adminClosing the Approval Gap in AI-Era Ad Tech
The Hacker NewsJul 15, 2026Web Security / Supply Chain Security A single approved marketing tag can quietly load fourth-party code your security team has never seen, granting full access to…
Mié. Jul 29th, 2026
Trending News:
73% of Organizations Say They Are Not Fully Ready for a Major CyberattackCritical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image UploadsNine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance PaymentsThree Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM EscapeRuflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI MemoryCoordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes OfflineResearchers Show a Single Malicious Webpage Visit Can Compromise Tor BrowserMythos Asks the Right Question. It Doesn’t Answer It.Russia Charges Telegram Founder Pavel Durov With Aiding Terrorist ActivityNew Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell CommandsPublic PoC Released for Exploited Check Point SmartConsole Authentication BypassFlying Eagle Android RAT Traces Found on 170 Servers as Source Code CirculatesOpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face BreachTwo Compromised joyfill npm Packages Run RAT When Imported Into Node.jsCifrado de datos en plataformas SaaS: todo lo que debes exigir al proveedorCondenan a un ucraniano a 5 años de cárcel por ayudar a trabajadores de TI norcoreanos a infiltrarse en EE.UU.Encuentran una puerta trasera en un software anti-ransomwareFiltran datos de directivos del INCIBE y de la Policía sin vulnerar los sistemas de estas institucionesCruz Roja Española tendrá que pagar una multa de 80.000 euros por violar la privacidad de pacientesClaude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES AttackCritical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before LoginTengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its ProcessJFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face BreachNimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert RelaysResearcher Says AI Helped Develop Linux Traffic-Control Race Into Root ExploitCritical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging InAttackers Exploit Arista VeloCloud Orchestrator Command Injection FlawMicrosoft Says New Cybersecurity AI Model Helps MDASH Hit 95.95% at Half the CostNVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA FrameworkDysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid DisruptionOperation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams UpdatePublic Exploit Released for Patched vBulletin Pre-Auth Code Execution FlawRogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and Moren8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n ProcessCruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows MalwareGitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package AdoptionTELESHIM Abuses Telegram for C2 in Attacks Against Middle East GovernmentsMalvertising Sends Malware in Pieces, Then Makes the Browser Build the ExecutableDevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate PayoutsCl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCECTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account HijackingFastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched AvailableResearcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as GitGolden Chickens Resurfaces With Four New Malware Families and Modular ImplantsBlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware DeliveryCertighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain ControllerBing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft’s ServersChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing LinkSeeing AI Agents Is Not Enough. Security Teams Must Enforce What They Can DoHacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance MinistryKimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers SayNodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private ChatsFake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 AttacksGoogle Adds Selfie Video Recovery for Users Locked Out of Their AccountsRussian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA CodesChina-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare AttacksAndroid Spyware, PLC Attacks, AI Image Prompt Injection + 12 More StoriesChaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and EdgeClaude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac FilesAttackers Weaponize GitHub Actions Runners to Target cPanel and WHM ServersHow Synthetic Identity Fraud is Coming for Machine IdentitiesNine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL InstallsCheck Point Patches Exploited SmartConsole Flaw Allowing Full Admin AccessAdobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web DataBasic-Fit sufre una brecha de datos que afecta a sus usuarios españolesEl grupo de ransomware Lockbit 5.0 reivindica un ciberataque contra Cegasa EnergíaHackean el sistema de control de inundaciones de la Plaza de San Marcos en VeneciaEl Gobierno prepara una campaña institucional de urgencia por el aumento de la ciberdelincuenciaHelvetia Caser confirma la brecha de datos en un correo enviado a sus clientesGitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP TierUbuntu snap-confine Flaw Could Give Local Users Root on Default Desktop InstallsThe Fastest Path to AI Adoption Runs Through SecurityHackers Exploit Windmill Flaw to Read Arbitrary Server Files Without AuthenticationWhy Modern SOCs Need Multi-Layered DetectionsOpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat BenchmarkMicrosoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review AgentsPolice Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFATrojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working LibraryApple Fixes Hide My Email Bug That Exposed Real Addresses in Mail LogsNightSpire, el ransomware que ha ‘taladrado’ a una ferretería españolaLos hackers también vuelven a lo presencial… y se hacen pasar por personal de TI de tu empresaCypherLoc: el scareware que bloquea el navegador y ya acumula 2,8 millones de ataques en 2026Los ciberataques a proveedores ponen en alerta a las empresas españolasLa Agencia Espacial Española niega haber sufrido un ciberataqueNew Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an ExploitGoogle Launches Gemini 3.5 Flash Cyber AI to Find and Fix Software VulnerabilitiesAWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run CodeZimbra Patches Critical SNMP Command Injection and Four XSS VulnerabilitiesCritical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoCQilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial AccessN-day is Becoming N-Hour. Patching Faster Won’t Save You.Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCsCritical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code ExecutionWordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass ScanningNew ENCFORGE Ransomware Targets AI Model Files in Langflow RCE AttackFakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader MalwareExposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware CampaignMythos Didn’t Break Your Security Program. Your Exposure Window Could.HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050
