☕️ OpenAI open-sources a bug-finding tool

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🔓 Anthropic's AI cracks weakened encryption

🐛 OpenAI open-sources a bug-finding tool

💧 Cyberattack hits Minnesota water systems

🖥️ VMware bug lets hackers escape VMs

🔑 24,000 servers leak passwords via old flaw

Plus: 💡 5 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.

• An FBI official warned that Anthropic's Mythos 5 model can find and exploit previously unknown bugs across major operating systems and foundational open-source code used in security, web infrastructure, and encryption, raising concerns about future adversary use.
• The model has not been used at scale by attackers yet, but Anthropic said Mythos 5 can identify and exploit bugs not previously known in every major operating system, and even "less capable" models could find and exploit vulnerabilities the same way.
• The Trump administration imposed export controls on Mythos 5 in June citing national security, then lifted them after Anthropic added new safeguards, though a globally available Anthropic model shares the same underlying technology while Mythos 5 stays limited to U.S. government-approved users.

• OpenAI has released Codex Security CLI, an open-source, Apache 2.0-licensed command-line tool that automatically finds, confirms, and fixes vulnerabilities in code repositories, and plugs security checks into CI/CD pipelines.
• The tool, currently in beta, scans repositories, compares results across multiple runs, verifies fixes, and supports bulk scans across multiple repositories, requiring Node.js 22 and Python 3.10 or higher and installing via npm.
• Previously known internally as "Aardvark," Codex Security launched in March 2026 as a research preview for ChatGPT Enterprise, Business, and Edu customers, and by April 2026 had helped fix more than 3,000 critical vulnerabilities, according to OpenAI.

• More than 30 community water systems across Minnesota were disrupted on July 26 and 27 by what officials called a coordinated cyberattack targeting operational technology, with Tenable suspecting the Iran-linked group CyberAv3ngers though no official attribution has been made.
• CyberAv3ngers targets programmable logic controllers (PLCs) at small water facilities, previously compromising at least 75 Unitronics Vision Series PLCs by exploiting default passwords, and Tenable notes some operators expose PLCs to the web or manage them via remote-access software like TeamViewer and AnyDesk.
• Minnesota IT Services said the Department of Health is working with affected utilities to maintain public health, no cities have asked residents to reduce drinking water use, Braham briefly limited outdoor water use, and Maple Plain declared a state of emergency to coordinate resources.

• Broadcom has patched a critical VMware ESXi flaw (CVE-2026-47876, CVSS 9.3) that lets an attacker break out of a compromised virtual machine and run code on the underlying host that powers all the VMs.
• The bug is an out-of-bounds write in the VMXNET3 virtual network adapter, so an attacker who already holds local administrator rights inside a VM using that adapter can execute code on the ESXi host; virtual machines with non-VMXNET3 adapters are not affected.
• No active exploitation has been reported, but Broadcom urges prompt patching, as the same update also fixes two other critical vCenter flaws—an authentication bypass and a directory traversal (both CVSS 9.8)—that let a network attacker gain unauthorized access or run code.

• Around 24,000 Internet-exposed Baseboard Management Controllers (BMCs) can be tricked into handing over password hashes through a more than 20-year-old flaw in the IPMI 2.0 authentication protocol, letting attackers gain privileged access to the underlying servers.
• The bug, CVE-2013-4786, is being actively exploited in the wild and lets an unauthenticated attacker reaching UDP port 623 obtain a password-derived hash and brute-force it offline, with Lava cracking many weak, reused, or factory-set passwords in minutes.
• Lava found compromised BMCs at a major automotive parts maker and an exposed HPE controller showing ransom notes; the immediate mitigation is removing BMC and IPMI interfaces from the public Internet, isolating them on a dedicated management network, and replacing factory and reused credentials.

💡 Strategies & Tactics

Other news & articles you might like

• Critical TeamCity Flaw Could Let Unauthenticated Attackers Execute Server Commands LINK

• Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers LINK

• CISA shares advice on isolating vital systems during cyberattacks LINK

• Flying Eagle RAT Abuses Android Accessibility Services for Keylogging, Screen Capture and Gesture Injection LINK

• Two Joyfill npm Beta Releases Compromised With Blockchain-Backed Remote Access Trojan Loader LINK

• macOS ClickFix Attacks Use Fake CAPTCHAs to Deploy Atomic Stealer and Hijack Crypto Wallets LINK

• Critical WordPress Plugin Backdoor Exposes 20,000 Sites to Full Administrator Takeover LINK

🛠️ Trending tools

📚 Trending research papers

💬 How did you find today's edition?

We read every reply — just reply to this email and let us know how we can improve!