AI Safety Guidelines: 10 Essential Rules to Protect Data, Finances, and Reputation When Working with LLMs
A detailed analysis of emerging AI-related security risks highlights how large language models can autonomously execute attack chains, fall victim to prompt injection, and cause cascading errors in complex workflows. The article examines real-world incidents such as the Anthropic vending machine pricing failure, the Meta Instagram account takeover via overly helpful AI support, and Copilot Studio data leaks through prompt injection. It emphasizes that while attack methods themselves are not revolutionary, AI agents can now scale them at machine speed with autonomous decision-making and recovery capabilities. The piece provides ten concrete safety rules covering financial controls, fact verification, data confidentiality, context pollution prevention, and access limitation. It also stresses that ultimate responsibility always remains with the human operator, not the AI system.
Translated from Russian
Read full articleLatest News
Cat Tunnels Service Deploys Kotator-Rotator to Counter Mass Blocking of Relay Nodes in Russia
The operators of the decentralized Cat Tunnels service faced a sudden wave of blocks that disabled all several dozen of their tracker nodes inside Russia. Without these anchor relays, new user connections slowed dramatically and existing sessions degraded. The team responded by building Kotator-Rotator, an automated system that continuously evaluates node reachability from the client side and replaces failing relays with fresh instances. The decision engine relies on Grohotator, an aggregated availability metric derived from client technical logs that also triggers an audible alarm when thresholds are crossed. Analysis of the logs revealed that blocking activity follows a clear weekday pattern, pausing on Friday evenings and resuming Monday mornings. The experience demonstrated that server-side health checks alone are insufficient when censors interfere with paths between clients and relays.
Translated from Russian
Can the Moon Be DDoSed? Exploring Future Cybersecurity Challenges for Lunar Bases
A speculative analysis examines whether DDoS attacks could target a lunar base in 2036, highlighting how Earth-based internet protocols would fail over the 384,000 km distance. The piece details NASA’s LunaNet architecture and Delay/Disruption Tolerant Networking (DTN) that uses store-and-forward mechanisms to handle long delays and link disruptions. It explains why traditional volumetric attacks would be limited by narrow space communication channels while resource-exhaustion attacks on orbital relays and DTN nodes could prove more effective. The analysis contrasts Earth’s redundant routing with the Moon’s few irreplaceable links and emphasizes that attacking ground control centers might be more practical than flooding lunar hardware. It concludes that any real lunar network will inherit familiar terrestrial bottlenecks despite its exotic setting.
Translated from Russian
Oracle Releases August 2026 Monthly Security Patches Fixing 943 Vulnerabilities
Oracle has published its monthly Critical Security Patch Update on August 18, 2026, addressing a total of 943 vulnerabilities across a wide range of products. This release supplements the company's quarterly Critical Patch Update and includes fixes for third-party software issues, resulting in 925 unique CVEs after removing duplicates. Of these, 710 vulnerabilities received CVSSv3 base scores of 7.0 or higher, with 154 scoring 9.0 or above, including three at the maximum 10.0. A total of 467 flaws can be exploited remotely without authentication. Major products affected include Oracle Fusion Middleware with 262 patches, Oracle E-Business Suite with 120 fixes, and Oracle Database Server with six updates. The next monthly update is scheduled for September 15, 2026, followed by the quarterly release on October 20.
Translated from Japanese
Hacktivist Group Cyberleek Leaks Alleged GTA VI Gameplay and Map Details in Protest Against Digital-Only Releases
A hacktivist collective calling itself Cyberleek has released two purported gameplay clips from GTA VI along with images that may depict the full map of Leonida state. The group claims the leak is a protest against Rockstar's decision to sell physical editions that contain only a download code rather than an actual disc. Cyberleek is also demanding an end to digital pre-orders, the practice of selling built-in content as DLC, and mandatory online connectivity for single-player modes. Rockstar and parent company Take-Two have already filed DMCA takedown requests, which some observers view as indirect confirmation of the material's authenticity. The footage reportedly shows basketball mechanics, vehicle customization, trunk-opening animations, a stamina meter, and an honor system reminiscent of Red Dead Redemption 2. The alleged map includes five counties, an extensive rail network, and numerous small islands. At the same time, Cyberleek is promoting a Solana-based token and soliciting donations, prompting several outlets to question whether the operation is partly a cryptocurrency marketing scheme.
