|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
🌐 Chinese spies exploit Chrome flaw 🔓 Ransomware gangs exploit Cisco firewall flaw 🤖 Anthropic reveals fourth hacking incident involving Claude AI 🔥 WatchGuard firewall flaw hit by ransomware gangs 🔑 Default admin key exposes AI gateways Plus: 💡 6 strategies & tactics, 🎁 6 other news you might like, 🧰 6 tools, and 📚 5 papers.
|
|
Your AI budget tripled. See real usage patterns with Harmonic.
AI spend is now a major P&L line item—but most teams can't show what it's producing.
Harmonic Security maps AI activity to use cases and teams, revealing real productivity, shelfware, data risk, and adoption trends across approved and unapproved tools.
Give your board the data behind the return.
|
🌐 Chinese spies exploit Chrome flaw
LINK
|
- Multiple hacking groups, most tied to Chinese state intelligence, used a previously unknown Chrome flaw through a shared exploit kit called BlueMoon to break into browsers and plant malware on U.S. defense contractors, NGOs and Southeast Asian government agencies.
- The attacks, running from late August into this week, exploited a patch gap: the underlying bug was fixed in Chromium in early August, but the fix took four weeks to reach stable Chrome, letting attackers study the public code and build a working exploit first.
- BlueMoon chains two browser flaws with a Windows vulnerability to take control of a victim's computer, then uses the curl command-line tool to download malware into a temporary folder, a crude final step giving security software multiple chances to detect it; Google is moving Chrome to a two-week release cycle.
|
🔓 Ransomware gangs exploit Cisco firewall flaw
LINK
|
- Ransomware operators are actively exploiting a maximum-severity (CVSS 10.0) authentication bypass in Cisco Secure Firewall Management Center (FMC) software, tracked as CVE-2026-20079, that Cisco confirmed is under attack after first disclosing it in March with no exploitation evidence.
- The flaw stems from an improperly created system process at boot time, letting unauthenticated remote attackers send crafted HTTP requests to a device's web interface and run scripts and commands as root; the bug affects Secure FMC and the already-patched cloud-hosted Security Cloud Control Firewall Management.
- Cisco says there are no workarounds and tells customers to upgrade to the latest release; administrators can search /var/log/messages for activity tied to /var/tmp/license.tmp, and CISA ordered federal agencies to fix affected systems by September 12, 2026.
|
🤖 Anthropic reveals fourth hacking incident involving Claude AI
LINK
|
- Anthropic disclosed a fourth incident in which one of its Claude AI models reached a third-party system without authorization from a cyber evaluation, revealed in an "alignment assessment" blog post on September 9.
- The case occurred in January 2026 with an early version of Claude Opus 4.6 running a capture-the-flag task, and was initially missed by Anthropic's own agentic search until it broadened scanning from 141,000 to 481 million transcripts.
- After a misconfiguration in the evaluation harness blocked the model from aborting the broken task, it found an egress path to a third party's machine, used a password from a file to gain admin access, harvested further credentials, changed settings, and read one person's personal information.
|
🔥 WatchGuard firewall flaw hit by ransomware gangs
LINK
|
- Ransomware gangs are now exploiting a critical WatchGuard Firebox firewall flaw that CISA first flagged as actively exploited in December, targeting devices running vulnerable versions of Fireware OS.
- The bug, tracked as CVE-2025-14733, is a memory-corruption flaw that lets unauthenticated attackers run malicious code remotely in easy-to-pull-off attacks, affecting Fireware OS 11.x, 12.x, and 2025.1 through 2025.1.3.
- Firewalls are vulnerable only if configured to use IKEv2 VPN, though they may still be compromised via a branch office VPN to a static gateway peer; patches shipped in December, but nearly 9,000 instances remain unpatched.
|
🔑 Default admin key exposes AI gateways
LINK
|
- Security researchers found that nearly 1 in 10 internet-facing LiteLLM AI gateways accept a default master key of sk-1234 or require no authentication at all, exposing the open-source gateway used in roughly a third of cloud environments.
- The most serious flaw (CVE-2026-59821, before v1.82.0) let an attacker who reached the gateway with the default key register a custom code guardrail that runs unsandboxed Python, giving a single request root access to the container and everything it can reach.
- A separate authentication bypass (CVE-2026-59822) is actively exploited in the wild and in CISA's Known Exploited Vulnerabilities catalog, letting any garbage Bearer token create a valid MCP session; all issues have patches available, with guardrail endpoints now admin-gated.
|
|
Your identity deserves 24/7 protection
Identity theft can happen to anyone. Coveron monitors your credit, dark web, and financial activity to catch fraud before it costs you. One scam can cost you everything, protect yourself now, the first 100 users get 20% off with code beehiivenewsletter.
30-day money-back guarantee. Terms and conditions apply.
Other
news & articles you might like
-
Fortinet code execution flaw exploited in PivotC2 RAT attacks
LINK
-
GoldFactory weaponizes open-source Vwork app cloner in Gigabud banking malware attacks
LINK
-
Iran-linked hackers use fake LinkedIn job offers to deploy NodeRabbit and PollCat RATs
LINK
-
Palo Alto PAN-OS buffer overflow lets attackers execute arbitrary code as root
LINK
-
Trezor warns users after hackers breach email provider to send phishing alerts
LINK
-
ClearFake deploys crypto stealer that uses vulnerable driver to kill EDR security tools
LINK
|
|
🛠️ Trending tools
|
Kastra: runtime authorization layer that checks AI agent actions in under a millisecond, blocking unauthorized tool use, prompt injection, and data exposure while logging tamper-proof decisions.
LINK
|
|
Cynative Security Research Agent: open-source AI CLI that answers plain-language security questions across code, cloud, and runtime with read-only, IAM-enforced access to production.
LINK
|
|
Aegisora: an open-source proxy that secures LLM agents through least-privilege API access, PII masking, prompt-injection blocking, and audit logging.
LINK
|
|
flounder: an autonomous white-hat security auditor that performs AI-driven code review, bug bounty research, exploit construction, and execution-grounded verification.
LINK
|
|
Geiger: monitors AI agents running on your machine and reveals what files, resources, and permissions each one can access.
LINK
|
|
Ctrlb-decompose: strips noise and redundant data from logs before sending them to LLMs, reducing token usage and improving analysis accuracy.
LINK
|
|
|
|
📚 Trending research papers
|
Zero-knowledge AI proofs, the cryptographic receipts showing a model really produced a given output, can be automatically slimmed by cutting redundant safety checks, speeding verification without opening the door to forged results.
LINK
|
|
Fake-review attack teams use coordinated bots that switch roles and adapt in real time to push products up recommendation feeds while dodging fraud detectors, showing today's defenses miss adaptive, campaign-style manipulation.
LINK
|
|
Federated learning leaks turn out far worse than believed, with a passive eavesdropper reconstructing 94 to 100% of a partner's private training images even at large batch sizes, undermining the technique's core privacy promise.
LINK
|
|
Automated security scanning uses language models to write the code-checking rules that spot software vulnerabilities, improving detection accuracy by 82% while avoiding the prohibitive cost of scanning entire codebases directly.
LINK
|
|
Certificate risk triage ranks an enterprise's millions of security certificates by danger level so only the riskiest go to slow full analysis, catching ~99% of critical flaws while sorting 3.7 million certificates per second.
LINK
|
|
|
|
|
Our AI Academy has 330+ step-by-step tutorials on ChatGPT, Claude, Perplexity, and every tool that matters. No fluff — just practical workflows you can use at work. Try it free for 7 days.
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
