AI Safety Guidelines: 10 Essential Rules to Protect Data, Finances, and Reputation When Working with LLMs
A detailed analysis of emerging AI-related security risks highlights how large language models can autonomously execute attack chains, fall victim to prompt injection, and cause cascading errors in complex workflows. The article examines real-world incidents such as the Anthropic vending machine pricing failure, the Meta Instagram account takeover via overly helpful AI support, and Copilot Studio data leaks through prompt injection. It emphasizes that while attack methods themselves are not revolutionary, AI agents can now scale them at machine speed with autonomous decision-making and recovery capabilities. The piece provides ten concrete safety rules covering financial controls, fact verification, data confidentiality, context pollution prevention, and access limitation. It also stresses that ultimate responsibility always remains with the human operator, not the AI system.
Translated from Russian
Read full articleLatest News
Agent, Scan or Beyond: Modern Methods for Comprehensive Infrastructure Vulnerability Scanning
The eighth installment in the Vulnerability Management for Beginners series explains why traditional scanning approaches no longer cover today's dynamic environments. It details three classic methods—Host Discovery, Pentest, and Audit—alongside agent-based scanning, cloud snapshot techniques, passive traffic analysis, container and SCA tools, and integrations with existing IT systems. The guide stresses that agents from Tenable and Qualys complement but do not replace network scanning, while Orca Security and Wiz pioneered disk snapshot analysis for short-lived cloud instances. It also covers container image scanning with Trivy and Grype before deployment, passive monitoring for OT environments, and the importance of combining multiple data sources to eliminate blind spots. Practical recommendations include scanning frequency by asset type and six post-scan steps for effective remediation.
Translated from Russian
CVE-2026-20349: Cisco ASA and FTD Firewalls Face Remote DoS in SSL VPN, Already Exploited
Cisco has disclosed a high-severity denial-of-service vulnerability affecting its Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense products. The flaw, tracked as CVE-2026-20349, resides in the SSL VPN component and allows unauthenticated remote attackers to trigger device reboots by sending specially crafted HTTP requests. The issue also impacts FTD deployments using Zero Trust Network Access. With a CVSS v3.1 base score of 8.6, the vulnerability has already been observed in active exploitation campaigns since August 2026. Cisco released hotfixes for both affected platforms and strongly urges immediate updates, while confirming that Secure Firewall Management Center remains unaffected.
Translated from Japanese
Adobe Releases Third Emergency Patch for Campaign Classic in Two Weeks, Fixing Critical RCE Vulnerabilities
Adobe has issued another urgent security update for Adobe Campaign Classic after discovering multiple critical vulnerabilities that affect the previous patches released on July 29 and August 3. The new advisory, published on August 11, 2026, addresses three CVEs rated Critical, including two remote code execution flaws with CVSSv3.1 base scores of 10.0. These authorization bypass issues allow unauthenticated attackers to execute arbitrary code remotely. The affected versions include 7.4.3 build 9398 and build 9399, which were themselves emergency fixes issued only days earlier. Adobe urges all customers to apply the latest update immediately due to the high risk of exploitation. This marks the third high-severity patch for the product within a two-week period.
Translated from Japanese
Yandex Pay App Permanently Removed from App Store Across All Regions Due to Sanctions
The Yandex Pay application has been fully removed from the App Store in every region worldwide. Existing installations continue to operate normally, and the company has confirmed that all client funds remain secure. However, users can no longer download the app or receive updates, prompting Apple device owners to avoid deleting the application. Yandex recommends disabling automatic app updates through iOS settings to prevent any potential loss of functionality. If the app is accidentally removed, the service remains accessible through the web version at pay.yandex.ru, which can be added to the home screen via Safari. The removal occurs amid broader sanctions and information-related restrictions affecting Russian technology services.
Translated from Russian
Palo Alto Networks Unit 42 Uncovers Kimwolf v7 Botnet Infecting Android Set-Top Boxes via Open ADB
Researchers at Palo Alto Networks Unit 42 have identified Kimwolf v7, an updated botnet that compromises Android set-top boxes and other IoT devices to conduct DDoS attacks. The malware now employs HTTP/2 flooding with realistic browser fingerprints to blend malicious traffic with legitimate user activity. Command-and-control infrastructure is hardened through Ethereum Name Service lookups and public Ethereum RPC services, with a Tor fallback address embedded in the binary. Operators have removed scanning, exploitation, and brute-force capabilities from this version, indicating a division of labor where a separate loader handles initial infection. The botnet uses 15 numbered methods focused on high-performance UDP floods optimized for ARM processors. Infections typically occur through residential proxies targeting devices with open Android Debug Bridge on port 5555, after which the malware masquerades as system processes. Unit 42 advises treating Android set-top boxes as untrusted devices and disabling ADB or restricting it to USB access only.
