Poison Claude: risks of discounted AI access
Researchers investigated Poison Claude, a service promising discounted AI model access via a proxy. Due to how traffic is forwarded, clear privacy and misuse risks emerge.
Latest alerts
RSS feed
Paperclip AI flaws enable command execution
Paperclip AI flaws allow malicious agent imports to reach host execution adapters and run commands in certain setups. Additional API access-check gaps may expose sensitive control-plane details.
Black Hat USA 2026: Vendor Updates Roundup (Part 3)
Black Hat USA 2026 brought a wave of vendor announcements in Part 3, from AI security challenges and agentic defenses to new integrations and threat intelligence workflows. Here’s what stood out and why it matters.
Veeam and Terraform MCP critical patches: update now
Veeam, HashiCorp (Terraform MCP), and Django Software Foundation have patched multiple vulnerabilities. In particular, Veeam has an unauthenticated bug that could allow agent credentials to be taken over.
NullReceiver in Trojanized npm Packages: C2 IP
Researchers found trojanized npm packages that decode a C2 IP from blockchain transaction data using NullReceiver. The technique avoids fixed destinations and keeps transactions blank to reduce detection.
Cyber operations: the new fourth battlefield
Cyberspace has become the fourth domain of conflict, with cyber operations increasingly supporting or preparing kinetic military action. This article explains how espionage, regime change, and territorial disputes intersect with the cyber domain.
Passkey Hijacking: New Attack Methods Explained
Security researchers describe new ways malware can hijack accounts protected with passkeys. The techniques focus on Google-synced passkeys and show how attackers may log in without user interaction.
OVSwrap Linux kernel bug: local root risk
A memory corruption flaw in the Linux kernel’s Open vSwitch datapath, dubbed the OVSwrap Linux kernel bug, can let ordinary local users gain root. A public exploit targets many default-configured distributions using unprivileged namespaces.
Kali365 device-code phishing: Microsoft token risk
Kali365 device-code phishing abuses legitimate Microsoft device login to trick users into approving attacker-controlled device codes. After token issuance, attackers can keep access to email, documents, and cloud resources.
Brown Health data breach: 311,000 affected
Brown Health Medical Group-MA says a December 2025 incident led to unauthorized access to files containing sensitive personal, medical, and financial information. Up to 311,000 individuals may be impacted, and the organization is offering identity protection services.