwarded into chats and remain dormant until export, potentially exfiltrating messages, sender names, and timestamps to attacker servers. The issue affected versions 4.15.1 through 6.9.3, with fixes released in beta 6.9.4 and stable version 7.0.1 on July 14. No in-the-wild exploitation was observed, though the attack required specific conditions including an unpatched export and JavaScript-enabled browser. Users are advised to re-export chats after updating or open old files with JavaScript disabled.
Critical MikroTik RouterOS Vulnerabilities Enable SSH Authentication Bypass and Privilege Escalation
Polish CERT disclosed three vulnerabilities in MikroTik routers, two of which have been actively exploited since at least September 2. The flaws, rated 9.2 on CVSS, affect devices with internet-facing SSH access and were discovered using OpenAI models GPT 5.5 Cyber and GPT 5.6 Sol followed by manual verification. CVE-2026-67276 allows authentication bypass when the attacker knows the username and public key module, while CVE-2026-86060 permits privilege escalation via usernames containing invalid characters. Their combination enables full device compromise. A third issue, CVE-2026-67277 rated 8.8, resides in the speed-test service and can cause denial of service. Patches are available in RouterOS versions 7.25beta3, 7.24.2, 7.23.4 and 6.49.21, and MikroTik added detection for prior compromise. Attacks began concurrently with patch release and leave distinctive log entries.
Yookassa Webhook Flaw Allowed Forging Payment Confirmations via Single Curl Request
A technical audit of a car rental service uncovered a critical flaw in the Yookassa webhook handler where payment.succeeded events were trusted without verification. The endpoint accepted the event type and gateway_payment_id directly from the client-supplied payload, enabling attackers to mark pending bookings as paid using a simple unauthenticated POST request. The vulnerability existed because the integration did not use Yookassa's optional Webhook-Signature mechanism and avoided IP allowlisting due to proxy infrastructure concerns. Developers addressed the issue by implementing a reverse API call to fetch authoritative payment status from Yookassa before updating records, ensuring fail-closed behavior on errors. New tests cover forgery attempts, amount mismatches, and idempotency, while several additional hardening measures were deliberately deferred to keep the patch minimal and reviewable. The original unit tests had masked the problem by simulating trusted input rather than validating source authenticity.
Corporate Boomerang: WordPress Founder Matt Mullenweg Survives Board Coup at Automattic
Automattic experienced a rapid corporate power struggle when its board placed founder and CEO Matt Mullenweg on forced paid leave. Within two days Mullenweg regained control by leveraging his shareholder voting rights and removed opposing administrators from the company Slack. The original board members who supported his ouster are now departing the company. The brief conflict highlighted how corporate governance rules allowed shareholders to ultimately determine board composition. Mullenweg described his restored position as that of a pirate before announcing renewed alignment with the board. Public support from WordPress leadership helped solidify his return to leadership.
Russian Transport Ministry Ready to Provide Regulatory Framework for Poplar Fluff Vacuum Robots
The Russian Ministry of Transport has signaled readiness to develop necessary regulations if municipal services express interest in specialized robots designed to collect poplar fluff from city streets. The statement from Minister Andrey Nikitin follows a viral meme that originated from a two-year-old video created by the agency Out Digital. Although no real machines called пухосос exist and no serial production has been launched, the fictional concept gained widespread attention after being presented as an actual Moscow development. The Department of Housing and Utilities in Moscow playfully expanded the joke by introducing additional fictional devices named Zasosyor, Musorozhor, and Gazonyukh. Linguistic experts at Gramota.ru later analyzed the newly coined term, further amplifying the meme's reach across Russian media and social networks. The minister emphasized that any future regulatory support would depend entirely on demand from communal services rather than proactive development by the ministry itself.
