The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them, driving it into projects the attacker has no rights to reach and quietly leaking what it finds. The flaw is in Microsoft's official Azure DevOps MCP server , and it works because one of its tools returns pull request descriptions without a prompt-injection guardrail the company had already applied to others. Agentic Runtime Security firm Manifold Security detailed the confused-deputy bug this week. Microsoft ships the server so AI agents can read and operate Azure DevOps for a user, across pull requests, pipelines, wikis, and work items, all with the user's own permissions. That is the whole problem: content other people wrote can become instructions the agent acts on. Azure DevOps PR descriptions accept Markdown, which allows HTML comments. In the web UI, an HTML comment (<!-- ... -->) renders as nothing, so a reviewer scrolling the description s...

Apple has moved to address a security flaw in its Hide My Email service that enabled users' real email addresses to be unmasked, effectively undermining the feature's privacy guarantees. 404 Media reported Tuesday that a fix for the issue was deployed by Apple on July 3, 2026, after more than a year, when it was disclosed to the company by Tyler Murphy, co-founder of EasyOptOuts. Hide My Email generates unique, random email addresses that forward messages to a user's personal email inbox automatically. By creating disposable email addresses, the idea is to safeguard user privacy and tackle unwanted spam. The feature requires a paid subscription to iCloud+ and was announced by Apple in June 2021. However, at the start of the month, details emerged of a flaw that made it possible to unmask a user's real email address hidden behind a Hide My Email address. The issue was first reported to Apple on June 13, 2025, with Cupertino unsuccessfully attempting to patch ...

Hidden text on a web page was enough to make Kiro , AWS's agentic coding IDE, rewrite its own configuration file and run an attacker's code on a developer's machine, with no approval step able to stop it. Intezer, in research with Kodem Security, found that a request as ordinary as asking Kiro to summarize a page could end in remote code execution. AWS has patched the issue and says it is covered by CVE-2026-10591. Kiro's safety model rests on a human clicking "allow." The agent can run shell commands, fetch URLs, and edit files, and the design assumes a developer reviews anything risky before it happens. That approval step is the security boundary, and the flaw let an attacker slip past it without the developer ever being offered a choice. The weak point was the file that tells Kiro which external tools to load. Kiro reads its list of Model Context Protocol servers, and the exact command used to start each one, from ~/.kiro/settings/mcp.json. When th...

Google's DeepMind on Tuesday announced the release of Gemini 3.5 Flash Cyber , a specialized artificial intelligence (AI) model built atop 3.5 Flash that's designed to discover, validate, and patch vulnerabilities quickly and efficiently. According to the tech giant, the model will be exclusively available to governments and trusted partners via CodeMender as part of a limited-access pilot program. CodeMender is an AI-powered agent for vulnerability discovery and patching that was unveiled by the company in October 2025. A Google DeepMind spokesperson told The Hacker News that there are plans to extend the model's capabilities to include red-teaming features and end-to-end enterprise defense. The lightweight model, per DeepMind, is both cost-efficient and highly capable alternative to large, costly cybersecurity-focused models. CodeMender can call upon 3.5 Flash Cyber "multiple times at high speed and low cost," allowing the AI agent to scan more code path...

A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr . The vulnerability in question is CVE-2026-50522 (CVSS score: 9.8), a critical deserialization of untrusted data in Microsoft Office SharePoint that could allow an unauthorized attacker to execute code over a network. Microsoft credited DEVCORE researcher "splitline" with discovering and reporting the flaw. "In a network-based attack, an attacker authenticated as at least a Site Owner, could write arbitrary code to inject and execute code remotely on the SharePoint Server," Redmond said in an advisory released last week. "The attack vector is Network (AV:N) because this vulnerability is remotely exploitable and can be exploited from the internet. The attack complexity is Low (AC:L) because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the ...

Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments. Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation of CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and gateway components of PAN-OS software. Successful exploitation of the flaw allows unauthenticated remote attackers to sidestep authentication and establish VPN sessions without valid credentials when authentication override cookies are enabled with specific certificate configurations. "Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware-as-a-service (RaaS) umbrella," the cybersecurity company said .

Zimbra has rolled out fixes to address multiple critical security issues, including a command injection flaw in the Simple Network Management Protocol (SNMP) monitoring component. As many as nine security vulnerabilities have been patched in Zimbra 10.1.20 . Topping the list is a command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled. Also patched are four cross-site scripting (XSS) flaws in the Classic Web Client - A stored cross-site scripting (XSS) vulnerability that could allow malicious attachment filenames to execute script under specific conditions. An XSS vulnerability where crafted fields could execute a malicious script under specific conditions. An XSS vulnerability where a crafted field could execute a malicious script when rendered. An XSS vulnerability where crafted attachments could execute a malicious script when rendered. Separately, fixes have been released for a mail forwarding restriction bypass (CV...

An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent. Researchers demonstrated that chain, plus six other attacks, against five open-source mobile agent frameworks: AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA. Everyone fell to at least six of the seven. The paper went up on arXiv on July 1 and was revised on July 14. The authors are at Simon Fraser University, the Chinese University of Hong Kong, Shandong University, and the Xingtu Lab at Chinese security firm QAX. Nothing here has a CVE, and first author Zidong Zhang told The Hacker News the team has no evidence of the techniques being used outside a controlled setting. The Hacker News checked all five frameworks and found the screenshot paths, the shell call, and the broadcast fallback that the paper describes st...