AgentBaiting is the clearest sign yet that AI agents and their capability ecosystems have become a first‑class malware delivery surface, with FakeGit’s 7,600‑repo operation pushing SmartLoader and StealC directly into AI Skills and MCP workflows. By turning agent‑readable READMEs, public…
Linux Kernel Team Publishes 440 CVE Security Advisories Within 24 Hours
The Linux kernel security team published approximately 440,440 CVE advisories over 24 hours, reflecting a significant release of vulnerability records linked to fixes already incorporated into the upstream kernel tree. These notices were distributed through the linux-cve-announce mailing list between…
The Privilege Paths Attackers See, That You Don’t – A Complete PAM Guide
Why identity fragmentation is the blind spot behind most breaches—and what a platform approach changes The Identity Problem Hiding in Plain Sight Identity is at the centre of nearly every major breach—yet most organisations still can’t answer one fundamental question: what…
Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution
Threat actors are now exploiting a recently disclosed critical security flaw impacting ServiceNow AI Platform, according to Defused Cyber. In a post shared on X, the threat intelligence firm said it’s observing in-the-wild exploitation of CVE-2026-6875 (CVSS score: 9.5), a…
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month. The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed to…
Attackers Exploit Critical ServiceNow RCE Flaw CVE-2026-6875
Attackers are exploiting critical ServiceNow flaw CVE-2026-6875, allowing unauthenticated remote code execution on self-hosted instances. Searchlight Cyber researchers disclosed a critical pre-authentication remote code execution vulnerability, tracked as CVE-2026-6875, in the ServiceNow AI Platform on July 14. The same day,…
Hugging Face fights AI hacks, World Cup streamers get red cards, WordPress enters a patching race
Hugging Face fights AI hacks with AI World Cup streamers get a red card WordPress enters a patching race Get the show notes here: Huge thanks to our sponsor, QuilrAI AI agents don’t ask permission. They act — moving data,…
IT Security News Hourly Summary 2026-07-21 09h : 6 posts
6 posts were published in the last hour 7:2 : Fileless Stealer and PureRAT Raid Browser Passwords, Telegram Sessions, and Crypto Wallets 7:2 : OVH reveals semi-secret plan to fix critical Januscape hypervisor bug with mass reboots – and an…
Fileless Stealer and PureRAT Raid Browser Passwords, Telegram Sessions, and Crypto Wallets
Fileless stealer and PureRAT operators are abusing a WebDAV‑backed “malware delivery lab” to raid browser passwords, Telegram sessions, and cryptocurrency wallets in a campaign that blends fileless info‑stealing with a modular .NET RAT. The incident began with an MDR alert…
OVH reveals semi-secret plan to fix critical Januscape hypervisor bug with mass reboots – and an Australian crash-test dummy
French cloud backported a patch into Debian and didn’t seek customer consent, despite chance of downtime This article has been indexed from www.theregister.com – Articles Read the original article: OVH reveals semi-secret plan to fix critical Januscape hypervisor bug with…
Researchers Advance ‘Flow Batteries’ For Renewable Power
Researchers at Queen’s University Belfast, two Chinese institutions come up with novel techniques for tech that could be used to store grid power This article has been indexed from Silicon UK Read the original article: Researchers Advance ‘Flow Batteries’ For…
European Password Manager Passwork Shares Codebase and Updates With FSTEC-Certified Russian Firm
Passwork Europe, a Spain-based password manager used by European public sector bodies, universities, and private organizations, is facing scrutiny after an investigation led by OCCRP uncovered technical and historical connections to a Russian counterpart certified by Russian state agencies. The…
Hackers Turn Telegram Bots Into Secret Backdoor Controllers for Government Systems
A newly uncovered cyberespionage campaign has turned Telegram bots into quiet controllers for backdoors planted inside Middle Eastern government networks. The operation relies on familiar Windows components and legitimate-looking files, allowing attackers to establish access without immediately drawing attention. The…
The air gap is a myth and other OT security truths
Benjamin Bachmann, Director Group Information Security at Bilfinger, speaks with Help Net Security about defending industrial plants. He explains why attackers want to control operations instead of stealing data, and why the air gap is mostly a myth. Bachmann covers…
EU Fines AliExpress Record €550m Over Illegal, Fake Goods
European Commission says Chinese e-commerce platform failed to flag unsafe or counterfeit goods, took ‘weeks’ to remove them This article has been indexed from Silicon UK Read the original article: EU Fines AliExpress Record €550m Over Illegal, Fake Goods
Bit2Watt Attack Turns AI Data Centers Into Cyber-Physical Threats to Local Power Grids
Bit2Watt is a newly disclosed cyber‑physical attack class that weaponizes AI and GPU workloads in modern data centers to destabilize nearby power grids, turning compute infrastructure itself into a grid‑scale threat surface. Measurements on NVIDIA accelerators show sub‑millisecond power ramps…
Employees’ shadow AI use is poorly monitored, survey finds
<p>Despite cybersecurity professionals’ best efforts to protect their organizations’ networks and data, employees have long been the weak link in the chain. They click malicious links in emails, reuse weak passwords, share sensitive information and make other mistakes that threat…
Why SSDLC is helping shipping faster and more secure code
Software Delivered the Same Way Every Time Before security enters the picture, SDLC exists to solve a simpler problem: making software delivery repeatable. A team that builds features ad hoc, without a defined sequence of requirements, design, coding, testing, and…
Nobody was checking the drives that encrypt your laptop
A drive ships with a label promising hardware encryption. You plug it in, set a password, and trust the chip inside to handle the rest. Millions of laptops and workstations run this way, on solid-state drives built to the TCG…
Hackers Hide C2 Traffic Inside Telegram While Targeting Middle East Governments
Hackers are increasingly blending malicious traffic with legitimate services, and a newly uncovered campaign shows how far this tactic has evolved. The activity has been attributed to a threat actor with links to East Asia, with researchers uncovering a previously…
HOLLOWGRAPH Malware Turns Microsoft 365 Calendar Events Into Covert Command-and-Control Channels
HOLLOWGRAPH, a Windows malware implant that transforms Microsoft 365 calendar events into a covert command-and-control channel. This malware, which is highly likely linked to the Cavern modular backdoor framework, utilizes the Microsoft Graph API to retrieve tasks from operators and…
Paidwork Data Breach Exposes 23.3 Million Accounts, Banking Data and bcrypt Password Hashes
Gig-economy platform Paidwork has been linked to a significant data breach that affects 23.3 million accounts. This breach, involving an approximately 11GB dataset, was publicly released in July 2026. The incident was added to the Have I Been Pwned (HIBP)…
PR3TACK preemptive framework maps threats before attackers use them
Defensive frameworks in cybersecurity record what attackers have already done. Analysts study a breach, document the method, and build detections around confirmed activity. This cycle leaves a gap between the moment an attacker invents a technique and the moment defenders…
AI agents are still logging in as humans
Most large companies run more than one AI platform at the same time. Developers pull up coding assistants, marketing teams lean on writing tools, and analysts query enterprise search across separate vendors. Single-provider setups keep giving way to mixed stacks…