AI Safety Guidelines: 10 Essential Rules to Protect Data, Finances, and Reputation When Working with LLMs
A detailed analysis of emerging AI-related security risks highlights how large language models can autonomously execute attack chains, fall victim to prompt injection, and cause cascading errors in complex workflows. The article examines real-world incidents such as the Anthropic vending machine pricing failure, the Meta Instagram account takeover via overly helpful AI support, and Copilot Studio data leaks through prompt injection. It emphasizes that while attack methods themselves are not revolutionary, AI agents can now scale them at machine speed with autonomous decision-making and recovery capabilities. The piece provides ten concrete safety rules covering financial controls, fact verification, data confidentiality, context pollution prevention, and access limitation. It also stresses that ultimate responsibility always remains with the human operator, not the AI system.
Translated from Russian
Read full articleLatest News
Detecting Lateral Movement with Neural Networks Trained Solely on Synthetic Data
A researcher generated entire corporate network histories using a 135-line configuration file to create synthetic authentication logs containing lateral movement attacks. Neural networks trained exclusively on these artificial datasets were then evaluated against 1.65 billion real authentication events from Los Alamos National Laboratory, including 749 red team events across 301 compromised machines. The best ensemble of six models flagged 3.6 million hourly machine windows and placed 16 genuine attacks among the top 23 highest-scoring entries, producing only seven false positives. In comparison, a simple threshold counter required 161,000 false alarms to reach the same detection level. The approach also demonstrated an iterative feedback loop where detector errors directly informed refinements to the synthetic world generator. The work shows that synthetic data can reach AUC performance comparable to models trained on real labeled attacks while providing full control over the underlying attack definitions.
Translated from Russian
Unauthorized Access to Japan's Government Solution Service (GSS) Exposes 246,000 Personal Records via VPN Flaw
Japan's Digital Agency confirmed that its Government Solution Service (GSS) suffered unauthorized access after attackers exploited a vulnerability in VPN equipment used for external maintenance operations. The intrusion, believed to have begun in late May 2026, allowed threat actors to compromise maintenance accounts and access large volumes of files on internal servers. On June 25, 2026, security teams detected suspicious access to numerous files using a compromised account, prompting an investigation that concluded on July 9 with confirmation of the breach. Some files containing personal information may have been exfiltrated, affecting approximately 246,000 records of government officials, civil servants, contractors, and related individuals. The agency immediately disabled the affected accounts and severed external communications on July 9 but has not disclosed technical details of the exploited VPN vulnerability. The incident was reported by Security NEXT on September 11, 2026.
Translated from Japanese
Exploiting CVE-2025-55182 React2Shell Vulnerability on Hack The Box Reactor Machine
A detailed walkthrough demonstrates remote code execution against a seasonal Hack The Box machine named Reactor by abusing the critical Next.js deserialization flaw CVE-2025-55182, also known as React2Shell. The attack begins with Nmap reconnaissance revealing an exposed Next.js service on port 3000, followed by Wappalyzer identification of an outdated framework version. Public exploit code is used to obtain an initial reverse shell as the node user without authentication. Credential access is achieved by extracting password hashes from the reactor.db SQLite database and cracking the engineer account with Hashcat against rockyou.txt. Privilege escalation leverages an exposed Node.js Inspector debug port on 9229, allowing WebSocket interaction via websocat to set the SUID bit on /bin/bash and obtain root access. The article highlights both the impact of the unauthenticated RCE vulnerability and common misconfigurations such as forgotten debug ports on production systems.
Translated from Russian
CISA Adds MikroTik RouterOS Flaws CVE-2026-67277 and CVE-2026-86060 to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities in MikroTik RouterOS to its Known Exploited Vulnerabilities Catalog. CVE-2026-86060 stems from improper sanitization of command argument delimiters and can lead to privilege escalation after an attacker gains access to the SSH login helper and alters trusted policy masks. CVE-2026-67277 involves missing authentication checks in critical RouterOS functions, allowing connections before authentication completes and potentially leaking kernel memory or causing denial-of-service conditions. CISA directed US federal agencies to apply mitigations by September 13 and specifically investigate any signs of compromise related to CVE-2026-86060. The agency noted that the flaws carry broader exploitation risk and urged all organizations using affected MikroTik products to take immediate action.