Translated from Russian
PoC Exploit Released for Android CVE-2026-0075 Allowing Contact Theft Without READ_CONTACTS Permission
A researcher has published a proof-of-concept exploit for CVE-2026-0075 affecting Android 14, 15, 16 and 16 QPR2. The flaw resided in the ContactsProvider2 component and enabled local applications to extract contact database entries through SQL injection and verbose SQLite error responses, bypassing the need for any user-granted permissions. Google rated the issue high severity and addressed it in the June 2026 security bulletin by stripping detailed JSON error information from responses to unprivileged apps. The publicly available PoC on GitHub deliberately avoids requesting READ_CONTACTS or WRITE_CONTACTS and is intended strictly for lab comparison of patched versus vulnerable builds. No confirmed in-the-wild exploitation has been observed yet, but the release of working code increases risk for devices running older firmware. Users are advised to verify that their devices have received the security patch dated 5 June 2026 or later.
Translated from Russian
Separating Identity and Delivery Channels for Compliant Telegram Mini App Authentication
A developer shared a detailed case study on building legally compliant user identification for Telegram Mini Apps targeting Russian audiences. Instead of relying solely on Telegram initData verification, the project routes authentication through established Russian providers including VK ID, Yandex ID and MAX. Identity is handled separately from message delivery channels, with telegram_id used only for notifications after account creation. The implementation employs OAuth 2.1 with PKCE for VK, OAuth 2.0 for Yandex, and deep links for MAX while enforcing short-lived cryptographic state values and HttpOnly session cookies. Additional measures include consent checkboxes required by Russian law and polling-based result delivery to support browser, WebView and extension environments. The same architecture was reused for Home Assistant smart-home login, demonstrating reusable separation of identity and channel concerns.
Translated from Russian
FSTEC Publishes 35-Point Network Perimeter Recommendations, Most Require No Spending
Russia's FSTEC released non-binding recommendations on protecting network perimeters on March 10, 2026, analyzing real-world intrusion vectors from external networks. The 35-point checklist spans eight sections covering device administration, DDoS resilience, segmentation, configuration backups, vulnerability management, authentication, logging, and incident response exercises. Only four items explicitly require purchasing new tools such as WAF, ZTNA, NAC, and SIEM, while five others depend on existing infrastructure. Twenty-six points can be addressed through policy, inventory, and configuration changes alone, including enforcing unique passwords, disabling legacy protocols like HTTP and SNMP v1/v2, and quarterly backup restoration tests. The document references Order 117 and earlier FSTEC methodologies on vulnerability handling, serving as a practical self-assessment questionnaire rather than a mandatory regulation. Analysts note that many organizations still fail to implement low-cost measures such as excluding remote administration interfaces from DMZ zones and verifying backup recoverability.
Translated from Russian
Critical Authentication Bypass and Buffer Overflow Flaws Patched in NetScaler ADC and Gateway
Cloud Software Group disclosed two critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway products. CVE-2026-19490 permits authentication bypass via an alternate path when the appliances operate as SSL VPN, ICA proxy, CVPN, or RDP proxy gateways, or when configured as authentication, authorization, and auditing virtual servers. CVE-2026-19489 is a buffer overflow in LSN groups with SIP ALG enabled that can lead to unexpected behavior or denial of service. Both issues received CVSS v4.0 base scores of 9.3 and 8.8 respectively. Fixed builds 14.1-73.32 and 13.1-63.21 are now available along with corresponding FIPS and NDcPP updates.
Translated from Japanese
Google Chrome Tests Visible Global Privacy Control Toggle in Canary
Google is testing a new visible toggle for Global Privacy Control in Chrome Canary that lets users send a standardized request asking websites not to sell or share their personal data and not to use it for targeted advertising. When enabled, the browser adds the Sec-GPC: 1 header to web requests and exposes the setting via navigator.globalPrivacyControl. In regions with supporting laws such as California's CCPA, the signal can serve as a formal opt-out from data sales. The feature currently appears primarily on Android, with experimental flags available on Windows, macOS, Linux, and ChromeOS, though the desktop interface remains incomplete. Two separate flags are required—one to show the toggle and another to actually transmit the signal—because enabling only the UI does not send Sec-GPC: 1. The mechanism is not a guaranteed enforcement tool; websites decide how to respond, and effectiveness depends on legal frameworks and site compliance. The feature is absent from the stable Chrome release and may still change before wider rollout.
