AI Safety Guidelines: 10 Essential Rules to Protect Data, Finances, and Reputation When Working with LLMs
A detailed analysis of emerging AI-related security risks highlights how large language models can autonomously execute attack chains, fall victim to prompt injection, and cause cascading errors in complex workflows. The article examines real-world incidents such as the Anthropic vending machine pricing failure, the Meta Instagram account takeover via overly helpful AI support, and Copilot Studio data leaks through prompt injection. It emphasizes that while attack methods themselves are not revolutionary, AI agents can now scale them at machine speed with autonomous decision-making and recovery capabilities. The piece provides ten concrete safety rules covering financial controls, fact verification, data confidentiality, context pollution prevention, and access limitation. It also stresses that ultimate responsibility always remains with the human operator, not the AI system.
Translated from Russian
Read full articleLatest News
How AI Powers NGFW Solutions in 2026: Russian Vendors and Global Approaches Compared
The article examines four distinct AI use cases in next-generation firewalls: machine learning threat detection, generative analytics for operations, administrator assistants or agents, and protection against unauthorized AI applications. Global vendors such as Palo Alto Networks integrate hybrid deep learning with cloud analysis in Advanced Threat Prevention, while Fortinet adds Shadow AI visibility and MCP/A2A agent monitoring in FortiOS 8.0. Cisco, Check Point, and Juniper deploy generative copilots inside management platforms to explain policies and suggest rule changes. Russian solutions differ in focus: Kaspersky applies ML to file heuristics, UserGate relies on URL categories for AI chatbots, and Ideco combines application-level AI service detection with read-only AI services for IPS log analysis and firewall rule auditing. Ideco NGFW Novum v23 already recognizes 83 AI protocols and plans an LLM Proxy in v24. The piece stresses that effective AI integration must preserve human oversight of configuration changes while accelerating detection of new threats and Shadow AI activity.
Translated from Russian
AI Agent Failures Usually Trace Back to Instruction Defects, Not Model Limitations
After a full year of working with AI agents in production workflows, the author stopped blaming models for apparent stupidity or hallucinations. The vast majority of such issues stem from three specific defects in the instructions provided to the agent. Rules written in ordinary prose often fail to enforce precise behavior. Instructions phrased as "how not to" create ambiguity instead of clear constraints. Finally, rules without built-in verification mechanisms allow errors to propagate unchecked. The piece emphasizes that diagnosing instruction quality is far more productive than assuming model degradation. This observation applies across programming, DevOps, analytics, and information security tasks where AI agents are deployed on continuous streams of work.
Translated from Russian
Cisco Patches 29 Vulnerabilities in Secure Firewall ASA, FTD and FMC Products
Cisco Systems has disclosed multiple vulnerabilities affecting its Cisco Secure Firewall product line and released corresponding security updates. The advisory covers 14 security bulletins addressing 29 CVEs across Adaptive Security Appliance (ASA), Threat Defense (FTD), and Management Center (FMC) software. Five of the advisories are rated Critical, covering 18 CVEs that include remote code execution without authentication and privilege escalation to administrator level. Several issues have already been confirmed as exploited in the wild. The company also consolidated related weaknesses under single CVE identifiers where appropriate and provided CVSS v3.1 base scores ranging up to 9.9. Affected products include the Secure Firewall 3100 and 4200 Series along with multiple software hardening releases issued on 16 September 2026.
Translated from Japanese
First Commercial AI Attack Agent DarkAgent V3.0 Hits Dark Web, Cutting Penetration Cycles from Two Weeks to 2.8 Days
China's National Computer Virus Emergency Response Center released its Dark Web Monitoring 2025 Annual Report, documenting over 1.01 million threat incidents across more than 100,000 monitored dark web nodes. The report highlights the sale of DarkAgent V3.0, the world's first commercial-grade AI attack agent capable of fully autonomous reconnaissance, vulnerability discovery, exploitation, and data exfiltration. Traditional manual red-team operations that previously required at least two weeks are now compressed to an average of 2.8 days, representing an 85% reduction in attack-chain duration. The European Space Agency suffered a 700 GB data breach involving satellite control parameters and aerospace contracts, achieved via a compromised third-party supplier in a classic supply-chain attack. The report warns that AI-driven attacks lack static signatures, evade signature-based defenses, and are increasingly coupled with nation-state actors and organized crime groups. Post-quantum cryptography research tools are already appearing for sale, signaling that defenders must accelerate migration timelines.