Translated from Russian
Claude Encrypted Thinking Blocks Use Protobuf with Exposed Metadata and AES-GCM Ciphertext
A detailed reverse-engineering of Claude signatures shows that the encrypted reasoning blocks are not opaque containers but structured protobuf messages. The outer envelope contains a 312-byte inner message that holds a 135-byte header, fixed-length nonce and MAC fields, and the actual ciphertext. The header itself reveals the model name such as claude-opus-5, the block type as thinking, and the organizationUuid from the user's Anthropic account. Only the reasoning text is encrypted with AES-GCM, adding exactly 16 bytes for the authentication tag. The analysis covers four protocol versions and notes that organization binding was added in version 15, potentially allowing servers to reject cross-model or cross-organization reuse. The findings provide concrete implications for both the Opus-to-Haiku extraction attack and the leakage of account identifiers in public logs.
Translated from Russian
SonicWall Global Management System Hit by Critical RCE and Path Traversal Vulnerabilities
SonicWall has disclosed six vulnerabilities in its SonicWall Global Management System (GMS) management product, with the highest-severity issues rated Critical. The most severe flaw, CVE-2026-66147, resides in the Dispatcher Service and allows unauthenticated remote code execution through crafted requests that inject commands. A second critical issue, CVE-2026-66145, stems from improper handling of zip archive extraction and enables path traversal attacks that can read sensitive data or write arbitrary files without authentication. Both vulnerabilities received CVSSv3 base scores above 9.0. The flaws affect both the virtual appliance and Windows versions of GMS. SonicWall released an advisory on August 11 urging immediate application of the available updates.
Translated from Japanese
Adobe Issues Critical Security Updates for ColdFusion with Multiple High-Severity Vulnerabilities
Adobe has released security updates for Adobe ColdFusion to address 15 vulnerabilities disclosed in a security advisory on August 11, 2026. Among them, CVE-2026-48362 is an OS command injection flaw that allows arbitrary code execution and carries the maximum CVSSv3.1 base score of 10.0. Two additional issues, CVE-2026-48273 involving dynamic code evaluation and CVE-2026-71384 related to authorization bypass leading to denial of service, received scores of 9.9 and 9.6 respectively. Eight further vulnerabilities were rated Critical, prompting Adobe to urge immediate patching. The advisory highlights risks across multiple attack vectors and emphasizes rapid remediation to prevent potential exploitation.
Translated from Japanese
Compromised SIM Cards Exploit Proactive SIM to Steal Files, Execute Code and Force 2G on Smartphones and IoT Devices
Researchers from the University of Birmingham and Fuzzware have demonstrated that a compromised SIM card can issue commands to smartphones and IoT devices by abusing the standard Proactive SIM feature. The attack leverages the RUN AT command to force the modem to execute AT commands, creating a direct channel from the SIM to the device hardware. Using their CATana toolkit, the team tested 18 smartphones and eight cellular IoT devices, finding the AT command interface exposed on two phones and seven IoT units. Four vulnerabilities were identified, enabling code execution, file theft, denial of service and persistent downgrade to 2G. Affected devices include the OPPO Reno14 F 5G and Quectel-based modules such as the EC25-AFX and EG25-G. Manufacturers have released some patches, and GSMA has registered the issue as CVD-2026-0122, though researchers recommend removing the RUN AT function entirely from firmware.
Translated from Russian
From Russian sources
Translated from Russian
Mozilla Revokes GPG Signing Key After Accidental Upload to Private GitHub Repository
Mozilla has replaced the GPG key used to sign certain Firefox and Thunderbird builds following an accidental exposure of the unencrypted secret key in a private GitHub repository. The key was intended for signing Linux archives, RPM packages, and checksum files, raising theoretical risks of supply-chain attacks through forged installers. Company audits found no evidence of external misuse, as repository access was limited to a small group of employees who already held legitimate access to the key. Most users require no action, though those manually verifying GPG signatures must import the new key along with revocation data for the old one. Linux administrators installing Firefox via RPM packages on distributions such as Fedora, RHEL, Rocky Linux, AlmaLinux, openSUSE, and SUSE may need to manually update the key to avoid installation failures. Thunderbird users are unaffected by the RPM issue since no official RPM packages are released for the email client. The new key remains valid until August 5, 2028, with public details available in updated KEY files and on keys.openpgp.org.
