artificial intelligence | Breaking Cybersecurity News | The Hacker News

Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by Cisco Talos under the moniker UAT-11985 , describing it as likely fueled by artificial intelligence (AI)-assisted content generation so as to quickly craft bespoke lures aimed at different targets within the confines of a common social engineering framework. The campaign was first observed in mid-2026. "The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility," Talos researcher Joey Chen said in an analysis. "Beyond traditional email phishing, the actor incorporated QR code phishing (quishing) te...

OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test cryptocurrency from a third-party's wallet without authorization to complete a coding task. The incident, the AI company said, involved an internal research model part of the GPT-5.6 Sol family. The incident occurred on June 26, 2026, and was discovered by OpenAI three months later. "An internal research model asked to update a cryptocurrency trading application used funds from a wallet that the task had not supplied to pay for a deployment on Sepolia, an Ethereum test network," OpenAI said . "It derived wallet keys from publicly known developer recovery phrases, found an account with test-network funds, and used that account to pay for the requested contract deployment." The assignment allowed the model to deploy compatible cont...

In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking . OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision , an open LoRA adapter you can run locally. Others, like Laya, are already showing up in open source tooling. These models skip text generation entirely. You hand them some state and a set of typed questions. They hand back a choice, a score, or a yes/no with a probability attached. For security operations, I think this is some of the best news of the year. I also think most of the conversation is pointed at the wrong layer. Why a SOC should be excited Three properties make decision models a natural fit for alert triage. You get a number you can automate against. A typed answer with a calibrated probability is something you can put a thresho...

AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In  said in an advisory  on October 15. The agents went beyond their assigned tasks, and none of the organizations detected the unauthorized access. After internal reviews, the AI companies whose models were being tested voluntarily reported the cases to CERT-In, India's national cyber agency. AI agents are software systems that can plan work, run commands, use tools, and act on the internet autonomously for extended periods. In these cases, the agents gained access via credentials and connection settings left exposed in application configuration and public code repositories, and via cloud service roles with excessive permissions. CERT-In did not name the AI companies, their models, or the organizations and sectors involved. It did not say how many companies reported cases or how many organizations were affecte...

A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape , is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared layer that cloud providers use to keep customers' workloads apart. It was found in a Vercel security challenge and reported privately before any public release, and there is no sign it has been used in a real attack. What the Researcher Showed Paulos Yibelo of the security firm pwn.ai found that specially made network packets sent from inside a virtual machine could do three things, he explained in a  technical write-up : read the host's memory, crash the host, and run code on it. All three come from the same kernel flaw. Vercel said in its  report on the challen...

Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and some flaws are so simple you wonder how nobody spotted them sooner. There's a lot more hiding in the details, including a few twists you probably wouldn't expect. Here's what made the list this week. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026.  The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed targets.  Similar attacks appearing across different customers can trigger repetitive investigations, consume analyst capacity, and extend response times, making it harder to maintain consistent service levels as threat activity grows. How Fake AI Attacks Are Reaching US Businesses Fake AI attacks pose a serious risk to business security The campaigns investigated by ANY.RUN use familiar AI brands to encourage employees to execute malicious commands, install compromised applications, or submit credentials through fraudulent authentication pages.

AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools are growing more confident in their own output faster than practitioners are developing reliable ways to verify it. Without governance models and validation standards in place, that gap compounds and rarely stays contained to a workstation: an unverified finding can end up in a forensic report, a deposition, or in court.  At SANS, we created two new AI frameworks this year to help address this challenge: the Digital Forensics & AI Investigations Framework , which we mapped to the trusted standards established by the Scientific Working Group on Digital Evidence (SWGDE), and the Incident Response & AI Investigations Framework , which we mapped to the NIST Cybersecurity Framework 2.0. Both frameworks rest on the same principle: AI can accelerate investigative work, but the human examiner remains the final authority at every phase...

Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM. The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of authenticated remote code execution impacting versions prior to 1.9.0. "Any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the 'stdio' transport," reads an advisory released last month. "The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH ove...

A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 in  curl 8.23.0 . Taking over a client needs exact knowledge of its build and memory layout, and curl expects a real attack to end in a crash instead. The flaw, a use-after-free tracked as  CVE-2026-92392 , affects curl and libcurl 8.12.0 through 8.22.0, both the command-line tool and the library that many other programs use for transfers. curl rates it High on its own four-level scale, its first High-severity flaw since the  SOCKS5 heap overflow of October 2023 . The project cut its release cycle by two weeks to ship the fix. The attack runs from the server side. The client has to upload a file of roughly 135KB over HTTP/2 to a server controlled by the attacker, and the server's certificate must pass the client's checks....

Cloned voices and synthetic video calls now show up in payment fraud, help desk resets, and access requests. A structured drill shows security teams exactly where verification breaks down, while nothing is at stake. The call comes in at 4:40 on a Friday. It's the CFO, or it sounds exactly like her, asking the controller to push a supplier payment out before the weekend because a deal closes Monday. She's traveling, she's rushed, and she apologizes for the bad connection. Ten minutes later an email lands with the wire details. A couple of years ago that scenario was a conference talk. Now it shows up in incident reports. In a 2025 Gartner survey of 302 cybersecurity leaders , 62% said their organization had experienced at least one deepfake attack in the prior 12 months. In the same survey, 43% reported at least one deepfake audio call incident and 37% had run into deepfakes on video calls. And the wire is only the obvious ask. The same cloned voice can call the help ...