Translated from Japanese
BI.ZONE Mail Security 3.0 Enhances Detection of Password-Protected Archives and Spam Variants
BI.ZONE has released Mail Security 3.0, introducing new mechanisms to detect email threats and improved tools for administrators. The updated system now assigns additional risk scores to password-protected archives when their contents cannot be unpacked, without automatically classifying the archive itself as malicious. It also compares message texts to identify near-identical emails used in spam campaigns where attackers slightly alter wording to evade filters. Administrators can now incorporate SPF and DKIM verification results into delivery rules to better distinguish legitimate senders from impersonators. According to BI.ZONE statistics, phishing accounted for 90 percent of illegitimate email traffic in the first half of 2026. Additional protections include CAPTCHA challenges after repeated failed login attempts on administrative accounts. The release also adds bulk management of rules, improved logging with a side panel for message details, a new Events section, and Syslog export to external SIEM systems.
Translated from Russian
The Birth of CVE: How Two MITRE Engineers Built the Universal Vulnerability Identifier in 1999
In the late 1990s, security teams faced chaos with one vulnerability carrying dozens of incompatible names across scanners, IDS tools, and CERT advisories. Two MITRE engineers, David E. Mann and Steven M. Christey, proposed a minimal Common Vulnerabilities and Exposures list to solve correlation problems without imposing taxonomy or risk models. Their January 1999 paper led to a Purdue workshop, the formation of the CVE Editorial Board, and a public launch on September 29, 1999, with 321 initial entries. The design deliberately avoided ownership by any vendor and kept names as simple CVE-year-number strings. This neutral, open approach allowed competing vendors to map their proprietary databases to a shared reference without agreeing on classifications. The same minimalist philosophy later influenced NVD, OSV, and GitHub Advisory Database.
Translated from Russian
Amnezia VPN Survives Coordinated Russian Censorship Campaign Targeting AmneziaWG Protocol Fingerprints
Amnezia VPN has published a detailed post-mortem on the multi-wave blocking campaign conducted by Russian authorities against its Amnezia Free and Amnezia Premium services during June and July. The company describes a shift from simple protocol blocking to sophisticated fingerprinting of AmneziaWG traffic combined with infrastructure DDoS attacks and automated IP-subnet blacklisting. Engineers closed multiple detection vectors including zero-length UDP packets, fixed-size keepalive messages, handshake timing patterns, and nonce zero bytes. The incident forced accelerated migration to AmneziaWG 2.0, discontinuation of legacy client support, and development of AmneziaWG 3.0 while expanding VLESS infrastructure as a backup. Self-hosted users largely avoided direct protocol blocks but still faced subnet-level restrictions. The report highlights how Roskomnadzor now applies cumulative scoring across multiple traffic features rather than single definitive markers.
Translated from Russian
OnePlus 13R Preinstalled Account App Leaks Cloud Session Tokens to Any App Declaring Required Permission
Researchers at Doyensec identified a vulnerability in the preinstalled com.oneplus.account application on the OnePlus 13R that allows any third-party app to steal a valid OnePlus Cloud session token. The flaw stems from the OPAccountProvider component lacking the protectionLevel="signature" attribute on its declared permission com.oneplus.account.READ_ACCOUNT_INFO, enabling any app to request the permission and query the provider directly. Once obtained, the token grants access to OnePlus Cloud APIs without further user interaction or warnings. Doyensec responsibly disclosed the issue on 30 December 2025, leading OnePlus to acknowledge the high-severity problem and pay a $720 bounty in March 2026. Follow-up testing in September on firmware CPH2691_16.0.10.500(EX01) confirmed the token leakage persists, although full account takeover via the regional API was no longer reproducible for US and EMEA accounts due to backend changes. Users are advised to avoid untrusted apps and apply future updates, while OnePlus needs only to add the signature protection level to close the exposure.
Translated from Russian
F6 and MAX Neutralize Over 2,550 External Phishing and Scam Resources in Two-Month Operation
F6 and the MAX messenger have jointly blocked more than 2,550 malicious external websites used for phishing, scams, and other forms of online fraud. The effort relied on the F6 Digital Risk Protection platform, which continuously scans for fake authentication pages and fraudulent resources targeting users. Monitoring took place during July and August 2026, after which experts from both organizations arranged for the sites to be taken down. The action focused exclusively on external resources and did not involve any malicious content hosted inside the MAX messenger itself. F6 Digital Risk Protection head Stanislav Goncharov noted that regular takedowns can reduce attacker activity over time, yet users must still verify website addresses manually before entering credentials or payment data.