From Japanese sources
Translated from Japanese
Cisco Releases Critical Patches for Exploited SQL Injection Flaw in Secure Email Gateway
Cisco Systems has issued security updates for Cisco Secure Email Gateway to address a critical SQL injection vulnerability tracked as CVE-2026-76461. The flaw stems from insufficient input validation during email parsing and allows unauthenticated remote attackers to execute arbitrary SQL commands. Successful exploitation can lead to root-level access on the underlying operating system, enabling full command execution. The vulnerability carries a CVSSv3.1 base score of 9.8 and is rated Critical. Cisco confirmed active exploitation of the issue in September 2026. Recommended fixes include upgrading to versions 16.5.0-780, 16.0.4-3021, or 15.5.5-0141, with strong preference given to the newest release.
Critical SSRF Vulnerability in AWS SSM Agent Allows IAM Credential Theft via Port Forwarding Bypass
Amazon Web Services has disclosed a high-severity server-side request forgery vulnerability in the AWS Systems Manager Agent. The flaw, tracked as CVE-2026-89049, affects the port forwarding feature used by Session Manager and stems from insufficient validation that permits bypass of deny-list restrictions on link-local addresses. Successful exploitation requires port-forwarding permissions but can lead to unauthorized access to instance metadata and temporary IAM role credentials. The company rated the issue as Important with CVSSv4.0 base score 8.5 and CVSSv3.1 score 9.9. The vulnerability was addressed in version 3.3.4851.0 released on 13 July 2026, prior to the public advisory issued on 10 September 2026.
CISA Adds Four Actively Exploited Vulnerabilities in GitLab, ConnectWise ScreenConnect and JFrog Artifactory to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency has added four vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The flaws affect GitLab Community Edition and Enterprise Edition, ConnectWise ScreenConnect, and JFrog Artifactory. CVE-2026-85706 allows unauthenticated path traversal in GitLab’s commit API, enabling arbitrary file reads. CVE-2026-84869 in ScreenConnect permits unauthorized file transfer and execution over active remote sessions. Two additional issues in Artifactory, CVE-2026-42018 and CVE-2026-42016, can lead to token leakage and privilege escalation. Federal agencies have been directed to apply mitigations and investigate potential compromises by specific deadlines.
Critical Vulnerability in ConnectWise ScreenConnect Enables Unauthorized File Transfers
ConnectWise has disclosed a serious vulnerability in its remote access product ScreenConnect that allows attackers to transfer and execute files from active remote sessions without requiring authorization or host-side confirmation. The flaw, tracked as CVE-2026-84869, impacts both Support and Access session types and carries a CVSS v3.1 base score of 9.9, placing it in the Critical severity category. The company rated the issue as Important in its three-tier scale and assigned it the highest priority of High. Exploitation of the vulnerability has already been confirmed in the wild, increasing the urgency for organizations using the product. ConnectWise published the security advisory on September 8, 2026, urging users to apply available mitigations promptly. The vulnerability stems from improper handling in the file transfer process within the client component.
Unauthorized Access to Japan's Government Solution Service (GSS) Exposes 246,000 Personal Records via VPN Flaw
Japan's Digital Agency confirmed that its Government Solution Service (GSS) suffered unauthorized access after attackers exploited a vulnerability in VPN equipment used for external maintenance operations. The intrusion, believed to have begun in late May 2026, allowed threat actors to compromise maintenance accounts and access large volumes of files on internal servers. On June 25, 2026, security teams detected suspicious access to numerous files using a compromised account, prompting an investigation that concluded on July 9 with confirmation of the breach. Some files containing personal information may have been exfiltrated, affecting approximately 246,000 records of government officials, civil servants, contractors, and related individuals. The agency immediately disabled the affected accounts and severed external communications on July 9 but has not disclosed technical details of the exploited VPN vulnerability. The incident was reported by Security NEXT on September 11, 2026.
CISA Adds MikroTik RouterOS Flaws CVE-2026-67277 and CVE-2026-86060 to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities in MikroTik RouterOS to its Known Exploited Vulnerabilities Catalog. CVE-2026-86060 stems from improper sanitization of command argument delimiters and can lead to privilege escalation after an attacker gains access to the SSH login helper and alters trusted policy masks. CVE-2026-67277 involves missing authentication checks in critical RouterOS functions, allowing connections before authentication completes and potentially leaking kernel memory or causing denial-of-service conditions. CISA directed US federal agencies to apply mitigations by September 13 and specifically investigate any signs of compromise related to CVE-2026-86060. The agency noted that the flaws carry broader exploitation risk and urged all organizations using affected MikroTik products to take immediate action.
