Everything BreachFeed is tracking across the industry, as it publishes.
Link — click to select, then copy:
https://breachfeed.com/article/cmu8dcs0l1hmlhmu2t5cy1yosGoogle Confirms Gemini Hacked 3 Real Companies in May Safety Test BeInCrypto
Link — click to select, then copy:
https://breachfeed.com/article/cmu8clrri1g16hmu29w6he1ghGoogle’s Gemini hacked three real companies during security test Cybernews
Link — click to select, then copy:
https://breachfeed.com/article/cmu8ae1e31b86hmu2j72lvpevGoogle's Gemini AI Broke Its Own Sandbox and Hacked Three Real Companies startupfortune.com
Link — click to select, then copy:
https://breachfeed.com/article/cmu897lnf18nlhmu2bywdhc3aGoogle Gemini Hacked Other Companies in Test by Israeli Cybersecurity Firm Haaretz
Link — click to select, then copy:
https://breachfeed.com/article/cmtvmbk961dinhmu228e46rlwCybercriminals are exploiting intense interest in Grand Theft Auto VI by pushing fake game downloads that install several types of malware instead of a playable game. The campaign targets people looking for an early build, leaked copy, or unofficial demo before the title’s release. The malicious downloads are distributed through poisoned search results, gaming forums, […] The post Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware appeared first on Cyber…
Link — click to select, then copy:
https://breachfeed.com/article/cmtvm01211d77hmu2ktugdvx1Multiple cyber-espionage groups deployed an exploit kit dubbed "BlueMoon" that leveraged zero-day vulnerabilities in Microsoft Windows and Google Chrome. [...]
Link — click to select, then copy:
https://breachfeed.com/article/cmtvlw4mi1d09hmu2kla19idxWordPress has rolled out an automated, AI-driven security review that screens every plugin release before it reaches the WordPress.org update API, adding a critical checkpoint to a distribution pipeline that had previously lacked one. The move follows a real-world incident in which a backdoor was slipped into an update for a plugin with roughly 20,000 […] The post WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites appeared first on Cyber Security News.
Link — click to select, then copy:
https://breachfeed.com/article/cmtvloevx1crvhmu2jj9a3bbwA new phishing campaign is moving fake login pages into victims’ browsers. Rather than sending people to a malicious website, its operators use browser-generated blob URLs to assemble the page in local memory, leaving less for security tools to inspect before it appears. The operation starts with a DocuSign-themed email carrying a calendar invitation. Its […] The post Hackers Use Blob URLs and Microsoft Teams to Create Phishing Pages Inside Victims’ Browsers appeared first on Cyber Security…
Link — click to select, then copy:
https://breachfeed.com/article/cmtvltk0w1cyqhmu2h3etcwruIdentity was the target in roughly half of all confirmed malicious activity. Prophet Security breaks down the four main attack patterns seen across customer environments between May and July 2026, and explains why some attacks succeeded while others were blocked. [...]
Link — click to select, then copy:
https://breachfeed.com/article/cmtvlcu6c1cejhmu2t3g7ngvaSean Cairncross also said AI has shown long-standing issues in cyber rather than creating new ones. The post Governments ‘buying time’ in race between innovation, security, national cyber director says appeared first on CyberScoop.
Link — click to select, then copy:
https://breachfeed.com/article/cmtvkxezz1bzehmu2vd8ci6qkDeceptive apps in Early Access are being used by dishonest developers for their own benefit. The post Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews appeared first on SecurityWeek.
Link — click to select, then copy:
https://breachfeed.com/article/cmtvkltz81bjphmu24t9s1jdeCisco Talos has confirmed active exploitation of two vulnerabilities affecting Cisco Secure Firewall Management Center (FMC) Software, with state-sponsored hacking groups and a ransomware affiliate leveraging the flaws to seize root access, plant malware, and stage attacks on enterprise networks. The disclosure marks one of the year’s more serious enterprise security incidents, given FMC’s role […] The post Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware…
Link — click to select, then copy:
https://breachfeed.com/article/cmtvkyoxx1c03hmu2q6np0qxyHere's a tip for any budding cybercriminals out there. If you're going to steal a quarter of a billion dollars worth of cryptocurrency, maybe don't broadcast on a group chat every time you buy a Lamborghini, or blow half a million dollars on a single night out at a nightclub. Read more in my article on the Hot for Security blog.
Link — click to select, then copy:
https://breachfeed.com/article/cmtvkpp6u1bq8hmu2s0gnmu7hJoin the webinar for a focused, 20-minute discussion on Frontier Pace Governance, an approach to balancing automation, policy, and business risk as IT operations accelerate. The post Webinar Today: Keep Pace With AI – A New Operating Model for Endpoint Remediation appeared first on SecurityWeek.