Translated from Russian
From Russian sources
Translated from Russian
Data Masking: 8 Critical Questions Businesses and Developers Ask About Protecting Sensitive Data
Garda expert Dmitry Larin addresses common challenges in data masking during a recent webinar titled 'Data Masking: Battle of Opinions'. The discussion covers why masking remains essential even when encryption is deployed, how to preserve application functionality after anonymization, and the performance trade-offs of processing large databases such as 5 TB PostgreSQL instances. Different masking types including static, dynamic, selective, and streaming are explained with specific use cases for DevOps pipelines, external contractors, and BI systems. The article also examines why machine learning alone is insufficient for discovering personal data and why custom scripts fail at scale across heterogeneous environments like PostgreSQL and Oracle. Practical recommendations include combining masking with encryption, using deterministic transformations for deduplication, and separating replication from masking tasks to avoid production impact.
Smartphone Spyware: How Devices Collect and Exfiltrate Data Even Without Internet Access
Modern smartphones continue gathering sensor data including microphone, camera, gyroscope, and satellite navigation even when Wi-Fi and mobile data are disabled. Information is stored locally and transmitted only when connectivity is restored. The Find My Device feature from Google and Find My from Apple allow location reporting for hours after the device is powered off via a separate Bluetooth chip. In August 2026, ThreatFabric disclosed the Manic trojan that uses Wi-Fi Direct, Bluetooth RFCOMM, and BLE GATT to relay encrypted data through nearby infected devices when direct internet access is unavailable. The malware supports multi-hop routing of up to four intermediate devices. Everyday users face greater risk from over-privileged applications and pre-installed malware on gray-market devices than from sophisticated offline exfiltration techniques. A detailed checklist covers purchase hygiene, permission audits, and recovery steps after suspected compromise.
Check Point Research Uncovers Cross-Session Command Channel in ChatGPT via JFrog Artifactory
Researchers at Check Point Research identified a covert channel that allowed commands to be passed between isolated ChatGPT sessions belonging to different user accounts. The channel exploited an internal JFrog Artifactory instance used by ChatGPT containers for package installation, enabling containers to read and write repository metadata that effectively served as a shared buffer. Attackers could inject malicious instructions into a victim's context through copied prompts, shared conversations, or custom GPTs, causing the assistant to execute hidden tasks while returning normal responses. In a demonstration, ChatGPT silently retrieved data from a connected Gmail account and forwarded it to the attacker's account. The technique potentially exposed chat history, uploaded files, and data from connected services including Google Drive, Microsoft Teams, and GitHub. OpenAI confirmed the affected Artifactory instance has been decommissioned, eliminating the channel, with no evidence of real-world exploitation reported.
IT Elements 2026 Conference: Ransomware Accounts for 69% of Incidents as Businesses Struggle with Backup Protection and AI Workloads
The fourth IT Elements conference opened in Moscow on September 9, focusing on business continuity after cyberattacks, infrastructure failures, and ransomware incidents. Jet CSIRT data showed that ransomware was responsible for 69% of confirmed incidents in the first half of 2026, with the majority occurring in the second quarter. Experts discussed the challenges of protecting backup copies from compromise, the frequent gap between stated RTO targets and real-world recovery times, and decision-making processes during major outages. The event also covered corporate AI agents, stressing the need for strong Data Governance, Data Quality, and DataOps practices to avoid unreliable model outputs. Research from Jet Infosystems and AC IKS revealed that over 30% of companies have already allocated dedicated network segments for AI workloads, with power demands reaching 80-200 kW per rack. On the networking track, testing of Eltex and EcoRouter devices showed adequate performance in standard scenarios but highlighted the lack of a universal domestic solution. The conference concluded with discussions on workforce changes, noting that AI is altering career paths for junior specialists and increasing demand for professionals who understand business context and can critically evaluate model results.
Stop Asking If an AI Skill Is Safe โ Ask What It Can Do Instead
A detailed analysis warns that AI agent skills distributed as simple text files can execute malicious commands with full user privileges. The article examines how prompt injection attacks embedded in skill.md files have already led to credential theft and persistent malware that survives system restores. Research by Snyk on 3984 public skills found that 36.8 percent contained at least one security issue and 13.4 percent had critical flaws. The author argues that traditional security badges are ineffective because skills can dynamically load payloads, target reviewers with injection, or change after initial review. Instead, a new tiered system called skill-xray classifies capabilities from inert text (T0) to runtime code loading (T4) and binds results to content hashes. The approach is implemented in an open-source MIT-licensed tool that combines static regex scanning with agent-based reporting to surface risks without issuing false safety guarantees.