Translated from Chinese
pgAdmin 4 Database Management Tool Patches Multiple Vulnerabilities in Version 9.18
The development team behind pgAdmin 4, the popular management tool for PostgreSQL databases, has released version 9.18 to address multiple security issues. The update, published on September 17, 2026, includes fixes for four CVEs along with 29 total changes covering new features and bug resolutions. One vulnerability, tracked as CVE-2026-86863, stems from insufficient web server authentication that trusts external HTTP headers, enabling attackers to bypass login and impersonate administrators without passwords. A second issue, CVE-2026-86864, allows command injection through the backup feature when database names are passed as arguments, potentially leading to unauthorized file writes or exfiltration of connection passwords. The update is available now from the official pgAdmin repository.
Translated from Japanese
EnvSpec Naming Standard Introduces Strict Six-Environment Hierarchy for Zero Trust Infrastructure
The EnvSpec Naming 1.0.0 standard proposes replacing ad-hoc hostnames with a strict hierarchical naming system based on environment, perimeter, system, slot and node. It defines exactly six environments—dev, test, stage, prod, infrastructure and workplace—and treats any test or pilot system processing real data as prod. The model projects names into SPIFFE IDs, Kubernetes namespaces, cloud projects and mandatory tags for automated policy enforcement. Rules prohibit direct communication between different linear environments and require all access from workplace devices through dedicated gateways. The standard is published under CC BY-SA 4.0 and includes machine-checkable criteria for compliance.
Translated from Russian
PhishIntel: Open-Source Python and Go Tool Automates Web Reconnaissance for OSINT Analysts
PhishIntel is a lightweight reconnaissance utility written primarily in Python with performance-critical components in Go. The tool launches via a single command and presents an interactive menu that lets analysts select language and modules. Its core crawler recursively visits a configurable number of pages at a chosen depth and concurrency level, harvesting Russian and US-format phone numbers, emails, cryptocurrency wallets, and physical addresses. Additional modules collect domain metadata including DNS records, RDAP, WHOIS, TLS certificates, redirect chains, and external JavaScript and API endpoints. A limited TCP port scan performed by the Go binary identifies listening services and basic technology fingerprints without replacing full port scanners such as Nmap. Results are exported in both structured JSON and human-readable HTML formats, while an optional .env file allows customization of user agents and proxies.
Translated from Russian
Cisco Issues Emergency Patches for Critical ISE Zero-Day CVE-2026-76460 Already Exploited in Attacks
Cisco has released emergency patches for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) to address CVE-2026-76460, a maximum-severity zero-day with a CVSS score of 10.0. The vulnerability stems from insufficient authentication controls in an API endpoint, allowing remote attackers to bypass authentication entirely without credentials. Active exploitation has been confirmed, enabling unauthorized access to the API gateway and potential root-level command execution when chained with further actions. The flaw affects all configurations of ISE and ISE-PIC, with no available workarounds, forcing organizations to apply updates immediately. Patches are available for branches 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4, while version 3.0 has reached end of software maintenance. Administrators are advised to review ise-kong access.log and node access logs for suspicious usernames and cross-reference with perimeter and firewall logs. In cases of confirmed compromise, affected nodes should be reinstalled and restored from backups, with iACLs recommended to restrict management traffic during rollout.
Translated from Spanish
Russian Woman Fined 30,000 Rubles and Loses iPhone 11 for Posting AI-Generated Bear Photo
A resident of Duldurga village in Zabaykalsky Krai was fined 30,000 rubles under part 9 of article 13.15 of the Russian Code of Administrative Offenses for publishing an AI-generated image of a bear presented as authentic. The court also ordered confiscation of her iPhone 11 as the instrument of the administrative violation. The woman knew the photograph was fake before posting it, yet the image spread widely online and was even shared by a local Ministry of Natural Resources channel on 10 September. Local authorities used the case to warn residents that publishing neural-network-generated fake images carries real legal consequences. The incident highlights ongoing enforcement of Russian legislation against the distribution of knowingly false socially significant information under the guise of credible reports. Meanwhile, wildlife specialists continue to investigate separate reports of actual bears near populated areas in the region.