Translated from Russian
From Russian sources
Translated from Russian
Microsoft Releases Fix for Windows Defender Crashes During Quick and Full Scans
Microsoft has issued a security intelligence update to resolve a crash in Windows Defender that occurred during quick or full system scans on affected Windows 10 and Windows 11 devices. The bug, introduced after a recent set of patches, caused the antivirus service to terminate unexpectedly with the message "Threat service has stopped. Restart it" and access violation error 0xc0000005. Some users misinterpreted the repeated failures as malware infection or severe system damage, leading them to reinstall Windows entirely. Administrators were able to reproduce the issue consistently across multiple machines simply by initiating a quick scan, confirming the root cause lay in Defender itself rather than individual endpoints. The fix is included in security intelligence version 1.457.236.0 and all subsequent releases, with Microsoft advising users to ensure automatic updates are applied via Windows Update or manually through the Windows Security interface.
Server Log Analysis Reveals How Major AI Crawlers Actually Behave on Websites
A detailed examination of server access logs shows that AI vendors operate multiple distinct bots with separate purposes rather than a single crawler. GPTBot performs scheduled training data collection while OAI-SearchBot builds search indexes and ChatGPT-User fetches pages in direct response to user queries. The same pattern appears with PerplexityBot and Perplexity-User at Perplexity as well as ClaudeBot and user agents at Anthropic. Blocking all AI-related user agents in robots.txt therefore prevents both training crawls and live user-driven visits. Analysis of 515 million AI bot events found only 408 requests for llms.txt, confirming the file sees negligible adoption. Verification of IP addresses against vendor-published ranges remains the reliable method for distinguishing genuine bots from spoofed traffic. Effective practices focus on clean HTML structure, fast response times, and selective robots.txt rules that allow user-agent traffic while restricting training crawlers.
YooMoney's YuScan Automates E-commerce Risk Assessment Scanning Up to 1,000 Sites Per Hour
YooMoney has detailed the inner workings of its YuScan service, an automated auditing tool designed to help banks and payment providers identify websites that conceal prohibited or high-risk activities. Since 2020 the system has processed more than 550,000 merchant applications without resulting in any fines for servicing illegal operations. YuScan builds comprehensive site maps, executes JavaScript, and handles dynamic content using Playwright combined with Camoufox to evade modern anti-bot protections such as Cloudflare. The crawler is built on Scrapy with FastAPI and PostgreSQL, then applies ML models, embeddings, and LLMs to analyze text, images, reviews, and external signals including Roskomnadzor registries and WHOIS data. The automation has reduced manual review time dramatically, allowing half of compliant merchants to begin accepting payments within 24 hours. YooKassa now offers the service to other banks through NSPK, the operator of the Mir payment system.
Nearly 70% of Companies Lack Control Over AI Agent Privileges, PAM Survey Finds
A recent survey conducted by AM Media among viewers and participants of the webinar 'How to Choose the Best PAM in 2026' shows that 68% of organizations fail to fully control privileges assigned to AI agents and automated services. Another 67% report insufficient oversight of API keys, tokens, and secrets, while 63% cite gaps in managing CI/CD and DevOps tool access. Traditional human administrator accounts are better protected at 34%, highlighting a shift in risk toward machine identities. Experts from NGR Softlab and Solar Group emphasize that service accounts often interact with multiple systems and require broad rights, making their compromise far more damaging than individual user breaches. JumpServer PAM CEO Denis Morozov noted that AI integration into PAM platforms could help map complex permission matrices and quantify risks for security teams. Participants also prioritized usability (72%) and ease of deployment (63%) when selecting PAM solutions over cost considerations.
OpenAI ChatGPT Computer History Feature on macOS Could Expose Detailed User Activity Logs to Infostealers
OpenAI has introduced the Computer History feature in its macOS ChatGPT app, which records application switches, clicks, keystrokes, and accessibility context to generate AI summaries and memories. The feature is disabled by default and requires explicit activation of Memories, with availability limited to Pro, Business, and Enterprise users outside the EEA, Switzerland, and the UK. While raw event files are deleted after 48 hours and not used for model training, the resulting Markdown memory files remain unencrypted on the local Mac. These files can be read by any process running under the same user account, creating a ready-made activity log for infostealers and other malware. OpenAI also warns about prompt injection risks where hidden instructions from websites or apps could influence ChatGPT or Codex behavior. Users retain controls to select participating apps, pause collection, or delete history, but the lack of encryption on stored memories raises significant privacy concerns.