Ideco NGFW Novum v23 Adds Shadow AI Discovery, Dynamic Routing and QoS Controls
Ideco has released NGFW Novum v23, introducing detection for 83 AI application protocols including ChatGPT, Claude, DeepSeek, GigaChat and YandexGPT. The update enables organizations to identify Shadow AI usage across networks without mandatory TLS decryption and adds new content-filter categories for AI agents and AI services. Enterprise routing capabilities have been expanded with Prefix lists, Route maps, OSPF zones, BGP aggregation and BFD profiles to support large distributed environments. Additional features include internal Virtual Ethernet and Virtual Switch interfaces for VCE connectivity, QoS traffic prioritization, MTU/MSS tuning for IPsec, certificate-based authentication in Ideco Client and detection of tunneled traffic inside SSH and TLS sessions. The release positions the NGFW as the first layer of an emerging AI Security Layer that combines discovery, policy enforcement and future LLM proxy controls.
From Japanese sources
Translated from Japanese
CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog Including Cisco FMC and Fortinet FortiOS
The US Cybersecurity and Infrastructure Security Agency has added four vulnerabilities to its Known Exploited Vulnerabilities catalog, warning that they are being actively exploited in the wild. The flaws affect Cisco Secure Firewall Management Center, Security Cloud Control, Fortinet FortiOS, FortiSwitchManager, and Citrix NetScaler products. One vulnerability allows attackers to bypass authentication and gain root privileges through crafted HTTP requests. Another is a heap-based buffer overflow that enables execution of unauthorized code or commands via specially crafted packets. CISA issued the update on September 9, 2026, urging organizations to apply patches immediately. The agency continues to track these issues as part of its ongoing efforts to mitigate real-world threats.
Critical RCE Vulnerabilities Disclosed in Check Point VPN Implementations
Check Point Software Technologies has disclosed multiple critical remote code execution vulnerabilities affecting its Quantum Security Gateway and related VPN components. The issues, tracked as CVE-2026-85102 and CVE-2026-85103, both carry a CVSS v3.1 base score of 9.8 and require no authentication for exploitation under specific conditions. CVE-2026-85102 stems from insufficient certificate validation during VPN negotiation in Remote Access VPN and Site-to-Site VPN setups, allowing attackers to bypass authentication and execute arbitrary code. CVE-2026-85103 involves a heap-based buffer overflow in ASN.1 decoding of VPN certificates, similarly enabling unauthenticated remote code execution. The vendor released a security advisory on September 9, 2026, along with live patches through Check Point Live Patch and official updates for affected products including Quantum Security Management.
Google Releases Chrome 153 Fixing 230 Vulnerabilities Including Zero-Day Exploit
Google has released Chrome 153 for Windows, macOS, and Linux, addressing a total of 230 security vulnerabilities. The update includes fixes for five critical-severity issues and one confirmed zero-day vulnerability already exploited in the wild. Among the critical flaws are use-after-free bugs in WebGL tracked as CVE-2026-87464 and CVE-2026-87488, an out-of-bounds write CVE-2026-87438, a buffer overflow CVE-2026-87527, and a use-after-free in the Cast component identified as CVE-2026-87628. A medium-severity out-of-bounds write in the V8 JavaScript engine, CVE-2026-87491, was reported on August 6, 2026 and has seen active exploitation. The company is rolling out the patches gradually over the coming days and weeks across all supported platforms.
Microsoft Addresses 973 Vulnerabilities in September Security Update
Microsoft released its monthly security updates on September 8, 2026, fixing 973 vulnerabilities tracked by CVE identifiers. The release coincided with Patch Tuesday and also resolved four third-party software flaws. Affected products span Windows, Office, SQL Server, Azure, Microsoft Dynamics, SharePoint Server, and various development tools. Among the issues, 258 allow remote code execution and 438 enable privilege escalation. A total of 113 vulnerabilities received the highest severity rating of Critical, while the remaining 860 were rated Important. Several of the flaws have already been observed in active exploitation.