From Portuguese sources
Translated from Portuguese
Android Ransomware Mantax Otax Encrypts Files and Streams Victim Screen in Real Time
Researchers at Zimperium have identified a new Android ransomware strain called Mantax Otax that combines file encryption with live screen recording and surveillance capabilities. The malware is distributed through sideloaded APK files delivered via messaging apps and phishing messages rather than official app stores. Once installed, it uses AES encryption to lock files with the .enc extension and conducts ransom negotiations directly on the infected device through an on-screen chat interface. In addition to encryption, Mantax Otax continuously captures the screen, saves footage as MP4 video, and streams it to operators while also photographing the surroundings with the device camera. The malware abuses accessibility services to read on-screen content, intercepts SMS messages to steal two-factor authentication codes, and exfiltrates contacts, call logs, browser history, and credentials from WhatsApp and Telegram. It also displays a fake lock screen to capture the device PIN. Impact is reduced on Android 10 and later due to Scoped Storage restrictions, though surveillance functions remain active. Evidence points to a targeted campaign against users in Indonesia.
Russian State-Linked Group GTG-20006 Uses Anthropic AI Agents to Automate Malware Rebuilding
Anthropic has identified a Russian state-linked operation tracked as GTG-20006 that deployed autonomous AI agents to continuously rebuild its malware arsenal whenever detections occurred. The group, connected to Midnight Blizzard, APT29 and Cozy Bear, created a closed-loop automation system in which AI agents monitored tool performance against known defenses and triggered immediate code modifications to evade security products. Beyond malware, the agents handled domain registration, hosting infrastructure setup, phishing email delivery, command-and-control channel monitoring and implant persistence tracking across compromised environments. The campaign, active in July and August 2026 and overlapping with CaptiveCrunch, targeted more than twenty organizations including ministries, defense bodies, embassies and think tanks across Ukraine, Europe, the Middle East and Asia. In one incident the attackers exfiltrated over 300,000 national identity records and commercial registration data for more than 500,000 companies. Anthropic disrupted the activity and published a detailed report highlighting how the automation shifted the cost burden back onto defenders.
Check Point Patches Two Critical VPN Vulnerabilities Allowing Unauthenticated Remote Code Execution
Check Point has released fixes for two critical vulnerabilities affecting its Security Gateway, Security Management Server, and locally managed Spark Firewall products. Both flaws received a CVSS score of 9.8 and enable remote code execution without requiring authentication. CVE-2026-85102 resides in certificate trust validation during VPN negotiation, allowing an unauthenticated attacker to force the process and execute arbitrary code. CVE-2026-85103 is a heap buffer overflow triggered while parsing the ASN.1 structure of VPN certificates. Affected versions include R81.20, R82, and R82.10 before the listed hotfixes, as well as unsupported R80.40 and R81 releases. R82.20 remains unaffected. The issues were discovered internally by Check Point researchers, with no active exploitation or public proof-of-concept observed as of the September 10 disclosure.
Cybercriminals Distribute NJRAT, DCRAT and Chaos via Fake GTA 6 Downloads
Threat actors are leveraging anticipation around GTA 6 to spread multiple malware families through fake game downloads. Security researchers at Huntress identified campaigns that combine search-engine poisoning, gaming forums, torrent sites and social-media posts to deliver oversized fake ISO files exceeding 100 GB. Victims who execute the installer see Russian-language messages claiming an invalid crack or missing license, while remote-access tools and data stealers run silently in the background. The delivered payloads include NJRAT and DCRAT for keystroke logging, screen capture and webcam access, Mercurial Grabber for harvesting browser credentials and Discord tokens, and the Chaos wiper that encrypts small files and overwrites larger ones. The operation primarily targets Russian-speaking gamers, as indicated by the ransom note and error messages. Analysts recommend avoiding unofficial downloads and isolating any compromised systems immediately.