AirTag and SmartTag: How to Detect If a Bluetooth Tracker Is Following You
Phones can now warn users when an unknown Bluetooth tracker such as an Apple AirTag or Samsung SmartTag is moving alongside them for an extended period. The alerts do not automatically confirm stalking, since the same tags can be left in taxis, rental cars or borrowed bags, yet they should never be ignored. AirTag and SmartTag rely on crowdsourced Bluetooth networks rather than built-in GPS or cellular connections, allowing them to report approximate locations only when nearby phones relay the signal. The article details differences from traditional GPS trackers, explains how to interpret notifications on iOS 17.5+ and Android 6.0+, and provides step-by-step guidance for locating hidden devices in clothing, vehicles or personal items. It also covers immediate safety actions, evidence preservation for police reports, and practical steps to reduce future tracking risks through account and permission hygiene.
From Japanese sources
Translated from Japanese
CISA Adds Four Exploited Vulnerabilities to KEV Catalog Including Critical macOS Authentication Bypass
The US Cybersecurity and Infrastructure Security Agency has added four newly exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. The flaws affect Apple macOS, Microsoft SharePoint, and VMware vCenter among other products. One of the vulnerabilities, tracked as CVE-2026-65400, allows network-based authentication bypass in macOS Screen Sharing without valid credentials. The issue received a CVSS v3.1 base score of 9.8 and is rated Critical. Apple addressed the flaw in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9 released on August 6. Federal agencies have been instructed to apply mitigations within three days.
Apple Releases macOS Tahoe 26.6.2 Fixing 28 Vulnerabilities Including Kernel Flaws
Apple has issued macOS Tahoe 26.6.2, addressing a total of 28 security vulnerabilities tracked under CVE identifiers. The update resolves three kernel-level issues, among them a Use After Free flaw tracked as CVE-2026-65343, an out-of-bounds memory read in CVE-2026-65349, and a memory corruption problem in CVE-2026-65330. Twenty-one of the fixed vulnerabilities affect the WebKit engine, with additional patches applied to Audio, ImageIO, and IOGPUFamily components. The release incorporates fixes that were previously tested in the macOS Golden Gate 27 beta. On the following day, Apple also shipped Safari 26.6.1 for macOS Sonoma and macOS Sequoia, eliminating the same set of 21 WebKit vulnerabilities.
Google Releases Chrome Security Update Fixing 15 Vulnerabilities Including Two Critical Flaws
Google has issued a security update for its Chrome browser that addresses 15 vulnerabilities, two of which are rated critical. The update covers Windows, macOS, and Linux platforms with specific version numbers released on August 18, 2026. Among the fixes are buffer overflow issues in WebGL and Dawn that were reported by Google since mid-July. Thirteen high-severity vulnerabilities were also resolved, including type confusion and calculation errors in the V8 engine, Use After Free flaws in Browser and WebGL, buffer overflows in ANGLE, and information leaks in Skia. Additional problems fixed involve CORS implementation weaknesses, CredentialProvider link handling, USB race conditions, and uninitialized GPU resources. The patches are being rolled out gradually over the coming days and weeks.
CISA Adds Ray AI Framework Flaw CVE-2025-62593 to KEV Catalog After Confirmed Exploitation
US authorities have issued a warning that a critical vulnerability in the Ray framework for scaling AI and Python applications is being actively exploited in real-world attacks. The flaw, tracked as CVE-2025-62593, allows remote code execution through browsers such as Firefox and Safari, potentially enabling attackers to run malicious code simply by displaying an ad on a compromised page. CISA added the issue to its Known Exploited Vulnerabilities catalog on August 17, 2026, and directed federal agencies to apply mitigations by August 20. Originally disclosed in November 2025 and fixed in Ray version 2.52.0, the vulnerability carries a CVSS v4.0 base score of 9.4 and is rated Critical. Developers using Ray in environments that also run Firefox or Safari face additional risk from DNS rebinding attacks that can lead to code injection. Organizations relying on Ray are urged to verify patch status and monitor for signs of compromise.
