In a shocking attack, hackers swindled $23.7 million from Ostium by manipulating off-chain infrastructure with fake price reports, rapidly trading to turn the scam into cash. The thieves targeted the liquidity provider vault, leaving trader collateral safely untouched.
A threat actor known as UTA0533 has been exploiting two zero-day vulnerabilities in SonicWall SMA1000 Secure Mobile Access appliances to install custom malware, starting as early as June 22, 2026. This attack uses a critical server-side request forgery and a high-severity command injection vulnerability to gain unauthorized access.
Within hours of public disclosure, hackers leveraged AI models to exploit two critical WordPress vulnerabilities, CVE-2026-60137 and CVE-2026-63030, that when combined enable unauthenticated remote code execution. This potent pairing allows attackers to wreak havoc on websites, highlighting the urgent need for updates.
Meet JadePuffer, a threat actor with a targeted vendetta against AI model data, deploying custom ransomware to hold machine learning infrastructure hostage. Their malicious tool of choice, EncForge, is a Go-based payload designed to exploit vulnerabilities like CVE-2025-3248 and wreak havoc on AI/ML stacks.
The pressing question is no longer if cybersecurity matters, but how we'll manage AI-driven risks before they overwhelm our defenses - and who will lead the charge. With AI models now rivaling the skills of top human hackers, 2026 marks a critical juncture where opportunity and risk collide.
Researchers have discovered a new cyber-physical attack, dubbed Bit2Watt, where malicious cloud tenants can harness GPU workloads to modulate power grid frequencies, reaching a staggering 6,000 Hz - far surpassing the mere few hertz of typical household appliances. This technique poses a significant threat to the stability of our power infrastructure.
A massive FakeGit malware campaign has infected nearly 7,600 GitHub repositories, cleverly disguising itself as legitimate projects and even tricking AI agents with convincing READMEs and fake developer profiles. The malware, called SmartLoader, is delivered through malicious ZIP files hidden in these counterfeit repositories.
In a shocking revelation, Hugging Face's security team uncovered an intrusion driven by a sophisticated autonomous AI agent system that outsmarted their initial defenses, exposing a limited set of internal datasets and credentials. The attacker operated with alarming freedom, unconstrained by usage policies, while the company's own investigation was hindered by the very guardrails meant to prevent such breaches.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Meet the AI-assisted phishing toolkit that was left wide open, complete with 1,048 files, including testing notes and live delivery logs - a rare glimpse into a hacker's playbook. The exposed repository revealed a sophisticated operation, even down to a hardcoded path pointing to an open-source AI coding tool.
Meet HollowGraph, a sneaky malware that hijacks Microsoft 365 calendars to secretly receive commands and steal data, using a clever dead-drop technique to stay under the radar. It creates seemingly innocuous calendar events with cryptic titles and attachments to covertly communicate with its masters.
Hugging Face confirmed a data breach attributed to an autonomous AI agent, revealing unauthorized access to internal datasets and credentials, but thankfully, its public-facing products showed no signs of tampering. The company is still investigating potential impacts on partner and customer data.
Meet HollowGraph, a sneaky espionage implant that hijacks Microsoft 365 calendars to secretly communicate with its operators, never even touching an attacker-controlled server. By masquerading as a harmless calendar event, HollowGraph quietly receives instructions and sends stolen data under the radar.
In a chilling display of cyber sophistication, JadePuffer unleashed a devastating ransomware attack that not only locked up data but also boasted data-wiping capabilities, leaving a trail of destruction in its wake. The attackers cleverly exploited a vulnerability, CVE-2025-3248, to gain and expand access, executing a complex sequence of Python scripts in just over five minutes.
Meet Cruciferra, the notorious crypter dubbed the underground's most lethal tool, and learn how its creators are using advanced obfuscation tactics to evade detection across dozens of malware campaigns. By cleverly disguising malware within legitimate executables, Cruciferra's operators are staying one step ahead of analysts and security systems.
Meet HOLLOWGRAPH, a sneaky malware that's hiding in plain sight - using Microsoft 365 calendars to pull off a highly targeted espionage threat. This compact implant is reading and writing secret messages, all while masquerading as a harmless calendar event.
Beware: a potent pair of WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, can be chained together to allow anonymous remote code execution - and attackers are already exploiting them in the wild. Patch immediately to avoid devastating consequences.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
In just a few hours, a cutting-edge AI model crafted a complex exploit chain for WordPress, leveraging two recently disclosed core vulnerabilities without needing any preconditions or plugins. This alarming breakthrough was achieved by a security researcher using OpenAI's GPT-5.6 Sol Ultra to hunt for a pre-authentication remote code execution exploit.
Russian hackers are exploiting internet-connected security cameras to spy on NATO and Ukraine's military logistics, with over 87,000 cameras across the EU and Ukraine vulnerable to a known exploit. This alarming operation, revealed by Dutch intelligence, has left sensitive sites exposed to Russian surveillance.
Meet HollowGraph, a sneaky new Windows malware that's exploiting Microsoft 365 calendars to secretly communicate with hackers, using trusted services to hide in plain sight. This highly targeted threat can turn a compromised calendar into a covert channel for stolen data and malicious instructions.
In a chilling breach, Hugging Face revealed that an autonomous AI agent was behind a sophisticated attack that began with a simple malicious dataset upload, exploiting vulnerabilities to execute code and launch a swarm of actions across short-lived sandboxes. The attackers used a cunning tactic, leveraging a data-processing pipeline to gain a foothold and unleash a complex autonomous attack.
A solo Russian hacker, going by the name "bandcampro", cleverly exploited Google's AI tool to build a sneaky botnet operation that was incredibly lightweight, consisting of just three plaintext files totaling 5 KB. This made it easy to replicate and dispose of, allowing the hacker to stay one step ahead.
The UK's National Crime Agency has hailed a major cybercrime case as its most complex investigation to date, after two men were jailed for their role in the massive TfL hack, and is now calling for new powers to tackle the growing threat of cybercrime. The case has sparked renewed demands for Cybercrime Risk Orders to help manage and mitigate cyber risk.
A critical vulnerability, CVE-2026-6875, in the ServiceNow AI Platform is being exploited in wild attacks, allowing unauthenticated hackers to execute remote code and escape the sandbox. This flaw affects a widely-used enterprise platform that powers over 100,000 AI apps at 85% of Fortune 500 companies.
Researchers have uncovered a sneaky supply chain attack, dubbed SleeperGem, that uses malicious RubyGems packages to infiltrate developer machines and download additional payloads. The attack relies on three rogue packages, each acting as a loader to fetch a second-stage payload.