Chicago 12, Melborne City, USA
Mié. Jul 29th, 2026
Trending News:
73% of Organizations Say They Are Not Fully Ready for a Major CyberattackCritical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image UploadsNine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance PaymentsThree Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM EscapeRuflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI MemoryCoordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes OfflineResearchers Show a Single Malicious Webpage Visit Can Compromise Tor BrowserMythos Asks the Right Question. It Doesn’t Answer It.Russia Charges Telegram Founder Pavel Durov With Aiding Terrorist ActivityNew Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell CommandsPublic PoC Released for Exploited Check Point SmartConsole Authentication BypassFlying Eagle Android RAT Traces Found on 170 Servers as Source Code CirculatesOpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face BreachTwo Compromised joyfill npm Packages Run RAT When Imported Into Node.jsCifrado de datos en plataformas SaaS: todo lo que debes exigir al proveedorCondenan a un ucraniano a 5 años de cárcel por ayudar a trabajadores de TI norcoreanos a infiltrarse en EE.UU.Encuentran una puerta trasera en un software anti-ransomwareFiltran datos de directivos del INCIBE y de la Policía sin vulnerar los sistemas de estas institucionesCruz Roja Española tendrá que pagar una multa de 80.000 euros por violar la privacidad de pacientesClaude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES AttackCritical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before LoginTengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its ProcessJFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face BreachNimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert RelaysResearcher Says AI Helped Develop Linux Traffic-Control Race Into Root ExploitCritical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging InAttackers Exploit Arista VeloCloud Orchestrator Command Injection FlawMicrosoft Says New Cybersecurity AI Model Helps MDASH Hit 95.95% at Half the CostNVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA FrameworkDysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid DisruptionOperation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams UpdatePublic Exploit Released for Patched vBulletin Pre-Auth Code Execution FlawRogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and Moren8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n ProcessCruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows MalwareGitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package AdoptionTELESHIM Abuses Telegram for C2 in Attacks Against Middle East GovernmentsMalvertising Sends Malware in Pieces, Then Makes the Browser Build the ExecutableDevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate PayoutsCl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCECTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account HijackingFastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched AvailableResearcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as GitGolden Chickens Resurfaces With Four New Malware Families and Modular ImplantsBlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware DeliveryCertighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain ControllerBing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft’s ServersChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing LinkSeeing AI Agents Is Not Enough. Security Teams Must Enforce What They Can DoHacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance MinistryKimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers SayNodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private ChatsFake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 AttacksGoogle Adds Selfie Video Recovery for Users Locked Out of Their AccountsRussian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA CodesChina-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare AttacksAndroid Spyware, PLC Attacks, AI Image Prompt Injection + 12 More StoriesChaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and EdgeClaude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac FilesAttackers Weaponize GitHub Actions Runners to Target cPanel and WHM ServersHow Synthetic Identity Fraud is Coming for Machine IdentitiesNine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL InstallsCheck Point Patches Exploited SmartConsole Flaw Allowing Full Admin AccessAdobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web DataBasic-Fit sufre una brecha de datos que afecta a sus usuarios españolesEl grupo de ransomware Lockbit 5.0 reivindica un ciberataque contra Cegasa EnergíaHackean el sistema de control de inundaciones de la Plaza de San Marcos en VeneciaEl Gobierno prepara una campaña institucional de urgencia por el aumento de la ciberdelincuenciaHelvetia Caser confirma la brecha de datos en un correo enviado a sus clientesGitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP TierUbuntu snap-confine Flaw Could Give Local Users Root on Default Desktop InstallsThe Fastest Path to AI Adoption Runs Through SecurityHackers Exploit Windmill Flaw to Read Arbitrary Server Files Without AuthenticationWhy Modern SOCs Need Multi-Layered DetectionsOpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat BenchmarkMicrosoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review AgentsPolice Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFATrojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working LibraryApple Fixes Hide My Email Bug That Exposed Real Addresses in Mail LogsNightSpire, el ransomware que ha ‘taladrado’ a una ferretería españolaLos hackers también vuelven a lo presencial… y se hacen pasar por personal de TI de tu empresaCypherLoc: el scareware que bloquea el navegador y ya acumula 2,8 millones de ataques en 2026Los ciberataques a proveedores ponen en alerta a las empresas españolasLa Agencia Espacial Española niega haber sufrido un ciberataqueNew Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an ExploitGoogle Launches Gemini 3.5 Flash Cyber AI to Find and Fix Software VulnerabilitiesAWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run CodeZimbra Patches Critical SNMP Command Injection and Four XSS VulnerabilitiesCritical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoCQilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial AccessN-day is Becoming N-Hour. Patching Faster Won’t Save You.Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCsCritical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code ExecutionWordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass ScanningNew ENCFORGE Ransomware Targets AI Model Files in Langflow RCE AttackFakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader MalwareExposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware CampaignMythos Didn’t Break Your Security Program. Your Exposure Window Could.HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050
Chicago 12, Melborne City, USA