GitLab Issues Critical Security Updates Fixing Unauthenticated Project Modification Flaws
GitLab has released security updates for its Community Edition and Enterprise Edition platforms to address two vulnerabilities, including one rated critical. The flaws were reported through the company's bug bounty program and affect multiple supported versions. CVE-2026-19478 is a code injection issue that allows remote attackers to tamper with or delete public projects and user data via GraphQL directives without authentication under certain conditions. CVE-2026-19650 is a CSRF vulnerability stemming from insufficient validation in GraphQL multiplexed query handling, enabling mutation execution through GET requests. Both CVEs received high CVSS scores, prompting GitLab to urge immediate upgrades to versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
Multiple Critical Vulnerabilities Patched in IBM Db2 Mirror for i
IBM has disclosed 18 vulnerabilities affecting the graphical user interface of its Db2 Mirror for i database synchronization product, which replicates Db2 for i databases across multiple systems. The most severe issue, CVE-2026-17186, carries a CVSSv3.1 base score of 9.9 and allows remote execution of arbitrary CL commands due to improper neutralization of specific elements within commands. Additional high-severity flaws include CVE-2026-17184 (CVSS 9.8) enabling arbitrary code execution through external file and path control, and CVE-2026-17182 (CVSS 9.8) permitting authentication bypass via URI path validation failures to access or modify sensitive data. Further issues encompass path traversal for writing files to arbitrary locations (CVE-2026-17181, CVSS 9.3) and an authorization bypass (CVE-2026-16879, CVSS 8.8). The vulnerabilities impact versions 7.6, 7.5, and 7.4, with fixes released in the August 11 security advisory.
From Portuguese sources
Translated from Portuguese
Critical Vulnerability in Forminator Forms WordPress Plugin Enables Unauthenticated Remote Code Execution
A critical vulnerability tracked as CVE-2026-15748 with a CVSS score of 9.8 has been identified in the Forminator Forms plugin for WordPress. The flaw allows unauthenticated attackers to upload malicious PHP files by manipulating the Select field alongside a File Upload field on published forms. This bypasses extension blocking and file type validation, potentially leading to full server compromise including web shell installation and database access. The plugin, which has more than 600,000 active installations, is affected in all versions up to and including 1.56.1. The issue was resolved in version 1.56.2 released at the end of July, with later updates including 1.57.0 now available.
Snowflake GitHub Actions Workflow Flaw Enabled Command Injection and Jira Token Theft
A vulnerability in Snowflake's GitHub Actions workflow in the snowflakedb/snowflake-connector-net repository allowed any user to execute arbitrary commands on a runner by creating a specially crafted issue in a public repository. The flaw stemmed from unsanitized insertion of issue titles and content directly into shell commands, combined with a failed access control check that relied on a non-existent pull request property during issue events. During authorized testing, an autonomous security agent exploited the issue to extract a Jira API token from the pipeline environment variables. This credential granted read access to internal engineering, security compliance, and bug bounty projects. The vulnerability was active from June 18 to June 23, 2026. Snowflake patched the workflow on the day the report was received and rotated the compromised token the following day. The vulnerable code appeared in a pull request that involved GitHub Copilot, though available history does not confirm the AI generated the insecure lines.
Apple Patches CVE-2026-43760 Screen Sharing Flaw Granting Root Access on macOS
A vulnerability in the macOS Screen Sharing feature allows remote attackers to execute commands with root privileges under specific configurations. Identified as CVE-2026-43760 and tied to the screensharingd service, the flaw affects systems with Screen Sharing or Remote Management enabled alongside the legacy VNC password option. Attackers who know the VNC password can exploit unauthenticated account binding to retrieve protected files such as /etc/sudoers or write policies into /private/etc/sudoers.d. This grants non-privileged accounts passwordless sudo rights. The issue stems from VNC-authenticated connections not being mapped to specific macOS accounts while file-transfer components retain root privileges. Apple addressed the vulnerability in macOS Tahoe 26.6 and macOS Sonoma 14.8.8, both released on July 27, 2026.