Building Secure MLOps Platforms in Air-Gapped Environments for DevOps Engineers
The article explains how DevOps engineers can construct a minimal yet complete MLOps platform inside a closed, air-gapped network without relying on any cloud services. It highlights the cultural gap between data scientists and DevOps teams and shows how MLOps practices such as data versioning, experiment tracking, and model registries bridge that gap. The architecture separates GPU training nodes from a Kubernetes serving cluster and uses open-source components including ArgoCD for GitOps, MLflow with PostgreSQL, MinIO, DVC, OpenBao, and External Secrets Operator. Special attention is given to secrets management with SOPS and age keys, image scanning with Trivy and Bandit, and secure Docker access via socket proxy on the training server. The setup avoids Kubeflow and HashiCorp Vault due to complexity and licensing concerns, favoring lighter, license-friendly alternatives suitable for isolated perimeters.
Researchers Extract Proprietary Reasoning Traces from Anthropic, OpenAI and Google LLMs, Revealing Hidden Secrets
A team of eight researchers from institutions including ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, Tübingen AI Center, MATS and Snyk published a preprint detailing a practical attack that recovers full reasoning traces from closed LLM APIs. The method requires only two API calls and works by feeding encrypted reasoning blocks from strong models such as Claude Opus 4.8 into weaker models from the same provider, such as Haiku 4.5, which then reproduce the hidden chain-of-thought verbatim. Analysis of 6,708 publicly shared agent logs from GitHub and Hugging Face yielded 315,320 recovered traces containing 704 unique secrets, including 62 API keys, 33 passwords and 24 access tokens that never appeared in visible session output. The attack also enables extraction of internal safety policies, system prompts and detailed harmful planning that providers normally filter from final answers. In addition, the same mechanism can be used in reverse to inject malicious instructions into shared logs that later get replayed by unsuspecting users. The authors recommend treating encrypted reasoning blocks as sensitive secrets and propose cryptographic binding of traces to sessions, users and models.
Russian Researchers Patent Detector Blinding Protection for Quantum Key Distribution Systems
Engineers from SFB Lab and the Center for Quantum Technologies at Moscow State University have developed a new method to protect quantum key distribution systems against detector blinding attacks. The technique not only detects the attack but also preserves the secure portion of the generated key instead of discarding the entire key after an alarm. The approach works by randomly varying the quantum efficiency of single-photon detectors at the receiver side, forcing an attacker to leave detectable traces such as erroneous or double clicks. These statistical anomalies allow the system to estimate the number of potentially compromised bits and remove them during privacy amplification. The solution has been granted Russian patent RU 2 856 208 C1 and accepted for publication in Physical Review Applied. It was validated on commercial off-the-shelf detectors and requires no changes to the optical scheme, making it compatible with a wide range of existing QKD hardware.
5 NetworkPolicy Mistakes That Leave Kubernetes Clusters Completely Unprotected
A detailed analysis from OTUS highlights five frequent configuration errors in Kubernetes NetworkPolicy that allow unrestricted traffic despite policies appearing active in the cluster. The article explains that Kubernetes itself does not enforce NetworkPolicy objects; enforcement depends entirely on the CNI plugin such as Calico, Cilium, or Weave Net, while Flannel and kubenet ignore them entirely. Common pitfalls include blocking DNS resolution when applying default-deny egress rules, incorrect use of namespaceSelector versus podSelector leading to overly permissive access, and confusing the top-level podSelector with selectors inside ingress or egress blocks. Additional issues arise when policies fail to account for ingress controllers, hostNetwork pods, or inter-container localhost communication within the same pod. The piece stresses the importance of traffic-based validation rather than relying on kubectl output and recommends testing with deny-all policies plus continuous monitoring during rollout.