Adobe Issues Critical Security Updates for ColdFusion Fixing Nine CVEs Including Eval Injection Flaws
Adobe has released security updates for Adobe ColdFusion to address nine vulnerabilities, urging users to apply the patches immediately. The update coincides with Patch Tuesday on September 8, 2026, and covers issues such as Eval injection, SQL injection, cross-site scripting, and access control weaknesses. Six of the vulnerabilities are rated Critical, with the highest CVSS v3.1 base score reaching 9.9 for CVE-2026-48273. The remaining three vulnerabilities are classified as Important. Adobe ColdFusion users are advised to update without delay to mitigate risks of code injection and unauthorized access. The advisory also references related security issues in other products including Canva, BIG-IP, and Dell SCG.
N-able Releases Hotfix 4 for Critical N-central RCE Flaw CVE-2026-86218 Now Confirmed Exploited
N-able disclosed a critical vulnerability in its N-central IT operations management platform that allows unauthenticated remote code execution on affected servers. The flaw, tracked as CVE-2026-86218, received the maximum CVSSv4.0 base score of 10.0 and is rated Critical. The company published security advisory information on September 5, 2026, and quickly followed with Hotfix 4 (version 2026.3.1.14) that resolves the issue. Although exploitation was not observed at disclosure, N-able updated the advisory the next day to confirm active exploitation in the wild. The vendor urges customers to apply the hotfix immediately and to monitor for suspicious account creation and scanning activity from specific IP addresses. Earlier hotfixes addressing CVE-2026-86206 and CVE-2026-86207 were superseded by the new release.
From Portuguese sources
Translated from Portuguese
Microsoft Fixes Remote Code Execution Flaw in Windows Remote Desktop Client
Microsoft has addressed a remote code execution vulnerability in the Windows Remote Desktop Client tracked as CVE-2026-69485 with a CVSS score of 8.8. The flaw stems from the use of an uninitialized resource and can be triggered by a specially crafted network request from an authenticated attacker with low privileges. Exploitation requires no user interaction such as clicking links or opening files and can lead to information disclosure, file modification, or service disruption. Multiple versions of Windows 10, Windows 11, and Windows Server 2016 through 2025 are affected, including Server Core installations. The issue was not publicly disclosed prior to patching and no active exploitation has been observed. Fixes were released in the September security updates including KB5124008 and KB5122871.
US Accuses Chinese AI Companies of Industrial-Scale Model Distillation Targeting Claude, GPT, Gemini and Grok
US agencies have accused six Chinese artificial intelligence firms of conducting large-scale unauthorized distillation operations to replicate advanced capabilities from leading models including Claude, GPT, Gemini, and Grok. The activity is reported to have begun at least by late 2024 and involved DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. Billions of tokens were extracted through millions of automated API requests routed via cloud providers, aggregators, and proxies to conceal origins and evade detection. The targeted capabilities included chain-of-thought reasoning, programming, software engineering, autonomous agent functions, and multimodal processing. Shared premium accounts and bulk subscriptions were used to lower costs while automated route-switching systems helped maintain access after blocks. Authorities assess that the sophistication and volume indicate distillation has become a core development method for these companies and likely occurred with Chinese government awareness. China has rejected the claims, stating its AI progress stems from independent innovation and calling the allegations unfounded.
US Offers $10 Million Reward for Iranian IRGC Cyber Commander Amir Yaryab
The United States has announced a reward of up to $10 million through the Rewards for Justice program for information leading to the identification or location of Amir Yaryab, leader of the Cyber Operations Command within Iran's Islamic Revolutionary Guard Corps (IRGC). Yaryab oversees units responsible for cyber operations targeting critical infrastructure across the United States, Europe, and the Middle East. Groups under his direction, including Shahid Hemmat and Shahid Shushtari, have conducted campaigns against defense, energy, telecommunications, finance, transportation, hotels, and airlines sectors. He is also linked to structures associated with the CyberAv3ngers group, known for attacks on industrial control systems and operational technology equipment. Previous operations attributed to IRGC-linked actors compromised internet-exposed Unitronics programmable logic controllers, affecting at least 75 devices between November 2023 and January 2024, including 34 in the US water and wastewater sector. The reward specifically targets individuals acting under foreign government direction in malicious cyber activities against US critical infrastructure.
AI Detection Agents Shift Cybersecurity from Alerts to Autonomous Investigations
AI-powered detection agents are redefining how organizations identify and respond to cyber threats by moving beyond simple signature matching and alert generation. Instead of forwarding isolated events to human teams, these agents now perform initial investigations themselves, correlating telemetry from multiple sources and reconstructing attack chains before escalating any incident. The technology has progressed from theoretical discussions to active budget conversations, forcing security teams to evaluate how much triage work can be handled autonomously. Traditional monitoring systems deliver chronological events and leave analysts to connect the dots manually, while the new agents handle correlation, timeline verification, and scope assessment upfront. Attack automation has increased the urgency, as malicious actions can now produce effects faster than human analysis can complete. The agents collect artifacts, review asset history, check for repeated behavior, and determine the real impact, redistributing analyst workload without removing the need for human judgment on business impact and response decisions.