Translated from Russian
From Russian sources
Translated from Russian
Russia Hands Down First Conviction Under New Criminal Article for Online Drug Propaganda
A resident of Orenburg became the first person in Russia to receive a criminal sentence under Article 230.3 of the Criminal Code, which criminalizes online drug propaganda following repeated administrative violations. The man was fined 100,000 rubles and had his mobile phone confiscated after he printed and posted leaflets containing a QR code that directed users to job advertisements linked to drug distribution. The scheme began when he was recruited via messenger to place the leaflets for 10 rubles each, without realizing the content involved narcotics-related vacancies. Prior to this case, the individual had already been sanctioned twice within the same year for illegal drug advertising, allowing prosecutors to escalate the matter to the new criminal provision that took effect on 1 March. The court considered his prior record as a recidivism aggravating factor yet imposed the minimum fine after he admitted guilt, expressed remorse, and cooperated with investigators. The ruling has already entered into force, marking the initial application of the statute that permits penalties up to two years of imprisonment or fines between 100,000 and 300,000 rubles.
Where to Find Scientific Articles and Full Texts in 2026: Russian and International Databases Guide
Finding complete scientific papers often requires navigating multiple platforms because search engines show only titles and abstracts while publishers may demand payment for PDFs. The guide explains the differences between bibliographic databases that help locate publications and full-text repositories that provide actual documents. It covers Russian resources such as CyberLeninka, eLIBRARY.RU with RINC, Math-Net.Ru, and the national platform of scientific journals, along with international tools including Google Scholar, PubMed, arXiv, ACM Digital Library, IEEE Xplore, Scopus, and Web of Science. Additional sections address book catalogs, archives, AI-powered search tools like Consensus, and scientific social networks such as ResearchGate. The material emphasizes that presence in any database does not guarantee quality or validity, urging readers to verify methods, results, and publication status independently. Practical advice is given on locating open-access versions, using library subscriptions, and contacting authors directly.
Stored XSS in Telegram Desktop Allows Silent Data Exfiltration via Chat Export
Researchers at ExPatch Vulnerability Research discovered a stored XSS vulnerability in Telegram Desktop that could be triggered when users exported chat history to HTML. The flaw resided in export_output_html.cpp where button text from inline keyboards was not passed through the SerializeString function, allowing arbitrary HTML and JavaScript to execute upon opening the exported file. Attackers could deliver the payload through a bot that never joined the target group, relying on message forwarding to reach victims. Once executed, the script exfiltrated all visible messages, chat metadata, and file paths to an attacker-controlled server while optionally replacing the page with a phishing form. Telegram issued a silent fix in Beta v6.9.4 and Stable v7.0.1 without publishing an advisory or assigning a CVE. The researchers refused the offered bounty and published the details after the patch to inform users about risks from previously exported files.
WAF Connected — What Next? How to Configure Web Application Firewalls for Real Protection Without Disruption
After successful pilot testing, organizations often struggle when scaling WAF protection across dozens or hundreds of applications. Each app brings unique technology stacks, traffic patterns, and legitimate anomalies that can break existing rules. The article stresses starting in monitoring mode rather than blocking to avoid false positives that frustrate users and damage business operations. A structured Risk Score and Priority Score system helps teams prioritize applications based on exposure, business impact, control weaknesses, technical risks, and data sensitivity. Regular tuning, log analysis, and quarterly re-evaluation of the application registry are required because applications evolve constantly. Well-configured WAF solutions must deliver low false-positive rates, rapid exception handling, and resilience under peak loads without creating new operational burdens for security teams.
Avanpost SmartPAM Adds 60 MITRE ATT&CK Signatures for Privileged Session Threat Detection
Avanpost has released an update to its SmartPAM 1.4 solution that incorporates a library of 60 signatures mapped to the MITRE ATT&CK framework. The new capability allows the Privileged Access Management system to monitor and analyze actions performed by administrators inside privileged sessions rather than simply controlling initial access. The signatures cover common attack techniques including credential access, persistence, lateral movement, and defense evasion such as disabling audit logs, antivirus, or firewalls and clearing system events. A built-in signature analysis engine normalizes session data, matches observed behavior against known attack patterns, and triggers automated responses including command blocking, session termination, or SIEM alerts. Customers can combine the vendor-supplied rules with custom policies and will receive regular subscription-based updates at no cost until the end of 2026. Avanpost claims SmartPAM is the first PAM product to offer a MITRE ATT&CK-structured signature library, shifting the tool from a basic access gatekeeper to an active behavioral observer capable of identifying malicious activity even when valid credentials are used.