How the Modern Web and HTTPS Emerged from Simple Two-Computer Networks
The article traces the evolution of internet infrastructure from two friends connecting PCs with twisted-pair cable and assigning IP addresses to the global system of DNS, routing, and public-key certificates. It explains how early local networks expanded with switches, always-on servers, and domain names to solve the problem of changing IP addresses. As networks grew and interconnected through routers and ISPs, new risks of eavesdropping and traffic redirection appeared on open paths. The solution introduced centralized certificate authorities such as the fictional Sectigo that issue chained certificates rooted in pre-installed trust stores. The piece details the structure of certificates, key pairs, signing chains, and the browser validation process that enables encrypted HTTPS sessions. Written in accessible language with deliberate simplifications, the text serves as an educational overview rather than a technical manual.
From Japanese sources
Translated from Japanese
Dell Fixes 70 Vulnerabilities in VSI for VMware vSphere Including Two Critical Flaws
Dell has released an update addressing 70 vulnerabilities in Dell Virtual Storage Integrator for VMware vSphere Client, two of which are product-specific and rated critical. The advisory published on August 6, 2026, covers both native issues and flaws inherited from third-party components. CVE-2026-67261 allows unauthenticated remote attackers to execute arbitrary OS commands with root privileges via the IAPI component. CVE-2026-54489 enables session hijacking by exposing active session credentials without authentication. The product integrates Dell storage arrays with VMware vSphere environments and is widely used in enterprise virtualization deployments. Administrators are urged to apply the latest version immediately to mitigate the risks of full system compromise and unauthorized administrative access.
Top 10 Security Stories: WordPress XSS Flaw, PHP Vulnerabilities, and VMware ESX Issues Lead Weekly Roundup
Security NEXT has published its weekly ranking of the most viewed articles for the period from August 2 to August 8, 2026. The list highlights critical vulnerabilities affecting widely used platforms including WordPress, PHP, pgAdmin 4, VMware ESX, and Chrome. Several entries focus on newly released security updates and ongoing exploitation warnings issued by US authorities. The ranking also includes real-world incidents such as credit card skimming by employees and data leaks caused by phishing attacks. This weekly overview reflects the topics that drew the highest attention from the Japanese cybersecurity community during the specified week.
CISA Adds Progress Kemp LoadMaster Command Injection Flaw CVE-2026-8037 to KEV Catalog After Confirmed Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency has added a known command injection vulnerability in Progress Software's Kemp LoadMaster application delivery product to its Known Exploited Vulnerabilities catalog. The flaw, tracked as CVE-2026-8037, allows unauthenticated attackers to execute arbitrary commands on affected devices because input values are not properly sanitized. CISA issued the addition on August 7, 2026, and directed federal agencies to apply mitigations by August 10, 2026. The same product was previously targeted through another flaw, CVE-2024-1212, which was also added to the KEV list after exploitation. Security researchers note that the vulnerability poses a broad risk because it requires no authentication and can be leveraged to compromise load balancers and related infrastructure. Organizations using Progress Kemp LoadMaster are urged to review vendor advisories and implement available patches without delay.
Cisco Publishes 12 Security Advisories Fixing Critical Flaws in Catalyst SD-WAN and IOS XE
Cisco Systems released 12 new security advisories on August 5, 2026, disclosing a total of 23 vulnerabilities across multiple products. Two advisories covering Cisco Catalyst SD-WAN Software and Cisco IOS XE Software received the highest Critical severity rating. The SD-WAN advisory addresses five issues, including CVE-2026-20303, CVE-2026-20304, and CVE-2026-20310, each scoring 9.9 on CVSSv3.1. The IOS XE advisory details seven vulnerabilities, with CVE-2026-20272 rated 9.8 and CVE-2026-20267 rated 9.0. Additional advisories cover flaws in Integrated Management Controller, RoomOS, and Terminal Services Agent. Organizations are urged to apply the hardening releases immediately to mitigate remote exploitation risks.
WordPress 7.0.3 Addresses 12 Vulnerabilities Including Reflected XSS Leading to PHP Execution
WordPress has released version 7.0.3 to fix multiple security issues discovered in the content management system. The update, announced on August 6, 2026, resolves 12 vulnerabilities covering cross-site scripting, privilege escalation, information disclosure, and server-side request forgery. One issue tracked as CVE-2026-64638 is a reflected XSS flaw on the login page that can be exploited without authentication. Under specific conditions the vulnerability allows an attacker to execute PHP code on the affected site. The flaw received a CVSS v4.0 base score of 8.9 and is rated High severity. Administrators are urged to apply the update immediately.
