|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
🎙️ Meta's Muse AI can be hijacked 🔓 WordPress flaw enables site takeover 🇰🇵 North Korean hackers weaponize fake job recruiters 📦 Backdoor infects 65 GitHub repos 🕵️ Z.ai tool secretly uploaded dev files Plus: 💡 6 strategies & tactics, 🎁 8 other news you might like, 🧰 6 tools, and 📚 5 papers.
|
|
AI-driven traffic converts 4.4X better than traditional search traffic AI agents can discover products, compare options, and transact on a customer's behalf. That creates a new attack surface: how do you make your storefront ready for legitimate AI traffic while stopping malicious automation? The Definitive Guide to Adopting Agentic Commerce shows how to: • 🔎 Prepare product data and policies for AI agents. • ⚡ Build machine-speed APIs and checkout experiences. • 🛡️ Welcome trusted agents while stopping malicious automation. |
|
|
🎙️ Meta's Muse AI can be hijacked
LINK
|
- A zero-day flaw in Meta's Muse AI agent for macOS lets malware already running under a user account hijack the assistant, intercept dictated prompts, inject malicious instructions, and steal authentication material tied to the victim's account.
- Researcher Patrick Wardle released a proof-of-concept named "not-a-mused" showing an unprivileged local process can change an undocumented setting to redirect Muse's dictation traffic to an attacker-controlled server, enabling prompt injection and session hijacking through the trusted workflow.
- The bug gives no remote code execution on a clean Mac, attackers must already run code as the local user, but it amplifies access by abusing Muse's delegated authority over files, email, purchases and linked devices; Meta had not responded, and users should pause the app.
|
🔓 WordPress flaw enables site takeover
LINK
|
- A WordPress flaw called Click2Shell, fixed in version 7.1.1 released on September 17, 2026, lets attackers run PHP code and fully take over a site after tricking a logged-in administrator into clicking a crafted link.
- Researchers at PWNAI showed the bug abuses the theme-preview workflow: the browser-side JavaScript keeps the raw URL value in a jQuery selector, letting an attacker inject selector syntax that silently triggers the Install button using the admin's session and nonce.
- Chained with a vulnerable inactive theme (the proof of concept used Mobile Repair Zone 2.5.4, whose AJAX plugin-install function lacked nonce and capability checks), attackers can load their own plugin as server-side code; the 7.1.1 fix escapes the URL-derived slug.
|
🇰🇵 North Korean hackers weaponize fake job recruiters
LINK
|
- North Korean hacking group WaterPlum, also tracked as Contagious Interview, posed as job recruiters to infect at least 30,000 devices across more than 100 countries and route roughly $10.7 million in stolen cryptocurrency to Pyongyang.
- Between December 2025 and July 2026, the group approached developers and crypto specialists on job boards and freelance sites, then during fake interviews or coding tasks told them to download malicious files that installed a backdoor stealing browser and wallet logins, keystrokes, screenshots, and ID documents.
- The malware drained funds or credentials from over 7,000 crypto wallets and let attackers use victims' machines as a foothold into corporate networks; a joint advisory from Japan, the US, Australia, and Germany also linked WaterPlum to North Korea's fake IT worker scheme through overlapping IP addresses.
|
📦 Backdoor infects 65 GitHub repos
LINK
|
- Attackers ran a software supply-chain campaign called GHAPPIER that abused npm's trusted publishing to hide a backdoor inside a legitimate package, reaching at least 65 public GitHub repositories, 73 infected files, and 22 accounts.
- The attackers hijacked a maintainer account for about 105 minutes on September 9, changed the release workflow so any push triggered automatic publishing, and pushed version 0.2.21, which stayed the latest release for 35 minutes before being pulled.
- The loader hid in a single line of a 99 KB file and ran only when the MCP server launched, delivering a self-deleting remote shell; a second payload matched the PolinRider campaign, so teams should replace lockfile references to 0.2.21 with 0.2.22.
|
🕵️ Z.ai tool secretly uploaded dev files
LINK
|
- Z.ai, China's second-largest AI company also known as Zhipu AI, admitted its ZCode coding assistant silently uploaded users' local files and data to online servers without consent, prompting a public apology and fixes on Friday.