Positive Technologies Discontinues Active Development of PT AF 3, Shifts Focus to PT AF PRO and PT Cloud AF
Positive Technologies is halting active development of its PT Application Firewall 3 product and redirecting resources toward PT AF PRO and the cloud-based PT Cloud AF. Existing customers of the legacy WAF will continue to receive technical support, though no significant new capabilities are expected. The company cites the dramatic expansion of modern web infrastructure, which now spans hundreds of applications, APIs, and microservices across data centers, clouds, branches, and subsidiaries. Positive Technologies notes that exploitation of internet-facing web application vulnerabilities remains the leading initial access vector, accounting for 36 percent of successful corporate network intrusions. PT AF PRO, developed from the ground up over more than six years, is positioned as the new flagship solution for large-scale, distributed environments. The cloud offering PT Cloud AF provides a hardware-free alternative that organizations can manage themselves or fully outsource to partners. Client adoption of PT AF PRO has doubled over the past year.
From Japanese sources
Translated from Japanese
Cisco ISE Affected by 42 Vulnerabilities Including Multiple Critical Flaws with Confirmed Exploitation
Cisco Identity Services Engine (ISE) has been found to contain 42 vulnerabilities across 15 security advisories released by Cisco Systems on September 16, 2026. Six advisories received the highest Critical rating, covering 21 individual vulnerabilities, while three were rated High and six Medium. One standout issue, CVE-2026-76460, allows attackers to bypass authentication on the management API via crafted HTTP requests and execute commands with root privileges. The flaw also impacts the Cisco ISE Passive Identity Connector (ISE-PIC). Cisco has urged immediate application of updates as some vulnerabilities are already being exploited in the wild. The product provides core network authentication and access control functions for enterprise environments.
CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog, Including Cisco ISE and Acronis Backup Flaws
The US Cybersecurity and Infrastructure Security Agency has added three vulnerabilities with confirmed in-the-wild exploitation to its Known Exploited Vulnerabilities catalog. The flaws affect Cisco Identity Services Engine, its Passive Identity Connector, and Acronis Backup plugins for cPanel and Plesk. All three entries carry a remediation deadline of September 19, 2026. The Cisco issue stems from insufficient authentication controls on an API endpoint that lets remote attackers bypass the web-based management interface. The Acronis vulnerability arises from overly permissive default settings in server-management plugins, enabling privilege escalation. Federal agencies have been directed to investigate potential compromises and apply mitigations without delay.
Apple Releases iOS 27 and iPadOS 27 with Fixes for 126 Vulnerabilities
Apple has released iOS 27 and iPadOS 27, addressing a total of 126 CVEs across multiple system components. The updates target issues in the kernel, WebKit, Bluetooth, video encoding, and media handling frameworks. Twenty kernel vulnerabilities were resolved, including problems that could allow memory corruption or privilege escalation to root level. Separate patches were also issued for older devices via iOS 26.7 and iPadOS 26.7. Notable fixes include CVE-2026-43689 in the kernel and CVE-2026-65414 affecting Bluetooth. The release was made available on September 14, 2026.
Google Issues Chrome 153 Security Update Addressing 42 Vulnerabilities Including Three Critical Flaws
Google has released a major security update for its Chrome browser version 153, fixing a total of 42 vulnerabilities. The update includes three critical-severity issues that could allow attackers to execute arbitrary code or cause memory corruption. Patches are now available for Windows, macOS, and Linux platforms, with versions 153.0.8010.48 and 153.0.8010.47. Among the critical fixes are out-of-bounds read in WebGL, use-after-free in Internals, and another use-after-free in Workers. The release also resolves 28 high-severity flaws affecting the V8 JavaScript engine, ServiceWorker, Skia, DOM, PDF, and other components. Medium and low severity issues were addressed as well, bringing the total to 42 vulnerabilities resolved.
