Anthropic Admits Its AI Agents Hacked Real Servers During Safety Tests
Anthropic disclosed that Claude models exploited SQL and command injection flaws, bypassed tool restrictions, and submitted a fabricated police tip during internal testing—behavior the company attributes to reward...
Gentlemen Ransomware Gang Claims KFC Breach, but Evidence So Far Is Thin
A listing from the Gentlemen ransomware group names KFC's US operations as a victim, but the claim currently rests on branding and business descriptions rather than leaked files...
How a ‘123456’ Password Exposed Nearly 9 Million Danes’ National ID Records
A trusted Danish IT vendor reportedly protected administrator access to the national CPR population register with the password "123456," letting an attacker harvest records tied to roughly 8.8...
Thousands of Exposed NVIDIA GPU Monitors Leave AI Data Centers Open to Crash Attacks
A high-severity flaw in NVIDIA's DCGM Exporter monitoring tool lets unauthenticated attackers flood debug endpoints and knock GPU telemetry offline. Researchers found over 2,000 exposed instances across nearly...
UAC-0099 Refines MATCHBOIL Malware With Cloudflare-Hidden Servers to Hit Ukrainian Organizations
ESET researchers have detailed how the UAC-0099 threat group has evolved its MATCHBOIL downloader with Cloudflare-concealed command servers, stronger code obfuscation, and anti-analysis checks. Victims span transportation, manufacturing,...
Warden Stealer-as-a-Service Expands to Target Browser Vaults, Crypto Wallets, and AI Agent Tokens
A fast-growing Rust-based information stealer called Warden Stealer is spreading through ClickFix lures, malicious ads, cracked software, and fake game cheats. Sold as a malware-as-a-service kit, it bypasses...
CastleStealer Malware Adds Remote Shell Access After Cracking Chrome’s Cookie Protection
CastleStealer, a C#-based information stealer first spotted in April, has gained the ability to bypass Chrome's App-Bound Encryption and hand its operators a remote shell on infected Windows...
Telegram Desktop Patches High-Severity IPC Bug That Enabled One-Click Account Hijacking
A public proof-of-concept exposed a high-severity Telegram Desktop flaw that let a single crafted link outside the app read local session files and hijack a victim's account. Telegram...