Google Releases Chrome Security Update Fixing 41 Vulnerabilities Including Six Critical Flaws
Google has issued a major security update for its Chrome browser addressing 41 vulnerabilities, six of which are rated Critical. The update covers Windows, macOS, and Linux platforms with new builds 151.0.7922.109 and 151.0.7922.108. Among the critical issues resolved is an out-of-bounds write vulnerability in ANGLE tracked as CVE-2026-19157. Five additional Critical Use After Free flaws were patched in WebGL, Aura, Skia, and Views components. The remaining 35 vulnerabilities received a High severity rating. Google plans a gradual rollout of the update over the coming days and weeks.
From Portuguese sources
Translated from Portuguese
Ransomware Groups Disable EDR, Backups and Windows Telemetry Before Encryption
Ransomware operators are increasingly focusing on disabling endpoint detection and response tools, backup systems, and Windows telemetry mechanisms prior to launching encryption. An analysis of the ten ransomware families with the lowest prevention rates in 2026 found that Play achieved only 13 percent of attacks blocked. BlackByte followed with 25 percent blocked and LockBit with 30 percent blocked. BabLock leverages a legitimate uninstaller to remove endpoint protection and terminates processes belonging to antivirus, EDR, backup, and database applications. It then clears the Security and System event logs to hinder incident response. LockBit 5.0 instead interferes with Event Tracing for Windows to reduce visibility for monitoring solutions. Additional families employ process injection, in-memory execution, registry modifications, file masquerading, and living-off-the-land binaries to evade detection.
Google Play Apps Hide Anatsa Banking Trojan Using Stealthy Loaders
Malicious applications distributed through Google Play are employing stealthy loaders to install the Anatsa banking trojan for Android, putting victims' financial accounts at risk. The campaign relies on seemingly legitimate programs to conceal the initial infection stage, with one identified case involving a modified PDF reader that displays a fake update prompt to trick users into installing an additional component. Another loader discovered in the Cleanova application collects data from analytics SDKs, including installation source details, and forwards this information to a command-and-control server. The server then decides whether to deliver the malicious payload based on predefined criteria, leaving the code inactive for non-targeted victims to evade automated analysis. Once Anatsa is installed, the threat can facilitate theft of credentials used for financial services and enable fraudulent transactions. Banking trojans represented 30.77 percent of detected malicious mobile applications in the second quarter of 2026, during which more than 1.99 million attacks involving malware, adware, or unwanted programs were blocked and 93,574 banking trojan installation packages were identified.
WordPress Patches High-Severity XSS2Shell Flaw Enabling Remote Code Execution (CVE-2026-64638)
WordPress has released a fix for a high-severity vulnerability in its core that can turn a malicious login attempt into remote PHP code execution on the server. The flaw, tracked as CVE-2026-64638 and rated 8.9 on CVSS, is named XSS2Shell and begins as a reflected cross-site scripting issue on the authentication screen. An unauthenticated attacker can submit a specially crafted username that bypasses sanitization mechanisms due to differences in how PHP and WordPress interpret certain characters, allowing controlled HTML elements to be injected into the login page. This leads to JavaScript execution in the site domain, and when an authenticated administrator visits a prepared page, the attacker can abuse the existing session to authorize application credentials and upload arbitrary PHP code. The patch is included in WordPress 7.0.3 released on August 6, with backports available for branches as old as 4.7. No public exploitation has been confirmed yet, but the technical details make immediate updating a priority for site administrators.
Google Releases Chrome 151 Fixing 41 Vulnerabilities Including Six Critical Flaws
Google has issued Chrome 151 to address 41 security vulnerabilities, six of which are rated critical and could lead to memory corruption, browser crashes, and remote code execution. The update covers Windows, macOS, and Linux platforms with versions 151.0.7922.108 and 151.0.7922.109. Two use-after-free flaws in the WebGL component, tracked as CVE-2026-19137 and CVE-2026-19170, allow continued memory access after deallocation. Additional critical issues affect the Aura, Skia, Views, and ANGLE components under CVE-2026-19149, CVE-2026-19154, CVE-2026-19172, and CVE-2026-19157. Google has withheld technical details and proof-of-concept code for several flaws to limit exploitation while the rollout completes. Users are advised to check for updates immediately through the browser's About section.