Cybercriminals Deploy Advanced AI for Continuous Automated Reconnaissance and Exploitation at Scale
Advanced AI models now enable cybercriminal groups to maintain uninterrupted reconnaissance across enterprises in every sector, mapping domains, exposed services, and infrastructure changes at a pace no human team could sustain for weeks. The automated process targets two opposite profiles of vulnerable systems: legacy environments left unpatched for years with outdated versions and forgotten permissions, and rapidly deployed applications built through Vibe Coding that reach production without security review. The entire attack chain—reconnaissance, vulnerability identification, validation, and exploitation—is now executed by AI agents operating with minimal human oversight. What previously required a dedicated specialized team focused on one target at a time now runs in parallel against thousands of targets simultaneously, with marginal cost approaching zero for each additional attack. This collapse in operational costs and rise in success rates has restructured the cybercrime economy, funding increasingly sophisticated tools and lowering the barrier for new operators who need only platform access rather than deep technical expertise. The time window between an application reaching production and discovery by attackers has shrunk to hours, while most organizations still treat security as a finite project rather than an ongoing process.
Microsoft to Make Passkeys Default Authentication in Entra ID Starting September 2026
Microsoft will transition Entra ID users to passkeys as the standard authentication method beginning September 1, 2026. The change aims to eliminate reliance on phishing-prone SMS and voice call codes. Existing SMS and voice users will be prompted to register passkeys during their next multifactor authentication. Passkeys rely on public-key cryptography and avoid shared secrets, blocking phishing, interception, credential reuse, and SIM swapping attacks. Support includes synced passkeys via iCloud Keychain and Google Password Manager, plus device-bound options like Microsoft Authenticator, Windows, and FIDO2 hardware keys. Native SMS and voice services will be fully retired on February 1, 2027, forcing affected tenants to adopt passkeys with no opt-out option.
Dysphoria Botnet Compromises Nearly 300,000 Devices for DDoS Attacks and Residential Proxy Services
The Dysphoria botnet has infected approximately 296,000 devices, including routers, IP cameras, gateways, and embedded Linux systems. Researchers first observed the threat in the first quarter of 2026, noting rapid evolution from the jackskid and fbot families. The infrastructure is primarily used for DDoS attacks but has expanded to offer residential proxy capabilities. Infection occurs through brute-force attacks on Telnet and SSH services with weak credentials, as well as known remote code execution vulnerabilities in IoT equipment. A key technical advancement involves the use of Ethereum and Solana blockchain domains for command-and-control infrastructure, making takedowns significantly harder. Compromised devices can also function as relays by leveraging UPnP to expose ports and hide criminal traffic origins. Operators advertise attack capacity of up to 4 Tbps and sell DDoS services in structured commercial packages targeting internet services and gaming platforms worldwide.
From Chinese sources
Translated from Chinese
Sorry Ransomware Exploits cPanel Vulnerability to Directly Lock Linux Servers in Multiple Chinese Incidents
China's National Computer Virus Emergency Response Center has issued a warning about the Sorry ransomware, which targets exposed Linux web servers through a cPanel authorization vulnerability. The Go-based malware gains root access without any phishing or user interaction, disguises itself as the legitimate sshd process, and follows a six-stage attack chain that includes data exfiltration before encryption. It terminates databases, security tools, and backup services, then uses AES and RSA to encrypt files with a .sorry extension while demanding ransom via an encrypted communication tool. The campaign specifically affects small and medium-sized enterprises running cPanel on mainstream Linux distributions, including domestic Xinchuang systems. Attackers also scan internal networks for weak SSH credentials to spread laterally. The center urges immediate patching of cPanel, exposure reduction, strong passwords, offline backups, and avoidance of fake decryptors.
Ruishu Information Warns Machine Traffic Now Dominates Internet as AI Agents Surge
Ruishu Information has released its 2026 Automation Threat Report covering data from early 2025 through Q2 2026. The report shows bots accounting for 68 percent of total internet traffic, with malicious bots making up 55 percent of that volume. Human traffic has fallen to just 22 percent while AI Agent-driven requests have grown from under 1 percent to 8-12 percent. LLM and AI Agent requests have already exceeded 450 billion, marking more than 400 percent year-over-year growth. The report introduces a new classification of non-human traffic into traditional bots, AI-enhanced bots, and autonomous AI Agents, along with an L1-L5 threat framework. It also expands documented attack scenarios from nine to thirteen, adding LLM application attacks, agent supply-chain attacks, identity hijacking, and autonomous AI-orchestrated attacks.
