TECHZONE™

AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files https://thehackernews.com/2026/08/ai-mind-viruses-can-spread-between.html Security researchers at Anthropic and Switzerland's EPFL have demonstrated that self-propagating payloads can spread from one artificial intelligence (AI) agent to the next through the editable system prompt files that autonomous agent harnesses use to carry state between sessions. The work, released as a preprint on August 10, 2026, tests the technique in a simulated six-agent coding

TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to.html Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT. "TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a technical report shared with The Hacker News. "Tasking flows through SharePoint Online file

One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025 https://thehackernews.com/2026/08/one-attacker-has-scraped-both.html A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a

16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets https://thehackernews.com/2026/08/16-typosquatted-rubygems-packages-steal.html Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker. The complete list of packages published as part of the campaign is below - ubnuler ubnlder ri18nr reaker rakier orakw joxn

SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers https://thehackernews.com/2026/08/safepal-hardware-wallet-maker-says-flaw.html SafePal has disclosed that an authorization flaw in an order-tracking plug-in exposed the names, email addresses, shipping addresses, phone numbers, and purchase details of approximately 39,798 customers. The hardware wallet maker said all affected customers were notified individually by email on August 16 from security@safepal.com, with the subject line "[Important] Your SafePal Order

CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE https://thehackernews.com/2026/08/cisa-flags-actively-exploited-ray-flaw.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical flaw impacting Ray to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Ray is an open-source, Python-native distributed computing framework designed to scale artificial intelligence and machine learning workloads. As of writing, the GitHub project has more than

How QR-code phishing can slip past corporate security measures https://www.welivesecurity.com/en/business-security/qr-code-phishing-slip-past-corporate-security-measures/ Quishing has become a popular alternative to traditional phishing. Here’s how businesses can close the gap.

Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects https://thehackernews.com/2026/08/critical-gitlab-graphql-flaw-could-let.html GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data. The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4. Released on

Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection https://thehackernews.com/2026/08/snowflake-github-actions-flaw-lets_0330881554.html Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials. The issue was present in .github/workflows/jira_issue.yml, which ran when a

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher who goes by the online alias "

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic https://thehackernews.com/2026/08/cavern-c2-uses-dns-and-google-apps.html Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Russian cybersecurity company Kaspersky said its ongoing monitoring of the threat activity cluster since December 2025 has led to the discovery of previously unreported components that expand the

SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch https://thehackernews.com/2026/08/sap-commerce-cloud-cve-2026-58231.html A maximum-severity security vulnerability impacting SAP Commerce Cloud is witnessing active exploitation efforts. The vulnerability, tracked as CVE-2026-58231, is rated 10.0 on the CVSS scoring system. It relates to an instance of insufficient authorization checks and input validation. "SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit

Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner https://thehackernews.com/2026/08/apple-macos-screen-sharing-flaw.html A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner, the Netherlands National Cyber Security Centre (NCSC) has warned. The vulnerability in question is CVE-2026-65400 (CVSS score: 9.8), a critical authentication issue impacting the Screen Sharing component that could allow an attacker already on the network to

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware https://thehackernews.com/2026/08/hackers-spend-nearly-7-million-on.html Threat actors are acquiring expired domains to inherit website traffic and reputation to redirect victims to scams and malware on a large scale. DNS threat intelligence firm Infoblox has given the name dropcatch domains to those that get a second chance, where an expired domain becomes available for registration and is then snapped up by another party. During the first half of 2026, 50,400

IAM Compliance Requirements and Best Practices https://thehackernews.com/2026/08/iam-compliance-requirements-and-best.html IAM compliance is the practice of demonstrating that identity and access controls are not only documented but actually enforced across users, applications, infrastructure, and non-human identities. This guide explains what IAM compliance requires, which regulations matter, and how organizations move from periodic access reviews toward continuous, evidence-backed verification that auditors can

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth https://thehackernews.com/2026/08/mustang-panda-adds-signed-windows.html The threat actor known as HoneyMyte (aka Mustang Panda) has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information. Russian cybersecurity vendor Kaspersky said it identified victims in Myanmar, Mongolia, Pakistan,

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers https://thehackernews.com/2026/08/chrome-devtools-technique-enables.html Cybersecurity researchers have detailed a post-exploitation technique that enables the Chrome DevTools Protocol (CDP) inside a running Google Chrome or Microsoft Edge process on Windows, allowing an operator to access cookies, saved data, and authenticated browser sessions. The technique assumes that an operator already has code execution on the Windows host and does not involve

CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps https://thehackernews.com/2026/08/ctm360-uncovers-over-3000-recruitment.html Cybersecurity researchers have uncovered a large-scale, global recruitment-themed phishing campaign that uses fake interview scheduling pages and Browser-in-the-Browser (BitB) windows to steal Google and Facebook credentials and, in more advanced cases, relay multi-factor authentication (MFA) prompts in real time. CTM360, which detailed the activity in a new report titled RecruitTrap, said it

Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware https://thehackernews.com/2026/08/apple-warns-users-in-110-countries-they.html Apple on Thursday sent a fresh batch of notifications to customers whom it suspects may have been targeted by mercenary spyware attacks. In a statement shared with TechCrunch, the iPhone maker said it alerted an unspecified number of users targeted in 110 countries and that it has notified customers in over 150 countries to date. Apple began sending threat notifications to users in late 2021.

Trump Memo Paves Way for U.S. Firms to Hack and Disrupt Foreign Crime Groups https://thehackernews.com/2026/08/trump-memo-paves-way-for-us-firms-to.html A new White House memo signed by U.S. President Donald Trump has instructed the National Coordination Center (NCC) to establish a program that would allow private sector companies to take advantage of their "innovative capabilities" to break into foreign Transnational Criminal Organizations (TCOs) and disrupt them. "By partnering with vetted United States companies subject to the direction and