Microsoft Fixes Remote Code Execution Flaw in Windows Remote Desktop Client
Microsoft has addressed a remote code execution vulnerability in the Windows Remote Desktop Client tracked as CVE-2026-69485 with a CVSS score of 8.8. The flaw stems from the use of an uninitialized resource and can be triggered by a specially crafted network request from an authenticated attacker with low privileges. Exploitation requires no user interaction such as clicking links or opening files and can lead to information disclosure, file modification, or service disruption. Multiple versions of Windows 10, Windows 11, and Windows Server 2016 through 2025 are affected, including Server Core installations. The issue was not publicly disclosed prior to patching and no active exploitation has been observed. Fixes were released in the September security updates including KB5124008 and KB5122871.
US Accuses Chinese AI Companies of Industrial-Scale Model Distillation Targeting Claude, GPT, Gemini and Grok
US agencies have accused six Chinese artificial intelligence firms of conducting large-scale unauthorized distillation operations to replicate advanced capabilities from leading models including Claude, GPT, Gemini, and Grok. The activity is reported to have begun at least by late 2024 and involved DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. Billions of tokens were extracted through millions of automated API requests routed via cloud providers, aggregators, and proxies to conceal origins and evade detection. The targeted capabilities included chain-of-thought reasoning, programming, software engineering, autonomous agent functions, and multimodal processing. Shared premium accounts and bulk subscriptions were used to lower costs while automated route-switching systems helped maintain access after blocks. Authorities assess that the sophistication and volume indicate distillation has become a core development method for these companies and likely occurred with Chinese government awareness. China has rejected the claims, stating its AI progress stems from independent innovation and calling the allegations unfounded.
From Chinese sources
Translated from Chinese
Anthropic Exposes Widespread Weaponization of Claude by Nation-State Hackers and Cybercriminals for Automated Attacks
Anthropic has released a threat intelligence report detailing how multiple state-sponsored and criminal groups systematically abused its Claude model between December 2025 and August 2026. The company introduced the term Generative Threat Groups to describe actors that built multi-agent frameworks to automate reconnaissance, exploitation, and data exfiltration. One group identified as GTG-20006, widely linked to Midnight Blizzard, APT29 and Cozy Bear, created an AI-driven workflow that automatically rewrites and redeploys malware once security tools detect it. The report highlights that this capability collapses the traditional gap between well-resourced nation-state operations and individual attackers. Defensive recommendations focus on shifting detection to behavioral chains, shortening IOC validity periods, strengthening data-loss prevention, and establishing internal governance for AI tool usage.
Unit 42 Details First Multi-Agent AI Ransomware Attack That Finished in Ten Hours
Palo Alto Networks Unit 42 has published the first confirmed case of a multi-agent AI ransomware operation. Attackers only defined the target; more than ten specialized AI agents then performed reconnaissance, credential harvesting, lateral movement, data exfiltration, and encryption within ten hours. The agents used over fifty ATT&CK techniques and successfully hid command traffic inside the victim’s own AI service endpoints. After encryption the same agents automatically generated an eighty-page security audit report listing every compromised system and technique. The sole defensive control that stopped part of the attack was a mandatory multi-person code review rule on Terraform changes. Unit 42 links the operation to frontier large-language-model frameworks and notes that earlier single-agent incidents such as JADEPUFFER have now evolved into coordinated agent fleets.
South Korean Medical Beauty Platform Gangnam Unni Suffers API Breach Exposing 220,000 Users' Sensitive Photos and Medical Records
Healing Paper, operator of South Korea's largest medical beauty information platform Gangnam Unni, confirmed a data breach affecting nearly 220,000 customers after an API endpoint used to query consultation records was abnormally accessed. The incident exposed highly sensitive personal information including names, contact details, medical consultation reasons, treatment progress, uploaded pre-procedure photos, appointment times, actual procedures performed, and payment information. Approximately 160,000 South Korean users and 60,000 overseas users were impacted, including 481 from mainland China, 4,218 from Taiwan, and others from Japan and Thailand. Attackers exploited weak authentication and rate limiting on the API, first detected on September 4, with a second attempt on a different path the following day. The breach raises risks of targeted phishing and extortion using victims' private medical images and records. Healing Paper has reported the incident to authorities, implemented enhanced authentication and monitoring, and allowed users to check their exposure status within 30 days.