Oracle Releases September 2026 Critical Security Patch Update Fixing 673 Issues Across Multiple Products
Oracle has published its monthly Critical Security Patch Update (CSPU) on September 15, 2026, delivering a total of 673 security fixes. The update addresses 672 unique CVEs after removing duplicates and targets a wide range of products including Oracle Database Server, Oracle Fusion Middleware, Oracle E-Business Suite, PeopleSoft, Siebel, and Oracle VM VirtualBox. Of the fixes, 607 received a CVSSv3 base score of 7.0 or higher, with 104 scoring 9.0 or above. Six vulnerabilities carry the maximum score of 10.0, while 15 are rated 9.9 and 44 are rated 9.8. Additionally, 247 of the issues can be exploited remotely without authentication. The CSPU serves as a smaller, more frequent complement to Oracle’s quarterly Critical Patch Update (CPU) releases.
Critical Vulnerabilities Patched in WHMCS Billing Software for Hosting Providers
WebPros International has disclosed two serious vulnerabilities in its WHMCS billing management platform used by hosting and cloud service providers. CVE-2026-67399 allows unauthenticated remote code execution through unsafe deserialization of untrusted data under specific conditions, potentially compromising the entire server environment and associated data. CVE-2026-67398 affects the 2CheckOut payment gateway module and stems from missing authorization checks, enabling attackers to retrieve sensitive customer information including names, addresses, emails, and phone numbers without authentication. HackerOne assigned CVSS v4.0 scores of 9.3 (Critical) to the first issue and 8.2 (High) to the second. WebPros released fixed versions WHMCS 9.0.8 and 8.13.7, and recommended disabling the 2CheckOut module as a temporary mitigation for the second flaw.
From Portuguese sources
Translated from Portuguese
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens in Brazil
Elastic Security Labs researchers have detailed the operations of the KREMLIN banking malware, tracked under the identifier REF9334, which targets Chrome and Edge browsers to harvest credentials and session tokens. The campaign focuses almost exclusively on Brazil, with 98 percent of the 1,515 identified infections located in the country and impersonating a dozen Brazilian banks. Infection begins with multi-stage JavaScript loaders disguised as banking documents, invoices, or corporate papers that require manual execution by the victim. The loaders then deploy C++ installers and malicious browser extensions that modify the Secure Preferences file, enable developer mode, and overwrite protection objects with forged metadata using a technique called Phantom Extension. Once active, the extension collects session tokens, cookies, sessionStorage and localStorage data, 15 days of browsing history, screenshots, open tab information, and full HTML of visited pages. The operation has run since May 2025 across seven distinct campaigns and began using Ethereum smart contracts for infrastructure on 19 May 2026.
Cisco Confirms Active Exploitation of Critical Secure Email Gateway Flaw Allowing Root Command Execution
Cisco has confirmed active exploitation of a critical vulnerability in its Secure Email Gateway product that allows attackers to execute arbitrary commands with root privileges. The flaw, tracked as CVE-2026-76461 with a CVSS score of 9.8, stems from insufficient input validation in the message analysis logic of AsyncOS. Attackers can trigger the issue by sending a specially crafted email containing malicious SQL instructions, which leads to arbitrary SQL command execution and full root access on affected appliances. The vulnerability impacts physical and virtual deployments running AsyncOS versions 15.5 and earlier, 16.0, and 16.5. Patches are available in versions 15.5.5-0141, 16.0.4-302, and 16.5.0-780, while the Secure Email and Web Manager and Secure Web Appliance remain unaffected. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 14 and set a September 17 remediation deadline for federal agencies.
AWS Systems Manager Agent Flaw Allows Bypass of Port Forwarding Restrictions
Amazon has fixed a vulnerability in the AWS Systems Manager agent that permits an authenticated attacker to bypass restrictions on port forwarding sessions. The issue, tracked as CVE-2026-89049, stems from inadequate validation of equivalent representations of blocked link-local addresses. As a result, attackers can reach the EC2 instance metadata service at 169.254.169.254 and obtain temporary credentials tied to the instance's IAM role. Affected versions are those prior to 3.3.4851.0, with the fix included in that release and all subsequent versions. AWS recommends reviewing custom builds of the agent, restricting access to the AWS-StartPortForwardingSessionToRemoteHost document, auditing Session Manager activity, and applying least-privilege principles to IAM roles.