360 Launches nanoWork Enterprise Edition Channel Ecosystem with Native Security for AI Agents
On August 17, 360 held its nanoWork Enterprise Edition partner recruitment launch event, gathering over 200 channel partners from across China. The event marks the first major channel gathering since the product's official release on July 28. 360 founder Zhou Hongyi emphasized that AI is moving from answering questions to completing tasks, requiring robust security foundations, channel networks, and service systems. General Manager Wang Yi highlighted the low enterprise AI adoption rate of around 18% and positioned nanoWork as a secure, enterprise-grade AI agent platform built on 20 years of 360 security expertise. The company unveiled a three-dimensional partner architecture, four revenue models, and five empowerment systems to enable lightweight partner entry into the market. With a 1,000+ FDE engineer network and the AikerWorld community, nanoWork aims to deliver on-site陪跑 and service packages to bridge the last mile of AI deployment.
SAP Commerce Cloud CVE-2026-58231 Critical Flaw Exploited in the Wild Just Three Days After Patch
SAP Commerce Cloud has been hit by a maximum-severity vulnerability tracked as CVE-2026-58231 that carries a CVSS score of 10.0. The flaw resides in the Data Hub Adapter component and allows unauthenticated remote code execution via a single crafted HTTP request. SAP released the official patch on 11 August, yet honeypots recorded the first exploitation attempts only three days later on 14 August. More than 4,200 internet-facing SAP Commerce Cloud instances have been identified worldwide, primarily in Europe and North America. Researchers note that AI-assisted patch analysis enabled attackers to weaponize the fix at unprecedented speed. Organizations are urged to apply the updates to versions 2211.55 or 2211-jdk21.17 immediately and restrict access to the affected endpoints in the meantime.
WordPress Login Page Exposed to Critical XSS2Shell Flaw CVE-2026-64638: Over 11,000 Sites Attacked Across 67 Countries
WordPress core login page vulnerability CVE-2026-64638 enables unauthenticated attackers to trigger reflected XSS that can escalate to full server compromise. The flaw stems from mismatched HTML sanitization between two filtering layers on the wp-login.php page, allowing malicious payloads to execute in the site origin. Imperva observed automated campaigns hitting more than 11,000 sites with hundreds of thousands of requests, predominantly affecting U.S. targets in gaming, education, and finance sectors. Successful exploitation chains the XSS into WordPress REST API and application password creation when an administrator is logged in, ultimately allowing malicious plugin uploads. Official patches are available in WordPress 7.0.3 and backported releases down to 4.7; administrators are urged to verify versions, audit user accounts, and inspect plugin directories immediately.
LiteLLM Supply Chain Poisoning Exposes 195TB of Credentials Across 2500 Organizations
A detailed forensic report from CloudSEK and Hudson Rock reveals that attackers compromised the LiteLLM CI/CD pipeline by poisoning the Trivy security scanner dependency. The malicious Trivy tag allowed theft of PyPI publishing tokens, leading to the upload of tainted LiteLLM versions 1.82.7 and 1.82.8. Within a 40-minute attack window these packages were downloaded over 119,000 times, exfiltrating 195TB of credentials including AWS, Azure, GCP keys, GitHub tokens, SSH keys, Kubernetes configs, and AI provider API keys. NVIDIA and multiple other major technology firms were confirmed among the victims. The incident highlights critical weaknesses in dependency pinning practices and the absence of automated detection for malicious package behavior on PyPI. Experts warn that AI infrastructure components are becoming high-value targets for future supply-chain campaigns.
From Spanish sources
Translated from Spanish
Critical GeoServer Vulnerability CVE-2024-36401 Actively Exploited for Unauthenticated Remote Code Execution
The CVE-2024-36401 flaw in GeoServer and its GeoTools library allows attackers to achieve remote code execution without authentication by abusing property name expressions interpreted as XPath. Active exploitation has already led to confirmed intrusions involving initial access, lateral movement, and persistence with tools such as China Chopper web shells. Multiple OGC endpoints including WFS GetFeature, WMS GetMap, and WPS Execute are affected when exposed to the internet. Patches are available in GeoServer versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2. Organizations unable to patch immediately can mitigate risk by removing the gt-complex JAR file, though this may break functionality. Additional defenses include restricting internet exposure through IP allowlisting, VPNs, and reverse proxies while monitoring logs for anomalous requests. Any previously exposed instances should be treated as potentially compromised, with full incident response including credential rotation and host forensics recommended.