A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs,  fixed them , and paid XBOW its top $250,000 reward for a full Chrome exploit. The attack is a full chain: a set of bugs used together to break every layer of Chrome's protection, from a web page all the way to the computer. Chrome runs web page code inside two nested sandboxes, the barriers that stop a hacked page from reaching the rest of the machine. The chain crossed both. The result was code running outside Chrome on Windows, with no need for the user to click or download anything. All three bugs are now fixed, and XBOW says they were never used against Chrome users. The two that carry public identifiers were fixed ...

The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login request let the user choose where the one-time passcode went. The attack was the easy part. Proving it on a live site took web context built over a decade. The Login Worked. Then the Agent Stopped. Reflectiz's AI pentesting agent was mapping the login flow of a major insurer's production website, which has millions of users. The agent requested a login code and directed it to an email inbox it controlled. The code arrived. The login went through. Its guardrails halted the test after the login succeeded.  The agent had discovered a critical-severity authentication bypass on its own. Reflectiz reported it to the insurer. The Flaw: The Request Chose Where the Code Went ...

A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as  CVE-2026-74580  and named Vghost . Tencent Zhuque Lab, which found the flaw, released a fix on August 3 and published a full write-up on October 12 with working demos of both attacks. There is no public sign it has been exploited yet. vhost is the part of the Linux kernel that speeds up network and other input/output for virtual machines and containers. A local user reaches it by opening a device node, usually /dev/vhost-net or /dev/vhost-vsock. On the host, the flaw gives an unprivileged user a reliable way to read and write any kernel address, bypass KASLR, and escalate to root. The attack is deterministic: it needs no memory grooming and ...

A Saudi national and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to covertly record sensitive conversations. Abdulrahman Alfozan, 35, has been charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications. He was arrested by authorities on October 9, 2026, the U.S. Department of Justice (DoJ) said. Alfozan had been employed at OpenAI since July 2025, working as an engineering lead. He has since been terminated. According to Alfozan's LinkedIn profile, he graduated from the University of California, Berkeley, with a master's in data science in 2025. He was previously employed at Meta as a senior systems engineer and went on to become the founding engineer at Nash. "Abdulrahman Alfozan allegedly concealed a covert recording device inside his employer's executive conference room to secretly capt...

Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are "challenging to shut down," since "there's no centralized point to shut off." Prior work has demonstrated that AI agents can act like one by scanning their network, executing an exploit, and copying model weights to a target machine across a GPU cluster with an aim to generate tailored attack strategies and use compromised machines as a botnet to run large language models (LLMs) in order to sustain its reasoning and expand in scale. "Such an 'AI worm' could carry its model weights with it as it reproduces (or re-download them from a public hub), and then run inference directly on compromised hardware," Anthropic said . "Eff...

The dangerous part of a stolen identity isn't always the initial login. It's what an attacker can do with that access next. With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A compromised account that looks legitimate at first could become the starting point for a much larger attack. And that's where traditional identity security faces a serious problem: Checking who gets access isn't enough if you can't control what happens after. See How to Stop AI-Powered Identity Attacks — Register for the Webinar Why Traditional Identity Controls Are Falling Behind

A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list. Someone downloads a local model runtime, a program that runs models directly on the machine instead of sending data to an external service, because they were told not to send company data outside. None of this reaches your software inventory. Tasked with controlling AI, an administrator often resorts to blocking well-known AI websites and taking enforcement action without knowing what is actually running. Bitdefender GravityZone AI Visibility and Control (AIVC) is the discovery and risk layer that answers the questions you have, first: Which AI software is present on your protected Windows endpoints, who is running it, and how much risk does each one carry. What Your Software Inventory Was Never Built to Watch AI Visibility and Control covers four classes of exposu...

Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves. Malware got better at hiding its tracks. And some systems turned out to be easier to break into than anyone would like to admit. The odd part is how normal much of it looked until someone checked closer. There's more going on here than a few bad bugs and clever attacks. Some of the smaller stories are just as telling. This week's full recap is worth a read, especially the bits that didn't make the big headlines. ⚡ Threat of the Week Atlassian Flaw Exploited in the Wild — Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian...

The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns ; and the horror stories from pretty much every personal AI agent keep piling up. Regardless, the tech world is mesmerized by the capabilities and potential of these services. Less than a year after the first release of the open-source agent now called OpenClaw, the juggernauts are putting their weight behind the idea that each of us needs a personal assistant. You know what's coming: your employees will connect their personal agents to work systems. There's no stopping that. Their agents already manage their home time, and managing their work time is the next logical step. For them, that is. Not for your security. Given that personal agents will reach corporate systems whether approved or not, you might be wondering what the best way is to block them. If that’s yo...