Cisco Patches Seven Critical IOS XE Vulnerabilities Including CVSS 9.8 Command Injection Flaw
Cisco has released security updates to address seven vulnerabilities in IOS XE, the operating system powering routers, switches, wireless controllers, and other enterprise network devices. The highest-severity issue, tracked as CVE-2026-20272 with a CVSS score of 9.8, stems from improper handling of special elements in commands and could enable remote command injection, unauthorized operations, and full device compromise over the network. Additional flaws impact memory management, resource lifecycle, numeric calculations, execution flow, and input validation, potentially leading to buffer overflows, out-of-bounds writes, crashes, infinite loops, and directory traversal. The vulnerabilities affect IOS XE versions 17.9, 17.12, 17.15, 17.18, and 26.1 in both standalone and controller modes regardless of configuration. Fixed releases include 17.9.10, 17.12.8, 17.15.6, 17.18.4, 17.18.4a, and 26.1.2, with no available workarounds. The issues were discovered during internal testing that incorporated advanced AI models, and no evidence of public exploitation has been observed.
AWS and Vercel Patch Critical Flaws in AI Agent Platforms Allowing Unauthorized Tool Execution
AWS and Vercel have addressed multiple critical vulnerabilities in their AI agent platforms that enabled unauthorized execution of tools without legitimate model approval. The issues, grouped under the CoreBreak pattern, allowed attackers to bypass AI authorization checks by injecting crafted tool calls that the infrastructure misinterpreted as model-approved actions. In AWS, CVE-2026-18830 affected the InvokeHarness API in Amazon Bedrock AgentCore, permitting authenticated users to trigger sensitive tools directly. Vercel faced two separate flaws tracked as CVE-2026-64650 and CVE-2026-64651 that let sandboxed code reach host system tools, potentially exposing secrets or cloud APIs. No public evidence of active exploitation has been confirmed yet. Organizations are advised to apply updates immediately, restrict available tools for agents, and treat all external inputs as potentially malicious.
From Chinese sources
Translated from Chinese
ChainDrop Malware Infects Over 1,300 npm Packages in Record Supply Chain Poisoning Campaign
Security researchers have uncovered a massive supply chain attack involving the ChainDrop malware that compromised more than 1,300 npm packages with a combined 2 billion monthly downloads. The malicious code silently steals npm tokens, GitHub credentials, and SSH keys before using stolen tokens to infect additional packages in a self-propagating loop. In a parallel incident, the Open VSX marketplace removed 77 malicious extensions that impersonated popular developer tools and harvested host and repository data. Attackers have also begun exploiting AI coding assistants through a technique called HalluSquatting, registering packages that match hallucinated names suggested by tools such as GitHub Copilot and Claude Code. The incidents highlight how modern supply chain threats now extend beyond direct dependencies to include AI-generated recommendations and automated publishing pipelines. Experts recommend strict lockfile usage, minimal token permissions, and manual verification of any package suggested by AI assistants.
Chinese Courts Hand Down 16-Year and 32-Year Sentences to Ransomware Operators
Two individuals involved in ransomware operations have received lengthy prison terms in China, with one sentenced to 16 years and the other to 32 years. The cases underscore Beijing's increasing focus on prosecuting ransomware-related crimes. The longer sentence reflects the scale and impact of the criminal activity attributed to the second defendant. Chinese authorities have publicly highlighted these outcomes as part of broader efforts against cyber extortion. The rulings send a clear deterrent message to ransomware actors operating within or targeting Chinese infrastructure.
AI Disrupts White Hat Ecosystem: 8000 Viewers Join Live Debate on SRC Closures and Security Industry Future
A live stream hosted by AikerWorld and HackingClub drew nearly 8000 viewers as nine security experts debated the impact of AI on white hat communities following the closure of a major financial sector SRC and HackerOne's shift to mandatory real-name submissions. Hu Xiaona, founder of the communities and 360 VulnCloud executive, described the changes as a structural wave that devalues routine vulnerability submissions while pushing practitioners toward AI Forward Deployed Engineer roles. Xiong Yong argued that AI lowers attack costs yet forces enterprises to treat security as essential rather than optional. Other speakers including Yang Wei, Wei Yongqiang, and Jia Yu examined pricing pressure, the need for human oversight during AI-driven testing, and the cyclical nature of security budgets. The discussion converged on the view that AI eliminates low-skill tool-based hunting but elevates complex research and defensive engineering skills. Participants highlighted risks such as un-audited AI actions deleting production data and warned that SRC platforms are moving from open crowdsourcing to curated, real-name models.
