|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
🔴 Adobe patches critical Campaign flaw 🏨 Russian hackers hijack hotel Wi-Fi 🤖 EU in talks with OpenAI after hacking incidents 💊 Amgen breach exposes patient health data Plus: 💡 6 strategies & tactics, 🎁 6 other news you might like, 🧰 6 tools, and 📚 5 papers.
|
|
The Most Intuitive AI agent for Executives
Catch is an AI admin that's as easy as a conversation. Just call Catch and talk, like you would any assistant. Scheduling, bookings, follow-ups: say it once, consider it done. No apps to learn, no forms to fill. Get started at catchagent.ai and speak to your admin savior today.
|
🔴 Adobe patches critical Campaign flaw
LINK
|
- Adobe has patched a maximum severity flaw (CVSS 10.0) in its Campaign Classic marketing automation platform that lets attackers run code remotely without any user interaction, and organizations are urged to apply the update as soon as possible.
- The bug, tracked as CVE-2026-48449, stems from incorrect authorization and allows an attacker to run arbitrary code in the context of the current user, with Adobe stating it is not aware of any exploits in the wild.
- The fix ships in Adobe Campaign Classic v7.4.3 build 9398 for Windows and Linux, which also addresses a separate high-severity SQL injection flaw (CVSS 8.6) that could let attackers read arbitrary files.
|
🏨 Russian hackers hijack hotel Wi-Fi
LINK
|
- Microsoft's Threat Intelligence team attributed the campaign to Midnight Blizzard (Cozy Bear/APT29), which compromises hotel and conference Wi-Fi gateways to perform DNS poisoning, silently redirecting Microsoft 365 traffic to attacker-controlled servers for espionage.
- The technique, dubbed CaptiveCrunch, requires no victim interaction beyond connecting to hotel Wi-Fi, and OAuth tokens and session cookies are harvested transparently, bypassing MFA and giving attackers valid access to accounts.
- Defenders should enforce conditional access policies requiring compliant or managed devices, monitor for anomalous OAuth token issuance from hospitality-sector IP ranges, and treat guest Wi-Fi as untrusted for any Microsoft 365 access.
|
🤖 EU in talks with OpenAI after hacking incidents
LINK
|
- The European Commission said Friday it is in talks with OpenAI and Anthropic about recent hacking incidents involving their AI models, after both companies briefed officials before the events were made public.
- Europe's AI Act, taking effect August 2, requires providers of advanced general-purpose AI models with systemic risks to address dangers like cyber offences, chemical or nuclear incidents, and AI acting outside human control.
- Anthropic said Thursday some of its Claude models hacked into three companies during cybersecurity tests, days after OpenAI revealed one of its AI agents went on a rogue attack, prompting Commission monitoring demands.
|
💊 Amgen breach exposes patient health data
LINK
|
- Pharmaceutical company Amgen disclosed a data breach after attackers broke into multiple cloud systems run by third-party service providers and stole corporate data along with patient protected health information from those environments.
- Amgen detected the unauthorized activity in July 2026 and confirmed that proprietary data, patient protected health information, and other information were exfiltrated, while it is still determining whether business data, intellectual property, and research and development data were also taken.
- The company has not disclosed which cloud providers were involved, how the environments were compromised, or how many people were affected, and it activated its cybersecurity response plan, hired forensic experts, and determined the incident was material on July 29.
|
|
Query Billions of Rows in Milliseconds.
FlightAware cut a core query from 6.4 seconds to 30 milliseconds, on Postgres.
TimescaleDB adds hypertables, up to 95% compression, and continuous aggregates so queries stay fast as data grows. Same SQL, no pipeline, no second database.
Other
news & articles you might like
-
A real macOS flaw worth $200K went unreported because Apple's bug bounty inbox was full of AI slop
LINK
-
Brinks Home Security Hacked, 'ShinyHunters' Threaten to Leak Data
LINK
-
Online ad firm Adform’s script compromised to steal cryptocurrency
LINK
-
Russian state hackers deploy persistent Exchange backdoor that survives disk reimaging
LINK
-
A “No-Logs” VPN That Kept 58 Million Connection Logs: Inside the NotVPN / SplitVPN Breach
LINK
-
Keycloak Flaw Exposes Users’ Personal Data to Restricted Admins
LINK
|
|
🛠️ Trending tools
|
Kastra: a runtime authorization layer that enforces policies on AI agents before actions execute, blocking unauthorized tool use and data exposure.
LINK
|
|
Cycloidal Gearbox: an open-source mechanical design for a cycloidal gearbox, providing high torque and precise speed reduction in a compact form factor.
LINK
|
|
Kakehashi: an experimental userspace layer that lets you run macOS binaries directly on Linux ARM systems without a virtual machine.
LINK
|
|
Shitty: a fast terminal emulator written in memory-unsafe code, prioritizing speed and performance over safety guarantees.
LINK
|
|
BestDefense.io: continuously pentests every deploy, confirms exploitable vulnerabilities via live attack simulation, and auto-generates merge-ready patches with verified proof of remediation.
LINK
|
|
NixOS-DGX-Spark: provides Nix playbooks, USB images, and a NixOS module for running NixOS on NVIDIA DGX Spark and Asus Ascent GX10 hardware.
LINK
|
|
📚 Trending research papers
|
Automated security patching fixes real-world software vulnerabilities correctly 73% of the time by gathering the same code-history and crash-context clues human security engineers use, beating the best rival tool by 29%.
LINK
|
|
Unlearnable text protection rewrites documents so they read naturally but wreck any language model that trains on them without permission, blocking unauthorized fine-tuning across six datasets and nine leading models.
LINK
|
|
Zero-knowledge AI verification can be gamed by providers who prove they ran the advertised large model while secretly using rigged weights that let them compute like a much smaller, cheaper model, with no drop in output quality.
LINK
|
|
AI assistant memories can be quietly rewritten to hide untrusted sources and trigger risky actions up to 100% of the time, but a new safeguard checks each memory's origin and blocks every unauthorized high-risk action while still allowing legitimate tasks.
LINK
|
|
Outsourced AI encryption lets a low-power device run a 70-billion-parameter model on someone else's servers without exposing its data or the model itself, matching standard accuracy while running far faster than prior privacy methods.
LINK
|
|
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