Liquid Network Federation Wallet Drained of 4000 BTC in Alleged White-Hat Exploit Exposing L-BTC Minting Flaw
On September 7, the Liquid Network sidechain suffered a major incident where its Federation wallet lost approximately 4000 Bitcoin, worth around $320 million or 2.1 billion RMB, leaving only 200 BTC behind. The funds were moved through the authorized SideSwap settlement platform using PAK keys without any reported key compromise. Liquid officials described the actor as a claimed white-hat hacker intending to return assets for a fee, but security experts point to a critical vulnerability allowing unauthorized L-BTC minting that could bypass the 1:1 Bitcoin backing mechanism. The network has halted all new transactions while federation members work on remediation, affecting major platforms including BTSE, Bitfinex, and BitMEX. This event aligns with a broader 2026 trend where attackers target protocol-level asset issuance rather than individual keys, as seen in recent Coldcard RNG flaws and other incidents totaling $972 million in crypto thefts. The case underscores weaknesses in multi-signature federation validation and cross-chain anchoring that go beyond traditional smart contract bugs.
Widespread AI Outage Exposes Fragile Cloud Dependencies Behind ChatGPT, Claude and Grok
On September 3, major AI services including ChatGPT, Claude, Grok, Copilot and Gemini suffered a simultaneous outage lasting nearly four hours. The incident began around 9:30 a.m. ET with ChatGPT and rapidly spread, generating over 12,000 reports on Downdetector within twenty minutes. Industry analysis points to underlying cloud infrastructure rather than the models themselves, with Microsoft Azure and Cloudflare identified as the most likely points of failure. Developers relying on tools such as Cursor experienced immediate loss of code completion and intelligent assistance, forcing manual workflows. The event highlighted single points of failure created by heavy concentration of AI workloads on a small number of cloud providers. Security professionals are urged to map AI supply chains, prepare fallback procedures, monitor infrastructure status pages and adopt multi-vendor routing for critical operations.
CISA Adds Seven Actively Exploited Vulnerabilities to KEV Catalog, Including SonicWall and LiteLLM Flaws Targeting AI Infrastructure
CISA has added seven vulnerabilities confirmed to be exploited in the wild to its Known Exploited Vulnerabilities catalog, with two carrying CVSS scores of 10.0. The list includes critical issues in SonicWall SMA 1000 devices, JFrog Artifactory, Kestra workflow engine, and LiteLLM AI gateway components. Attackers are now systematically targeting AI infrastructure to steal large language model API keys and configuration data from databases such as LiteLLM_ProxyModelTable. Qilin ransomware operators have already chained LiteLLM flaws for remote code execution and data theft. CISA has set a 48-hour remediation deadline for federal agencies, underscoring the urgency for all organizations running these components.
From Spanish sources
Translated from Spanish
Twitch Enhanced Viewer Extension Leaks OAuth Tokens From Nearly 31,000 Users
The browser extension Twitch Enhanced Viewer | JeetBot, available in the official Chrome Web Store and Mozilla Add-ons, secretly forwarded OAuth session tokens to proxies controlled by its operator. These bearer tokens allow full account takeover without passwords or second-factor authentication, enabling actions such as reading and sending whispers, posting in chat, and modifying account settings. The issue surfaced prominently in the v85.x branch where tokens were appended as the &auth= query parameter during network redirects to operator-controlled proxy servers, exposing them in clear text within proxy logs. Earlier v4.x versions had already transmitted tokens via POST requests to a set-token endpoint and backup servers on deno.dev and deno.net. A fix appeared in Firefox version 85.8.7 that stops token exfiltration by altering playlist retrieval, while a Chrome patch is in preparation. Users are advised to uninstall the extension immediately, revoke all active Twitch sessions, and review recent account activity for signs of unauthorized use.