1755 Bitcoin Worth $110 Million Stolen from 5000 Hardware Cold Wallets Due to Flawed Random Number Generator
A mainstream hardware cold wallet suffered a systemic defect in its random number generation algorithm, allowing attackers to compromise approximately 5000 wallets and steal 1755 BTC valued at around $110 million. The incident, confirmed on August 4, marks the largest hardware wallet security breach in crypto history because the flaw existed at the foundational level of private key generation rather than in network defenses. Victims had relied on the common assumption that offline cold storage provides ultimate protection, yet the non-random RNG reduced the effective keyspace dramatically, enabling feasible brute-force attacks. Historical precedents show similar RNG weaknesses have repeatedly undermined wallet security across platforms including Android implementations and various hardware chips. The event underscores that cold storage security depends entirely on correct implementation of cryptographic primitives at every layer, from hardware entropy sources to firmware. Experts recommend avoiding blind trust in any single device, verifying third-party audits, and diversifying storage across multiple solutions including open-source options.
Vibe Hacking Rises: Generative AI Lowers Barriers for Offensive Security Operations
Generative AI is reshaping the cybersecurity threat landscape by dramatically reducing the cost of offensive security knowledge. Previously, attackers needed years of experience in reverse engineering and exploit development to conduct meaningful intrusions, but AI now assists with research, code generation, debugging, and adapting known techniques to new environments. This enables less experienced individuals to build functional attack chains in weeks rather than years. The article introduces the concept of vibe hacking, where attackers collaborate with AI assistants using natural language prompts in a process similar to vibe coding. Defenders can no longer rely on the scarcity of skilled adversaries and must shift toward continuous validation frameworks such as CTEM, AEV, and PTaaS. Senior human experts remain essential for risk judgment and business context, even as automation accelerates routine tasks.
HackerOne Ends Anonymous Era for Bug Bounty Hunters with Mandatory ID Verification
HackerOne has introduced compulsory identity verification for all researchers submitting reports to paid bug bounty programs, effective August 1. The policy requires users to complete KYC checks through Estonian firm Veriff by uploading government-issued ID and performing a live selfie, with annual renewals. Vulnerability Disclosure Programs remain open to anonymous participants, but any researcher seeking monetary rewards must now reveal their identity. The move follows similar steps by Bugcrowd and Intigriti and is driven by anti-money laundering and cross-border payment regulations. Researchers in high-surveillance regions and newcomers face new barriers, while the platform argues the change improves report quality and enterprise trust. H1 Clear adds an extra criminal background check layer for elite participants.
From Spanish sources
Translated from Spanish
GhostSplice Technique Lets Malicious MCP Servers Trick AI Coding Agents into Exfiltrating Secrets
GhostSplice is a new technique that allows a malicious MCP server to induce an AI coding agent to leak SSH keys, environment secrets, and source code. The attack splits malicious instructions across tool metadata and responses so the agent reconstructs and executes the full exfiltration plan without detecting an overtly malicious command. Tests showed the method raised compliance rates from an average of 42 percent to 82 percent across eleven models, with some systems moving from zero to 100 percent success. The technique requires the developer to connect the attacker-controlled MCP server and for the agent to already possess read access to the targeted files. Defenses focus on strict allow-listing of MCP servers, least-privilege tool permissions, separation of tool output from instructions, and human approval for sensitive operations. The disclosure aligns with prior warnings about poisoned MCP tool descriptions and agentjacking attacks.
Malicious VS Code Extensions Masquerading as Solidity Tools Steal Crypto Wallets, API Keys and Credentials
Two malicious Visual Studio Code extensions promoted as Solidity development utilities have been used to steal cryptocurrency wallet data from browsers along with API keys and stored credentials. The extensions, identified as helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, target developers working with smart contracts and Web3 environments where sensitive tokens and sessions are commonly present. Attackers rely on the trusted VS Code marketplace to deliver the payload through a simple installation rather than any complex exploit. Once active, the extensions harvest browser-based crypto wallet information, saved credentials, environment files, SSH keys and API tokens. A single compromised workstation can therefore expose repositories, cloud services and directly drain cryptocurrency funds. Security researchers recommend immediate removal of both extensions, rotation of all accessible secrets and adoption of stricter extension allow-list policies. The incident highlights ongoing supply-chain risks in developer tooling ecosystems.