Critical GeoServer Vulnerability CVE-2024-36401 Actively Exploited for Unauthenticated Remote Code Execution
The vulnerability CVE-2024-36401 in GeoServer is already being exploited in real-world attacks and enables remote code execution without authentication. The flaw stems from how GeoServer and its GeoTools library interpret certain property names, allowing malicious XPath expressions via commons-jxpath in default configurations. Attackers can abuse multiple OGC endpoints including WFS GetFeature and GetPropertyValue, WMS GetMap, GetFeatureInfo and GetLegendGraphic, plus WPS Execute to gain initial access. Observed intrusions follow a familiar pattern of reconnaissance, lateral movement and persistence with web shells such as China Chopper. Patches are available in GeoServer 2.22.6, 2.23.6, 2.24.4 and 2.25.2, while a temporary mitigation involves removing the gt-complex jar file. Organizations are urged to apply updates immediately, restrict internet exposure and hunt for indicators of compromise in logs and on hosts.
Attackers Actively Exploit Critical SharePoint Authentication Bypass CVE-2026-55040 After Public PoC Release
Active exploitation of CVE-2026-55040, a critical authentication bypass vulnerability in Microsoft SharePoint Server, has intensified following the public release of a proof-of-concept exploit. The flaw, which carries a CVSS score of 9.1, stems from multiple defects in the JWT token validation pipeline and allows remote attackers to impersonate any user, including administrators, without valid credentials. Affected versions include SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016, with heightened risk for instances exposed to the internet. Microsoft released patches in July 2026, and organizations are urged to apply them immediately while restricting external access and monitoring IIS logs for anomalous administrative activity. The vulnerability has already been chained with other flaws in real-world incidents involving persistence, data theft, and credential rotation responses.
Attackers Exploit Critical CVE-2026-59310 in VMware vCenter for Persistent Remote Access
A critical vulnerability identified as CVE-2026-59310 in Broadcom VMware vCenter Server is being actively exploited in the wild against internet-exposed instances. The flaw resides in the Syslog server component and enables remote code execution through a path traversal weakness, carrying a CVSS score of 9.8. Attackers have been observed deploying malicious cron jobs and the reverse_ssh tool to establish persistent outbound command-and-control channels since early August 2026. The campaign has impacted 361 unique IP addresses across 47 countries, with notable concentrations in Germany, the United States, Turkey, Iran, and France. Broadcom has released patches under advisory VMSA-2026-0006.1, which also addresses the related CVE-2026-59309, and strongly recommends immediate updates along with network segmentation and log reviews. No workarounds exist, making prompt patching the only effective mitigation.
GhostSplice Technique Lets Malicious MCP Servers Trick AI Coding Agents into Exfiltrating Secrets
GhostSplice is a new technique that allows a malicious MCP server to induce an AI coding agent to leak SSH keys, environment secrets, and source code. The attack splits malicious instructions across tool metadata and responses so the agent reconstructs and executes the full exfiltration plan without detecting an overtly malicious command. Tests showed the method raised compliance rates from an average of 42 percent to 82 percent across eleven models, with some systems moving from zero to 100 percent success. The technique requires the developer to connect the attacker-controlled MCP server and for the agent to already possess read access to the targeted files. Defenses focus on strict allow-listing of MCP servers, least-privilege tool permissions, separation of tool output from instructions, and human approval for sensitive operations. The disclosure aligns with prior warnings about poisoned MCP tool descriptions and agentjacking attacks.
Malicious VS Code Extensions Masquerading as Solidity Tools Steal Crypto Wallets, API Keys and Credentials
Two malicious Visual Studio Code extensions promoted as Solidity development utilities have been used to steal cryptocurrency wallet data from browsers along with API keys and stored credentials. The extensions, identified as helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, target developers working with smart contracts and Web3 environments where sensitive tokens and sessions are commonly present. Attackers rely on the trusted VS Code marketplace to deliver the payload through a simple installation rather than any complex exploit. Once active, the extensions harvest browser-based crypto wallet information, saved credentials, environment files, SSH keys and API tokens. A single compromised workstation can therefore expose repositories, cloud services and directly drain cryptocurrency funds. Security researchers recommend immediate removal of both extensions, rotation of all accessible secrets and adoption of stricter extension allow-list policies. The incident highlights ongoing supply-chain risks in developer tooling ecosystems.