|
🖼️ Gyazo breach exposes 23.6M user records
LINK
|
- Helpfeel disclosed a breach of its Gyazo image-sharing service after an attacker exploited a flaw in an upload server to run arbitrary commands and reach backend systems, exposing roughly 23.62 million user records and metadata for about 490 million images.
- The break-in happened on September 11, 2026, and by early September 12 Helpfeel had blocked the access routes, cut the attacker's connections and fixed the vulnerability, but stolen image IDs can rebuild Gyazo URLs, potentially exposing images including some private ones.
- Exposed user data may include names, email addresses, password hashes, session IDs, X integration tokens and Google SSO emails, while no payment data was taken; Helpfeel invalidated affected authentication data and urges users to change passwords immediately and watch for phishing.
|
🔓 Claude used to breach OpenAI code
LINK
|
- Researchers at start-up Hacktron used Anthropic's Claude to help exploit weaknesses in OpenAI's authentication setup, chaining them to take over employee ChatGPT accounts and reach the company's private GitHub code environment on July 25.
- The route combined a misconfiguration in OpenAI's single sign-on (SSO) infrastructure with a remote-code-execution flaw in its Discourse-based community forum, letting an attacker take control of ChatGPT and Codex accounts of people who signed into that forum.
- Because those accounts link to services like GitHub, Slack and email, the researchers read code and proposed changes in under 72 hours; the flaws were disclosed to OpenAI and Discourse, patched, and earned a $6,500 bounty rather than being an ongoing breach.
|
🐛 Flaw lets attackers hijack AI coding agents
LINK
|
- A zero-click flaw dubbed "Plugin4Shell" lets attackers run code remotely on major AI coding agents, Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, Microsoft's Copilot, and GitHub Copilot, gaining full access to everything the agent can reach.
- The flaw bypasses the SHA-pinning safety mechanism: the agent checks out the pinned commit but never verifies it landed there, so an attacker controlling a plugin's repo makes the checkout resolve to malicious code while the pin still looks honored.
- Anthropic and OpenAI patched it in Claude Code 2.1.179 and Codex 0.146.0; Google deprecated Gemini CLI and won't patch, leaving every install vulnerable, and Microsoft's Copilot remains unfixed while researchers say GitHub's mitigation is insufficient.
|
🕵️ Fake installers spy on Iranian dissidents
LINK
|
- Iran-aligned operators known as Handala Hack are deploying a previously undocumented Windows surveillance implant called HEAVYGRAM that uses Telegram bots, groups, and user accounts as its command-and-control channel to spy on Iranian dissidents, journalists, and perceived government opponents.
- Victims are contacted through trust-based social engineering and tricked into running fake KeePass, Telegram, WhatsApp, or Pictory installers, after which a paired tool called CRUDEEXCLUDE uses PowerShell to add attacker-controlled paths to Microsoft Defender exclusions so the implant is never scanned.
- Once installed, HEAVYGRAM beacons over Telegram's bot API and accepts commands to run shell code, capture screenshots, steal Telegram Desktop and browser data, record audio, and fetch more malware; the FBI, which attributes it to Iran's MOIS, published an expanded FLASH report on September 15.
|
💥 Orkes Conductor flaw exploited for RCE
LINK
|
- Attackers have spent at least a month exploiting a critical flaw in Orkes Conductor, the open source framework for orchestrating microservices, workflows, and AI agents, that lets them run code on servers without any login.
- The bug, CVE-2026-58138 (critical, CVSS 9.8), is being actively exploited after a proof-of-concept appeared in early August; a single unauthenticated POST to the open workflow API registers a hostile INLINE task, and Fortinet blocked roughly 1,300 attempts between September 8 and 9.
- Because Conductor evaluates user-supplied JavaScript or Python expressions with its sandbox disabled, the code runs OS commands as the Conductor process, often as root; the fix is version 3.30.2 (patched in June), plus restricting external access to the workflow API and keeping deployments behind a firewall.
|
|