- The tool's upload mechanism was enabled by default with no way to turn it off; one developer, Ferstar, found ZCode compressed and encrypted 313MB of his files, tried 564 times to send them to Alibaba Cloud storage, and succeeded in siphoning a 15KB file.
- Z.ai says it fixed the unauthorized uploading, destroyed any data sent to its cloud, and plans to open-source ZCode's codebase for third-party review, though there is no indication how long the behavior existed or whether project contents were exposed beyond visible filenames.
|
|
AI can build faster. Can your team decide better?
AI can draft the PRD and prototype the idea. Jira Product Discovery helps teams decide whether it belongs on the roadmap. Bring feedback and ideas together, prioritize as a team, and keep your roadmap connected to delivery in Jira.
💡 Strategies & Tactics
|
> Dump Encoding Library: Attackers can hijack a trusted Microsoft crash-dump encryption file to hide their malware, but defenders can catch it by watching which programs load that file.
|
|
> Package manager threat model, revisited: Auditing package managers by attacker goals rather than dangerous code patterns catches ownership and feature-seam bugs that generic scanners miss entirely.
|
|
|
Other
news & articles you might like
-
Aikido Security unveils Altar-1 open-weight AI for cybersecurity defense
LINK
-
CISA orders feds to patch Zyxel flaw exploited for data theft
LINK
-
Public PoC exposes critical Veeam Agent privilege escalation
LINK
-
The TASK#STOMP Windows backdoor takes Wi-Fi passwords, screenshots, and business files
LINK
-
AWS automatically quarantines exposed IAM keys within 10 seconds of GitHub leak
LINK
-
D-Link DIR-822A router vulnerability scores CVSS 10.0 with public PoC available
LINK
-
Hackers clone legitimate websites to silently trigger Chrome and Windows zero-day exploits
LINK
-
Vidar uses custom bytecode interpreter and ARX stream ciphers for per-build string obfuscation
LINK
|
|
🛠️ Trending tools
|
Halo: an API-first platform that detects deepfakes and synthetic media across text, image, and audio, helping fraud and trust teams block attacks.
LINK
|
|
qsa.sh: scans your public IP for open ports and known vulnerabilities using naabu, nmap, and nuclei, streaming results to your terminal via one curl command.
LINK
|
|
Cynative Security Research Agent: open-source AI CLI that answers plain-language security questions across code, cloud, and Kubernetes using read-only, IAM-enforced production access.
LINK
|
|
Aegisora: an open-source proxy that secures LLM agents with least-privilege API access, PII masking, prompt-injection blocking, and audit logging for production.
LINK
|
|
Agent Chaperone: screens AI agent tool calls and results, blocking risky, off-task, or secret-leaking actions and detecting prompt injections before execution.
LINK
|
|
Prized: builds secure internal tools with AI for ops, support, and finance teams, featuring pre-connected data, access audit trails, and one-click deploy behind company sign-in.
LINK
|
|
|
|
📚 Trending research papers
|
Security agents can teach themselves to hunt software bugs better by rewriting their own instructions from what worked, without retraining the underlying model or needing scarce expert examples.
LINK
|
|
Coding checklists cut serious security flaws in AI-written backend code from 53 to 11 across five leading models, showing a short upfront spec beats the instruction files teams already use.
LINK
|
|
Memory-poisoning defenses for AI agents mostly cost nothing on normal traffic, except one reranking method that wrongly blocks legitimate memories in ~34% of cases and shaves ~4 points off accuracy.
LINK
|
|
Electromagnetic snooping can catch a malicious hidden chip circuit tampering with a computer's core memory in real time by spotting the abnormal software behavior it triggers, without adding hardware or damaging the device.
LINK
|
|
Quantum-safe encryption runs nearly as fast inside lightweight virtual containers on embedded devices as on bare hardware, though picking the wrong algorithm can swing energy per secure connection by up to a thousandfold.
LINK
|
|
|
|
|
Our AI Academy has 330+ step-by-step tutorials on ChatGPT, Claude, Perplexity, and every tool that matters. No fluff — just practical workflows you can use at work. Try it free for 7 days.
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