Critical ASUS Control Center Enterprise Flaw Allows Remote Root Access via CVE-2026-75754
A critical vulnerability identified as CVE-2026-75754 in ASUS Control Center Enterprise (ACC) carries a maximum CVSS score of 10.0 and enables unauthenticated remote attackers to gain full control of the management server and all connected devices. The flaw stems from a combination of missing authentication on a critical function, a server-side request forgery (SSRF) issue, and hardcoded credentials embedded directly in the software. Attackers can craft a malicious HTTP request to extract the systemโs encryption key, activate an SSH service on TCP port 2222, and use fixed credentials to obtain a root shell without any user interaction. Once inside, the attacker can read, modify, or delete data stored in the ACC platform and propagate the compromise across managed servers, PCs, and workstations. All versions of ASUS Control Center Enterprise through 4.0.0.2 are affected. ASUS released a security advisory on September 4, 2026, urging immediate updates to mitigate the risk.
Critical Zero-Day 'StyleSmuggler' Vulnerability Exploited in Adobe Commerce and Magento
A zero-day vulnerability dubbed StyleSmuggler is being actively exploited in Magento Open Source and Adobe Commerce to achieve unauthenticated remote code execution and install backdoors on e-commerce servers. The flaw allows attackers to inject malicious PHP code into files generated by the platform and then force the template system to process it, with the attack chain triggered during the generation of default transaction failure emails. Exploitation has been observed since September 4 and works even if the email is not successfully sent. Researchers have reproduced the attack on clean installations of versions 2.4.7, 2.4.8, and 2.4.9, as well as on a fully patched Magento 2.4.6-p15 system. After compromise, a Rust-based implant is deployed outside the store directory, masquerading as the process [kworker/u:8:0] and maintained via a cron job that restarts it every five minutes. As of September 6, Adobe had not released a CVE, official patch, or specific workaround, though the next scheduled security update is set for September 8.
From Chinese sources
Translated from Chinese
South Korean Medical Beauty Platform Gangnam Unni Suffers API Breach Exposing 220,000 Users' Sensitive Photos and Medical Records
Healing Paper, operator of South Korea's largest medical beauty information platform Gangnam Unni, confirmed a data breach affecting nearly 220,000 customers after an API endpoint used to query consultation records was abnormally accessed. The incident exposed highly sensitive personal information including names, contact details, medical consultation reasons, treatment progress, uploaded pre-procedure photos, appointment times, actual procedures performed, and payment information. Approximately 160,000 South Korean users and 60,000 overseas users were impacted, including 481 from mainland China, 4,218 from Taiwan, and others from Japan and Thailand. Attackers exploited weak authentication and rate limiting on the API, first detected on September 4, with a second attempt on a different path the following day. The breach raises risks of targeted phishing and extortion using victims' private medical images and records. Healing Paper has reported the incident to authorities, implemented enhanced authentication and monitoring, and allowed users to check their exposure status within 30 days.
Liquid Network Federation Wallet Drained of 4000 BTC in Alleged White-Hat Exploit Exposing L-BTC Minting Flaw
On September 7, the Liquid Network sidechain suffered a major incident where its Federation wallet lost approximately 4000 Bitcoin, worth around $320 million or 2.1 billion RMB, leaving only 200 BTC behind. The funds were moved through the authorized SideSwap settlement platform using PAK keys without any reported key compromise. Liquid officials described the actor as a claimed white-hat hacker intending to return assets for a fee, but security experts point to a critical vulnerability allowing unauthorized L-BTC minting that could bypass the 1:1 Bitcoin backing mechanism. The network has halted all new transactions while federation members work on remediation, affecting major platforms including BTSE, Bitfinex, and BitMEX. This event aligns with a broader 2026 trend where attackers target protocol-level asset issuance rather than individual keys, as seen in recent Coldcard RNG flaws and other incidents totaling $972 million in crypto thefts. The case underscores weaknesses in multi-signature federation validation and cross-chain anchoring that go beyond traditional smart contract bugs.