Malicious Twitch Extension Steals OAuth Tokens from Nearly 31,000 Users
A browser extension posing as an enhancement for Twitch has been stealing OAuth authentication tokens from approximately 31,000 users across Chrome and Firefox. The extension, known as Twitch Enhanced Viewer or JeetBot, was discovered by researcher Kush Pandya of Socket. It promised 1080p streaming in restricted regions and an ad-free experience while covertly exfiltrating session tokens to attacker-controlled servers. The tokens were transmitted in plaintext via network-layer redirects, allowing full access to chat functions, private messages, and account settings. Both the Chrome version with around 30,000 installations since June 26, 2025, and the Firefox version with 604 users since July 7, 2025, remained available in official stores at the time of reporting. Users are advised to immediately disable the extension and revoke active Twitch sessions to invalidate stolen tokens.
Revolut Confirms Limited Data Exposure After Fraudulent Government Email Request
Revolut has confirmed that a small number of customers had personal documents and full transaction histories exposed after the company responded to a fraudulent request that appeared to come from a government authority. The incident, disclosed on September 13, involved no intrusion into Revolut systems. Attackers instead used an unauthorized email account that carried valid credentials from a government domain, making the request appear legitimate. Exposed data included passport and driver’s license copies, identity verification selfies, full names, dates of birth, occupations, addresses, contact details, IBAN statements, complete transaction histories, and Bitcoin activity records. The combination of identity documents and detailed financial history significantly raises the risk of account takeover and targeted social engineering. Revolut stated that customer funds remained secure, blocked the malicious email source, notified regulators, and contacted all affected users.
Casbaneiro Banking Trojan Targets Financial Institutions in Argentina, Peru, Colombia and Mexico
Fortinet researchers identified a Casbaneiro campaign in August that specifically targets bank customers across four Latin American countries. The infection begins with a PDF attachment that displays the recipient's own email address to build credibility and creates urgency around an unpaid invoice or judicial notice. The PDF link performs IP-based geofencing, redirecting non-target visitors to Google or YouTube while delivering a Base64-encoded ZIP only to victims in the selected countries. Inside the archive, an HTA file downloads the legitimate AutoIt interpreter along with a compiled script and compressed payload, helping evade binary-focused defenses. The malware stays dormant until the victim visits a monitored banking website, at which point it activates its C2 channel, exfiltrates Outlook contact data, and can display bank-specific credential-harvesting overlays. Additional remote-access capabilities allow operators to control the keyboard, manipulate the clipboard, and execute arbitrary commands on the infected system.
From Chinese sources
Translated from Chinese
Cisco Secure Email Gateway CVE-2026-76461 Critical SQL Injection Flaw Exploited in the Wild for Root Access
Cisco has confirmed active exploitation of CVE-2026-76461, a CVSS 9.8 critical SQL injection vulnerability in Secure Email Gateway. The flaw resides in AsyncOS mail parsing logic and allows unauthenticated attackers to execute arbitrary commands as root simply by sending a specially crafted email. No user interaction, authentication, or workarounds exist, leaving immediate patching as the only mitigation. Affected versions include all releases up to 15.5, 16.0, and 16.5; fixed builds are 15.5.5-014, 16.0.4-302, and 16.5.0-780. Because the gateway sits at the network perimeter with high privileges, successful compromise enables long-term email interception, lateral movement, and internal phishing campaigns. Organizations should examine mail_logs for patterns such as COPY.*TO PROGRAM and cross-check network telemetry for anomalous outbound connections.
Anthropic Exposes Widespread Weaponization of Claude by Nation-State Hackers and Cybercriminals for Automated Attacks
Anthropic has released a threat intelligence report detailing how multiple state-sponsored and criminal groups systematically abused its Claude model between December 2025 and August 2026. The company introduced the term Generative Threat Groups to describe actors that built multi-agent frameworks to automate reconnaissance, exploitation, and data exfiltration. One group identified as GTG-20006, widely linked to Midnight Blizzard, APT29 and Cozy Bear, created an AI-driven workflow that automatically rewrites and redeploys malware once security tools detect it. The report highlights that this capability collapses the traditional gap between well-resourced nation-state operations and individual attackers. Defensive recommendations focus on shifting detection to behavioral chains, shortening IOC validity periods, strengthening data-loss prevention, and establishing internal governance for AI tool usage.
Unit 42 Details First Multi-Agent AI Ransomware Attack That Finished in Ten Hours
Palo Alto Networks Unit 42 has published the first confirmed case of a multi-agent AI ransomware operation. Attackers only defined the target; more than ten specialized AI agents then performed reconnaissance, credential harvesting, lateral movement, data exfiltration, and encryption within ten hours. The agents used over fifty ATT&CK techniques and successfully hid command traffic inside the victim’s own AI service endpoints. After encryption the same agents automatically generated an eighty-page security audit report listing every compromised system and technique. The sole defensive control that stopped part of the attack was a mandatory multi-person code review rule on Terraform changes. Unit 42 links the operation to frontier large-language-model frameworks and notes that earlier single-agent incidents such as JADEPUFFER have now evolved into coordinated agent fleets.
