cybersecurity

Researchers say a threat actor ran the open-source Hermes AI agent in unattended "YOLO" mode to probe Thailand's Ministry of Finance, deploying a web shell and staging a custom Go implant.

A joint US advisory says Iran-linked hackers are exploiting exposed industrial controllers at water and energy providers, and disabled shutdown alarms at one breached facility.

A shared Bluetooth key in dealer-installed KARR/SWDS anti-theft devices lets nearby attackers unlock or immobilize at least 2.2 million cars, UC San Diego researchers found.

A breach at gig-work platform Paidwork exposed names, bank details, and bcrypt-hashed passwords for over 23 million users, per Have I Been Pwned.

A 16-year-old use-after-free bug in Linux's KVM hypervisor, dubbed Januscape and rated CVSS 8.8, lets malicious VMs escape to the host on both Intel and AMD systems; OVHcloud patched roughly a million VMs across its fleet in an 11-day campaign.

GitHub is halving public bug bounty payouts starting July 27, reserving its largest rewards for a new invite-only VIP tier as it fights a flood of low-quality, AI-generated reports.

The Linux Foundation and roughly 20 companies including AWS, Anthropic, Google, IBM and major banks launched Akrites, a coordinated incident-response alliance for open source software, after finding fewer than 5% of recently surfaced vulnerabilities have been patched.

Hugging Face disclosed that an autonomous AI agent system breached its data-processing pipeline over a weekend, harvesting credentials before defenders turned to a self-hosted open-weight model to analyze the attack.

WordPress shipped 7.0.2 and 6.9.5 on July 17 and enabled forced auto-updates to fix wp2shell, a two-CVE chain allowing unauthenticated remote code execution in core, as public proof-of-concept exploits circulate.

Kaspersky's GReAT team found a new Go-language RAT and toolkit hitting government and diplomatic targets in Southeast Asia, with a possible link to the TetrisPhantom espionage actor.

JetBrains disclosed six vulnerabilities across IntelliJ IDEA, TeamCity, and YouTrack on July 16, led by a critical 9.8 CVSS path-traversal flaw in IntelliJ IDEA.

IBM and Red Hat launched commercial Lightwell offerings on July 8, building on their $5 billion pledge to secure open source software supply chains.