Daily Cyber News coverage affecting Defense.
Developer credentials and systems can be exposed when AI coding agents interpret a downloaded instruction file as trusted project guidance. Researchers found an AGENTS.md file in a customer’s Downloads folder that directed an agent toward a rogue npm package. They reproduced the technique against OpenAI…
Cloud intrusions moved from initial targeting to privileged access in less than three hours in some attacks attributed to China-aligned Storm-0940. The group used the ARTEX AI penetration-testing framework and stolen ConnectWise Cloud Backup credentials to target Microsoft 365 environments. Activity…
Developer and cloud credentials were put at risk when attackers compromised LiteLLM’s release pipeline. Version 1.107.0 on PyPI and affected Docker tags carried malware across Windows, Linux, and macOS. The payload ran during Python startup, stole secrets and environment data, and could fetch additional…
Internet-facing PHP servers face immediate compromise risk because attackers are broadly exploiting two critical code-execution weaknesses. Exploitation attempts appeared four days before public disclosure, followed by multiple proof-of-concept releases and more activity before the embargo ended on…
Chrome is adding warnings designed to interrupt scams before users expose systems or data. Enhanced Protection can now detect suspicious copied commands used in ClickFix attacks and send a scrubbed clipboard payload for analysis. Server-side Gemini analysis also evaluates pages showing strong scam…
A NATO-country shipbuilder was compromised during a Russia-linked espionage campaign that also targeted an aircraft engine maker and a law enforcement agency. The attackers delivered the Hookedge backdoor through an infected Microsoft Word document. They returned to the shipbuilder’s environment…
WordPress sites were backdoored through valid UpdraftCentral management keys after TeamUpdraft detected unauthorized access to its infrastructure. The vendor believes its customer database was accessed and replaced potentially affected keys and credentials. Researchers said attackers used stolen keys to…
Public-facing web servers face an urgent update cycle after critical PHP weaknesses opened paths to code execution, data exposure and service disruption. The issues affect PHP installations serving web requests, including common Apache, PHP-FPM and CGI configurations. Fixes are available in PHP 8.5.12…