Twitch Enhanced Viewer Extension Leaks OAuth Tokens from Nearly 31,000 Users
The browser extension Twitch Enhanced Viewer | JeetBot, available in the official Chrome Web Store and Mozilla Add-ons, secretly forwarded OAuth session tokens to proxies controlled by its operator. These bearer tokens allow full account takeover without passwords or second-factor authentication, enabling actions such as reading and sending whispers, posting in chat, and modifying account settings. The issue became especially severe in the v85.x branch, where tokens were appended as the &auth= query parameter during network redirects to the operator’s proxy servers, exposing them in clear text within proxy logs. Earlier versions had already transmitted tokens via POST requests to a set-token endpoint and maintained backup endpoints on deno.dev and deno.net. A fix is available in Firefox starting with version 85.8.7, which stops token exfiltration by changing the playlist retrieval method, while a corresponding Chrome patch is in preparation. Users are advised to uninstall the extension immediately, revoke all active Twitch sessions, and review recent account activity for signs of unauthorized use.
Attackers Chain JFrog Artifactory CVEs for Rapid Admin Takeover and Backdoor Deployment
Real-world attacks against self-hosted JFrog Artifactory have chained multiple CVEs to escalate from unauthenticated requests to full administrative control. Attackers achieved persistence by installing malicious Groovy plugins, executing shell commands, and deploying Rust-based backdoors within minutes. The primary chain relies on CVE-2026-42018 and CVE-2026-42016, allowing anonymous token acquisition and privilege escalation without proper scope validation. A separate critical flaw, CVE-2026-82329 with CVSS 9.8, enables direct authentication bypass and admin token creation on default configurations. Patches are available across multiple 7.x branches, and defenders are urged to audit logs for anonymous admin actions and inspect for unauthorized plugins and binaries. The incidents highlight risks to software supply chains when artifact repositories are compromised.
Trezor Warns of Email Provider Breach Used in Targeted Phishing Campaign Against Hardware Wallet Users
Trezor has disclosed that attackers compromised an external email provider and leveraged it to send phishing messages that appeared to originate from the company. The emails carried the subject line 'Critical Security Alert: STM32 Entropy Vulnerability' and falsely claimed a hardware flaw in STM32 microcontrollers that would reduce entropy and allow seed phrase reconstruction. No such CVE exists, and the campaign followed classic social-engineering patterns of urgency and brand impersonation aimed at stealing recovery phrases. Trezor has since disabled the malicious domain and continues investigating how the provider was accessed. Similar messages may have reached users of BitBox, suggesting possible compromise of shared service providers across the hardware wallet ecosystem. The incident underscores the difficulty of detecting phishing when it originates from legitimate third-party infrastructure.
Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)
Google has released an urgent update for Chrome to address CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript engine that is being actively exploited in the wild. The flaw is a type confusion issue within the Maglev compiler, specifically tied to optimizations around Array.prototype.sort, which can lead to arbitrary memory read and write primitives inside the JavaScript heap. Attackers can exploit the vulnerability by tricking victims into visiting a specially crafted HTML page, enabling remote code execution within the browser sandbox. The update brings Chrome to version 152.0.7977.82 or higher on Windows, macOS, and Linux, while also addressing a total of 12 vulnerabilities. The issue was reported by researcher Salvatore Gulizia, known as Serotav, who received a $1,000 reward. Other Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi will require corresponding updates from their vendors.
Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)
Google has released an urgent update for Chrome to address CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript and WebAssembly engine that is being actively exploited in the wild. The flaw is a type confusion issue tied to the Maglev compiler and optimizations around Array.prototype.sort, which can lead to arbitrary memory read and write primitives inside the JavaScript heap. Successful exploitation allows a remote attacker to execute arbitrary code within the browser sandbox after a victim visits a specially crafted HTML page, a technique commonly seen in malvertising and compromised-site campaigns. The fix is included in Chrome 152.0.7977.82 and later for Windows, macOS, and Linux, and the update also resolves a total of twelve vulnerabilities. The vulnerability was reported on 4 August 2026 by researcher Salvatore Gulizia, known as Serotav, who received a $1,000 reward. Other Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi will require corresponding updates from their respective vendors.