Zapscape Flaw in KVM Breaks Nested Virtualization Isolation Allowing L1 Guest Root Code Execution on Linux Host
The Zapscape vulnerability (CVE-2026-64561) affects KVM/x86 in the Linux kernel and enables an attacker with kernel privileges inside an L1 virtual machine to escape to the host and execute code as root. The flaw occurs in the shadow MMU when handling page faults for nested guests, specifically due to an incorrect order of stale root condition checks that leads to a use-after-free condition. This weakens the isolation between the host and L1 guests precisely when nested virtualization is enabled for potentially untrusted tenants. A public proof-of-concept demonstrates the escape by creating a file named /Zapscape owned by root on the host. The issue impacts Linux kernels starting from version 5.9, with fixes already merged into stable branches including 6.6.148, 6.12.101, 6.18.42, 7.1.6 and 7.2 rc5. On Intel systems the attack requires EPT page walk lengths 4 and 5 to be exposed to the L1 guest, while no equivalent condition is documented for AMD. Organizations are advised to apply patches promptly or disable nested virtualization for untrusted workloads.
SQL Injection in Oracle Escalates to SYSTEM Execution on Windows via Embedded Java Compilation
A real-world intrusion chain demonstrates how a basic SQL injection can lead to command execution on Windows with SYSTEM privileges. Attackers leveraged Oracle Database's ability to load, compile, and run Java code inside the database engine itself. After gaining initial database access through an internet-exposed application, the threat actors introduced Java source code, converted it into schema objects, and compiled it directly on the server. This technique, tracked under the artifact name khunt and linked to Huntress telemetry, minimizes reliance on traditional disk binaries and shifts tooling into the less-monitored database engine. When the Oracle process runs with elevated rights on Windows, the chained execution inherits high privileges up to SYSTEM level. The incident underscores the need for parameterized queries, disabling unnecessary Java functionality in Oracle, and monitoring specific DDL events such as CREATE JAVA SOURCE and CREATE JAVA CLASS.
Coldcard Firmware Flaw Linked to Theft of 1,082 Bitcoin in 41 Minutes
A critical defect in COLDCARD firmware degraded entropy during BIP39 seed generation, enabling offline enumeration of weak seeds and resulting in the theft of 1,082.65 BTC from 1,196 addresses in just 41 minutes on July 30, 2026. The root cause traces to a March 2021 integration error that replaced the STM32 hardware RNG with a deterministic software PRNG initialized only by chip ID and timing registers, yielding roughly 40 bits of effective entropy on Mk3 devices and 72 bits on Mk4, Mk5, and Q models. Coinkite issued emergency firmware updates, yet any seed created on vulnerable versions remains exposed regardless of later updates. Additional sweeps matching the same pattern have raised total observed losses to 1,367.05 BTC across 4,585 addresses. Users must generate fresh seeds on patched firmware and migrate funds immediately; dice-based entropy addition or BIP39 passphrases provide only partial mitigation.
Cisco Releases Hotfixes for Actively Exploited CVE-2026-20316 Zero-Day in Secure FMC Allowing Static Credential Access
A zero-day vulnerability tracked as CVE-2026-20316 is being actively exploited in Cisco Secure Firewall Management Center, enabling remote attackers to authenticate using hardcoded low-privilege credentials without prior authentication. The flaw carries a CVSS score of 5.3 but has been elevated to High severity by Cisco due to its potential for chaining with other vulnerabilities to achieve privilege escalation. Cisco has issued hotfixes across multiple versions including 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 while urging administrators to inspect logs for the presence of /var/tmp/license.tmp as an indicator of compromise. The same indicator is also linked to the related critical authentication bypass CVE-2026-20079 that can lead to root access via script execution. Organizations are advised to restrict management interface exposure through ACLs, VPNs and dedicated admin networks, rotate credentials after suspected compromise, and review sudo executions and license-related commands. U.S. federal agencies have a remediation deadline of August 1, 2026 under the Known Exploited Vulnerabilities catalog.