Link — click to select, then copy:
https://breachfeed.com/article/cmtvke47n1bbchmu2hzxwbz2lCISA added a critical Citrix NetScaler authentication bypass flaw (CVE-2026-19490) to its Known Exploited Vulnerabilities catalog after observing in-the-wild attacks targeting the issue. Federal civilian agencies must apply vendor mitigations by September 12, 2026. CVE-2026-19490 affects Citrix NetScaler ADC and NetScaler Gateway appliances configured as an Authentication, Authorization and Auditing virtual server or as a […] The post CISA Warns of Citrix NetScaler Authentication Bypass…
Link — click to select, then copy:
https://breachfeed.com/article/cmtvk6ejo1b24hmu2t9s86cqzHackers are using passkey-themed phishing to take control of Microsoft 365 accounts and collect cloud data. It can defeat MFA protections. The campaign starts with calls and texts to employees. Attackers pose as IT support, claim a passkey, MFA, or single sign-on setting needs attention, and direct targets to lookalike sign-in pages. Compromised accounts can […] The post Hackers Use Passkey-Themed Phishing to Hijack Microsoft 365 Accounts and Steal Cloud Data appeared first on Cyber Security…
Link — click to select, then copy:
https://breachfeed.com/article/cmtvjcu001a61hmu2fwn8rdyaEnterprise AI workflows can be vulnerable to misuse that exposes sensitive information without prompt injection, account compromise, or jailbreaking a large language model. This vulnerability, termed Workflow Identity Hijacking, exploits authorization gaps between external requesters and the privileged identities used by AI automation. Workflows linked to public-facing email inboxes, web forms, GitHub issues, shared documents, […] The post Hackers Can Turn AI Workflows Into Privileged…
Link — click to select, then copy:
https://breachfeed.com/article/cmtvij8np1971hmu2gmtfrgmrCheck Point Software has disclosed and patched two critical VPN-related vulnerabilities, CVE-2026-85102 and CVE-2026-85103, both carrying a maximum CVSS score of 9.8 and both capable of allowing unauthenticated remote code execution under specific conditions. Check Point’s own research team uncovered the flaws, and the company says it has found no evidence of active exploitation or […] The post Critical Check Point VPN Vulnerabilities Enable Remote Code Execution Attacks appeared first on Cyber…
Link — click to select, then copy:
https://breachfeed.com/article/cmtvibiwd18xvhmu2dcse8cabLiteLLM deployments can expose far more than an organization’s AI spending. Newly disclosed weaknesses in the open-source gateway could let attackers run code as root inside a container, reach connected tools, and retrieve cloud credentials that open a path into a wider environment. The risk is serious where the service is internet-facing or retains its […] The post LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials appeared first on Cyber Security News.
Link — click to select, then copy:
https://breachfeed.com/article/cmtvhj95n1827hmu2eamm8p2pA newly identified AI attack technique can let unauthenticated users trigger privileged workflows and access enterprise systems, highlighting a gap in how identity and access controls apply to AI agents, according to research from Noma Labs. The report, authored by Noma Labs lead researcher Sasi Levi, describes the issue as “workflow identity hijacking,” where attackers bypass standard controls by sending normal, benign requests through an unauthenticated entry point such as a support inbox,…
Link — click to select, then copy:
https://breachfeed.com/article/cmtvyuy9l1rskhmu2kuuy2n1dCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational…
Link — click to select, then copy:
https://breachfeed.com/article/cmtvp1art1gnvhmu29r8m8owlView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to disclose information, brute-force hashes, or run arbitrary code in a browser session. The following versions of AVEVA Pipeline Integrity Monitor are affected: AVEVA Pipeline Integrity Monitor <=2025_SP1_P1_build_7.1.9580.8513 (CVE-2026-81821, CVE-2026-81822, CVE-2026-81823, CVE-2026-81824) CVSS Vendor Equipment Vulnerabilities v3 8.4 AVEVA AVEVA Pipeline Integrity Monitor Use of Hard-coded…
Link — click to select, then copy:
https://breachfeed.com/article/cmtvp1art1gnuhmu2j1jd6l0bView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to device information or cause a denial-of-service condition. The following versions of ST Engineering iDirect iQ-Series Terminals (Update A) are affected: Evolution iQ‑Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057, CVE-2026-38056, CVE-2026-38058) 3315‑Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057, CVE-2026-38056, CVE-2026-38058) 9‑Series terminals…
Link — click to select, then copy:
https://breachfeed.com/article/cmtvp1art1gnthmu2orxjsr7eView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to exfiltrate date or cause a denial-of-service condition. The following versions of NextGen Healthcare Mirth Connect are affected: Mirth Connect <=v4.7.1 (CVE-2026-82583, CVE-2026-78224, CVE-2026-82578) CVSS Vendor Equipment Vulnerabilities v3 8.3 NextGen Healthcare NextGen Healthcare Mirth Connect Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Improper Restriction…
Link — click to select, then copy:
https://breachfeed.com/article/cmtvp1art1gnshmu29zpt94gjView CSAF Summary Successful exploitation of this vulnerability could allow an authenticated remote attacker to write past the end of a heap allocation when Orthanc decodes an attacker-supplied PNG or JPEG image, resulting in a crash of the Orthanc process and a denial-of-service condition. The following versions of Orthanc DICOM Server are affected: Orthanc DICOM Server <1.13.0. (CVE-2026-87020) CVSS Vendor Equipment Vulnerabilities v3 8.1 Orthanc Orthanc DICOM Server Integer Overflow or…
Link — click to select, then copy:
https://breachfeed.com/article/cmtvh2iv117jthmu2hsy7paz1Anthropic is most concerned about Claude Mythos 5’s reckless behavior after recent incidents in which real systems were hacked. The post Widened Scan Turns Up Fourth Rogue Claude Cyber Incident appeared first on SecurityWeek.
Link — click to select, then copy:
https://breachfeed.com/article/cmtvgw3sx17cbhmu2dova009wA newly analyzed Linux rootkit is believed to have given attackers a way to hide shells inside recently compromised F5 BIG-IP Access Policy Management (APM) environments, without leaving the malicious PHP code on disk. Sophos said the malware, found in compromised BIG-IP APM environments using Apache and PHP components, uses custom ELF loading, function hooking, and runtime code patching to establish persistent access. The implant, it said in a blog post, appears to be tailored specifically to…