South Korean Medical Beauty Platform Gangnam Unni Suffers API Breach Exposing 220,000 Users' Sensitive Photos and Medical Records
Healing Paper, operator of South Korea's largest medical beauty information platform Gangnam Unni, confirmed a data breach affecting nearly 220,000 customers after an API endpoint used to query consultation records was abnormally accessed. The incident exposed highly sensitive personal information including names, contact details, medical consultation reasons, treatment progress, uploaded pre-procedure photos, appointment times, actual procedures performed, and payment information. Approximately 160,000 South Korean users and 60,000 overseas users were impacted, including 481 from mainland China, 4,218 from Taiwan, and others from Japan and Thailand. Attackers exploited weak authentication and rate limiting on the API, first detected on September 4, with a second attempt on a different path the following day. The breach raises risks of targeted phishing and extortion using victims' private medical images and records. Healing Paper has reported the incident to authorities, implemented enhanced authentication and monitoring, and allowed users to check their exposure status within 30 days.
Liquid Network Federation Wallet Drained of 4000 BTC in Alleged White-Hat Exploit Exposing L-BTC Minting Flaw
On September 7, the Liquid Network sidechain suffered a major incident where its Federation wallet lost approximately 4000 Bitcoin, worth around $320 million or 2.1 billion RMB, leaving only 200 BTC behind. The funds were moved through the authorized SideSwap settlement platform using PAK keys without any reported key compromise. Liquid officials described the actor as a claimed white-hat hacker intending to return assets for a fee, but security experts point to a critical vulnerability allowing unauthorized L-BTC minting that could bypass the 1:1 Bitcoin backing mechanism. The network has halted all new transactions while federation members work on remediation, affecting major platforms including BTSE, Bitfinex, and BitMEX. This event aligns with a broader 2026 trend where attackers target protocol-level asset issuance rather than individual keys, as seen in recent Coldcard RNG flaws and other incidents totaling $972 million in crypto thefts. The case underscores weaknesses in multi-signature federation validation and cross-chain anchoring that go beyond traditional smart contract bugs.
Widespread AI Outage Exposes Fragile Cloud Dependencies Behind ChatGPT, Claude and Grok
On September 3, major AI services including ChatGPT, Claude, Grok, Copilot and Gemini suffered a simultaneous outage lasting nearly four hours. The incident began around 9:30 a.m. ET with ChatGPT and rapidly spread, generating over 12,000 reports on Downdetector within twenty minutes. Industry analysis points to underlying cloud infrastructure rather than the models themselves, with Microsoft Azure and Cloudflare identified as the most likely points of failure. Developers relying on tools such as Cursor experienced immediate loss of code completion and intelligent assistance, forcing manual workflows. The event highlighted single points of failure created by heavy concentration of AI workloads on a small number of cloud providers. Security professionals are urged to map AI supply chains, prepare fallback procedures, monitor infrastructure status pages and adopt multi-vendor routing for critical operations.
From Spanish sources
Translated from Spanish
Critical Unauthenticated File Upload Flaw in WooCommerce Wholesale Lead Capture Enables Active PHP Web Shell Attacks
A critical vulnerability tracked as CVE-2026-27540 affects WooCommerce Wholesale Lead Capture versions 2.0.3.1 and earlier, allowing unauthenticated attackers to upload arbitrary files including PHP web shells. The flaw resides in the wwlc_file_upload_handler AJAX action, where the file extension allowlist can be manipulated through the file_settings parameter to accept .php files. Exploitation has been observed in the wild with more than 100,000 blocked attempts since June 2026, including sustained campaigns from repeat IP addresses. The developer released version 2.0.3.2 on 20 February 2026 to address the issue, yet many sites remain unpatched. Organizations are advised to update immediately, audit wp-content/uploads for unexpected PHP files, and monitor admin-ajax.php requests for suspicious activity. In confirmed compromise cases, full remediation requires credential rotation and restoration from verified backups.