Widespread AI Outage Exposes Fragile Cloud Dependencies Behind ChatGPT, Claude and Grok
On September 3, major AI services including ChatGPT, Claude, Grok, Copilot and Gemini suffered a simultaneous outage lasting nearly four hours. The incident began around 9:30 a.m. ET with ChatGPT and rapidly spread, generating over 12,000 reports on Downdetector within twenty minutes. Industry analysis points to underlying cloud infrastructure rather than the models themselves, with Microsoft Azure and Cloudflare identified as the most likely points of failure. Developers relying on tools such as Cursor experienced immediate loss of code completion and intelligent assistance, forcing manual workflows. The event highlighted single points of failure created by heavy concentration of AI workloads on a small number of cloud providers. Security professionals are urged to map AI supply chains, prepare fallback procedures, monitor infrastructure status pages and adopt multi-vendor routing for critical operations.
CISA Adds Seven Actively Exploited Vulnerabilities to KEV Catalog, Including SonicWall and LiteLLM Flaws Targeting AI Infrastructure
CISA has added seven vulnerabilities confirmed to be exploited in the wild to its Known Exploited Vulnerabilities catalog, with two carrying CVSS scores of 10.0. The list includes critical issues in SonicWall SMA 1000 devices, JFrog Artifactory, Kestra workflow engine, and LiteLLM AI gateway components. Attackers are now systematically targeting AI infrastructure to steal large language model API keys and configuration data from databases such as LiteLLM_ProxyModelTable. Qilin ransomware operators have already chained LiteLLM flaws for remote code execution and data theft. CISA has set a 48-hour remediation deadline for federal agencies, underscoring the urgency for all organizations running these components.
Zhou Hongyi Warns AI Tools Are Industrializing Vulnerability Discovery
At the Fourth Cyberspace Security Forum in Tianjin, 360 founder Zhou Hongyi stated that vulnerability mining is shifting from artisanal workshops to automated production lines, compressing discovery cycles from months or years down to hours. AI tools such as Mythos are standardizing and automating the process, enabling attackers to replicate elite hacker expertise at scale through distilled models and agent swarms. 360's own Tulongfeng platform has already discovered over 10,000 vulnerabilities since its June release, including long-hidden high-risk flaws in Windows, Office, OpenClaw, Flowise, and Codex. The emergence of multi-agent systems introduces new attack surfaces because compromised agents can autonomously collaborate and move laterally faster than human operators. Zhou described this as the "second one-way transparency," where offensive tradecraft becomes copy-pasteable via prompts and toolchains. Defenders are advised to adopt "model-versus-model" strategies, automate vulnerability intelligence workflows with SOAR, enforce strict agent permission audits, and integrate AI into their own code review and detection engineering processes.
Anthropic Fable 5.1 System Prompt Fully Leaked Hours After Launch Exposing 275000 Characters of Rules
Anthropic released its flagship Fable 5.1 model alongside Mythos 5.1 on September 2, achieving strong benchmark scores including 90 percent on ARC-AGI-2. Within hours, researcher Pliny the Liberator published the complete 275000-character system prompt on GitHub, far exceeding the company's official 27000-word disclosure. The leaked document details 46 built-in tools, strict copyright restrictions, memory classification boundaries, and behavioral constraints that function as an internal employee handbook. The incident highlights that model weights remain the true core while prompt-based guardrails create an attack surface once mapped. It also reveals privacy rules that permanently exclude storage of minor identities, criminal records, and self-harm indicators even when users disclose them. The leak underscores the growing gap between vendor transparency claims and actual runtime instructions governing frontier AI systems.
From Spanish sources
Translated from Spanish
Trezor Warns of Email Provider Breach Used in Targeted Phishing Campaign Against Hardware Wallet Users
Trezor has disclosed that attackers compromised an external email provider and leveraged it to send phishing messages that appeared to originate from the company. The emails carried the subject line 'Critical Security Alert: STM32 Entropy Vulnerability' and falsely claimed a hardware flaw in STM32 microcontrollers that would reduce entropy and allow seed phrase reconstruction. No such CVE exists, and the campaign followed classic social-engineering patterns of urgency and brand impersonation aimed at stealing recovery phrases. Trezor has since disabled the malicious domain and continues investigating how the provider was accessed. Similar messages may have reached users of BitBox, suggesting possible compromise of shared service providers across the hardware wallet ecosystem. The incident underscores the difficulty of detecting phishing when it originates from legitimate third-party infrastructure.
Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)
Google has released an urgent update for Chrome to address CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript engine that is being actively exploited in the wild. The flaw is a type confusion issue within the Maglev compiler, specifically tied to optimizations around Array.prototype.sort, which can lead to arbitrary memory read and write primitives inside the JavaScript heap. Attackers can exploit the vulnerability by tricking victims into visiting a specially crafted HTML page, enabling remote code execution within the browser sandbox. The update brings Chrome to version 152.0.7977.82 or higher on Windows, macOS, and Linux, while also addressing a total of 12 vulnerabilities. The issue was reported by researcher Salvatore Gulizia, known as Serotav, who received a $1,000 reward. Other Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi will require corresponding updates from their vendors.
Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)
Google has released an urgent update for Chrome to address CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript and WebAssembly engine that is being actively exploited in the wild. The flaw is a type confusion issue tied to the Maglev compiler and optimizations around Array.prototype.sort, which can lead to arbitrary memory read and write primitives inside the JavaScript heap. Successful exploitation allows a remote attacker to execute arbitrary code within the browser sandbox after a victim visits a specially crafted HTML page, a technique commonly seen in malvertising and compromised-site campaigns. The fix is included in Chrome 152.0.7977.82 and later for Windows, macOS, and Linux, and the update also resolves a total of twelve vulnerabilities. The vulnerability was reported on 4 August 2026 by researcher Salvatore Gulizia, known as Serotav, who received a $1,000 reward. Other Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi will require corresponding updates from their respective vendors.
Attackers Exploit Critical JFrog Artifactory Flaw CVE-2026-82329 to Forge Admin Tokens and Poison CI/CD Pipelines
A critical vulnerability tracked as CVE-2026-82329 in JFrog Artifactory is being actively exploited in the wild, allowing unauthenticated attackers with network access to generate or forge administrator tokens on self-managed installations that retain default settings. The flaw enables full authentication bypass, granting attackers administrative privileges to enumerate users and groups, access sensitive configurations, read stored artifacts, and modify security settings. The greatest risk arises when Artifactory serves as the central repository for automated CI/CD pipelines, where an attacker can replace trusted internal packages, container images, or dependencies and propagate malicious changes downstream into build runners and production environments. JFrog has released patches for multiple branches, including versions 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20, although patching alone does not invalidate already-issued tokens. Organizations are advised to restrict network exposure, revoke and rotate admin tokens, review audit logs for anomalous token generation and configuration changes, and validate artifact integrity across the vulnerable period. The issue does not affect JFrog Cloud instances.
Critical JFrog Artifactory Flaw CVE-2026-82329 Actively Exploited to Forge Admin Tokens in Self-Managed Deployments
A critical vulnerability identified as CVE-2026-82329 in JFrog Artifactory is being actively exploited in the wild, enabling unauthenticated attackers to generate or forge administrator tokens simply by having network access to affected instances. The flaw impacts self-managed installations that retain default configurations, a common scenario when repositories are deployed quickly and later exposed to the internet. Once administrative access is obtained, attackers can enumerate users and groups, access sensitive configurations, read stored artifacts, and modify security settings. The most severe risk arises when Artifactory automatically feeds CI/CD pipelines, allowing malicious substitution of trusted packages, container images, or dependencies that then propagate downstream into production environments. JFrog Cloud instances were already protected, while self-managed deployments require updates to specific patched versions including 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. Even after patching, previously issued tokens must be revoked because their validity operates independently of the software update. Organizations are advised to restrict network exposure, rotate credentials, audit token generation logs, and validate artifact integrity for any material published during the vulnerable period.
Attackers Exploit Critical Sangoma Switchvox SQL Injection Flaw CVE-2026-9586 to Deploy Reverse Shells Without Credentials
A critical vulnerability in Sangoma Switchvox allows unauthenticated remote code execution through SQL injection in the /pa HTTP endpoint. The flaw, tracked as CVE-2026-9586 with a CVSS score of 9.3, affects internet-exposed VoIP deployments common in SMB environments. Attackers have already leveraged the issue in active campaigns since August 30, 2026, to open reverse shells and perform reconnaissance using Base64-encoded commands. The root cause is improper handling of the PhoneIP parameter in PostgreSQL queries, classified as CWE-89, which grants superuser database privileges. Sangoma released the fix in Switchvox 8.4.0.2 on July 14, 2026, following initial disclosure in April. Administrators are urged to patch immediately, restrict access, and monitor for indicators such as connections to 176.65.148.184 and suspicious entries in /var/log/switchvox/db-quirks.log.