Twitch Enhanced Viewer Extension Leaks OAuth Tokens From Nearly 31,000 Users
The browser extension Twitch Enhanced Viewer | JeetBot, available in the official Chrome Web Store and Mozilla Add-ons, secretly forwarded OAuth session tokens to proxies controlled by its operator. These bearer tokens allow full account takeover without passwords or second-factor authentication, enabling actions such as reading and sending whispers, posting in chat, and modifying account settings. The issue surfaced prominently in the v85.x branch where tokens were appended as the &auth= query parameter during network redirects to operator-controlled proxy servers, exposing them in clear text within proxy logs. Earlier v4.x versions had already transmitted tokens via POST requests to a set-token endpoint and backup servers on deno.dev and deno.net. A fix appeared in Firefox version 85.8.7 that stops token exfiltration by altering playlist retrieval, while a Chrome patch is in preparation. Users are advised to uninstall the extension immediately, revoke all active Twitch sessions, and review recent account activity for signs of unauthorized use.
Twitch Enhanced Viewer Extension Leaks OAuth Tokens from Nearly 31,000 Users
The browser extension Twitch Enhanced Viewer | JeetBot, available in the official Chrome Web Store and Mozilla Add-ons, secretly forwarded OAuth session tokens to proxies controlled by its operator. These bearer tokens allow full account takeover without passwords or second-factor authentication, enabling actions such as reading and sending whispers, posting in chat, and modifying account settings. The issue became especially severe in the v85.x branch, where tokens were appended as the &auth= query parameter during network redirects to the operator’s proxy servers, exposing them in clear text within proxy logs. Earlier versions had already transmitted tokens via POST requests to a set-token endpoint and maintained backup endpoints on deno.dev and deno.net. A fix is available in Firefox starting with version 85.8.7, which stops token exfiltration by changing the playlist retrieval method, while a corresponding Chrome patch is in preparation. Users are advised to uninstall the extension immediately, revoke all active Twitch sessions, and review recent account activity for signs of unauthorized use.
Attackers Chain JFrog Artifactory CVEs for Rapid Admin Takeover and Backdoor Deployment
Real-world attacks against self-hosted JFrog Artifactory have chained multiple CVEs to escalate from unauthenticated requests to full administrative control. Attackers achieved persistence by installing malicious Groovy plugins, executing shell commands, and deploying Rust-based backdoors within minutes. The primary chain relies on CVE-2026-42018 and CVE-2026-42016, allowing anonymous token acquisition and privilege escalation without proper scope validation. A separate critical flaw, CVE-2026-82329 with CVSS 9.8, enables direct authentication bypass and admin token creation on default configurations. Patches are available across multiple 7.x branches, and defenders are urged to audit logs for anonymous admin actions and inspect for unauthorized plugins and binaries. The incidents highlight risks to software supply chains when artifact repositories are compromised.
Trezor Warns of Email Provider Breach Used in Targeted Phishing Campaign Against Hardware Wallet Users
Trezor has disclosed that attackers compromised an external email provider and leveraged it to send phishing messages that appeared to originate from the company. The emails carried the subject line 'Critical Security Alert: STM32 Entropy Vulnerability' and falsely claimed a hardware flaw in STM32 microcontrollers that would reduce entropy and allow seed phrase reconstruction. No such CVE exists, and the campaign followed classic social-engineering patterns of urgency and brand impersonation aimed at stealing recovery phrases. Trezor has since disabled the malicious domain and continues investigating how the provider was accessed. Similar messages may have reached users of BitBox, suggesting possible compromise of shared service providers across the hardware wallet ecosystem. The incident underscores the difficulty of detecting phishing when it originates from legitimate third-party infrastructure.
Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)
Google has released an urgent update for Chrome to address CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript engine that is being actively exploited in the wild. The flaw is a type confusion issue within the Maglev compiler, specifically tied to optimizations around Array.prototype.sort, which can lead to arbitrary memory read and write primitives inside the JavaScript heap. Attackers can exploit the vulnerability by tricking victims into visiting a specially crafted HTML page, enabling remote code execution within the browser sandbox. The update brings Chrome to version 152.0.7977.82 or higher on Windows, macOS, and Linux, while also addressing a total of 12 vulnerabilities. The issue was reported by researcher Salvatore Gulizia, known as Serotav, who received a $1,000 reward. Other Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi will require corresponding updates from their vendors.