Anthropic has revealed that three of its Claude AI models accidentally gained unauthorized access to the live systems of three real organizations during internal cybersecurity testing. The company discovered the incidents after reviewing more than 141,000 evaluation sessions following a similar AI security event reported by another AI company. According to Anthropic, the problem was … Continued
South Korea’s Personal Information Protection Commission (PIPC) has imposed a fine of 53.979 billion won (around $39 million) on telecommunications giant KT Corporation after finding serious violations of the country’s personal data protection laws. The investigation found that attackers remained inside KT’s internal network for nearly 11 months, from October 8, 2024, to September 5, … Continued
A Chinese cybercrime group known as SilverFox has been linked to a new cyberattack targeting a Japanese manufacturing company. Security researchers found that the attackers used an advanced hacking method called Bring Your Own Vulnerable Driver (BYOVD) to bypass Windows security and secretly install ValleyRAT, a remote access trojan that allows attackers to control infected … Continued
Hackers have launched a new cyber campaign by abusing a security flaw in AnySign4PC, a widely used digital authentication software in South Korea. Instead of directly targeting victims, the attackers first compromised trusted Korean websites and secretly injected malicious code into them. Anyone visiting these websites with a vulnerable version of AnySign4PC installed could become … Continued
A newly disclosed security vulnerability in Gitea has raised serious concerns for organizations that host their own Git repositories. The flaw allows users with normal repository write access to trigger remote code execution (RCE) on the server by planting a malicious Git hook. Security researchers have classified the issue as critical because it can lead … Continued
In a major legal escalation against big tech, Russian authorities have officially filed criminal charges against Telegram founder Pavel Durov. The Federal Security Service announced that Durov is accused of aiding terrorist activities by allowing hazardous content to persist on his messaging platform. Russian security agencies claim Telegram failed to remove specific channels and bots … Continued
Security researchers have discovered two new ″Confused Deputy″ vulnerabilities affecting Microsoft Azure and Google Cloud Platform (GCP). The flaws could allow attackers to misuse trusted cloud services and gain higher privileges than they should normally have. The findings were reported by independent security researcher Justin O’Leary. A Confused Deputy vulnerability happens when a trusted cloud … Continued
Cybersecurity researchers have uncovered a sophisticated cyber-espionage campaign targeting Thailand’s Ministry of Finance. The investigation revealed that attackers used an open-source AI assistant called Hermes to automate many post-exploitation activities after gaining access to the ministry’s systems. Researchers discovered the operation while analyzing exposed attacker infrastructure that accidentally revealed valuable evidence about the ongoing attack. … Continued
Cybersecurity researchers have uncovered a new phishing campaign called Operation BlueDash that tricks users into installing legitimate remote management tools through a fake Microsoft Teams update. The attackers send phishing emails containing a so-called secure document that appears genuine. When victims try to open the file, they are redirected to a fake Microsoft Store page. … Continued
A critical security vulnerability has been discovered in n8n, a popular open-source workflow automation platform used by organizations to automate business tasks and connect applications. Security researchers found that users with permission to create or edit workflows could escape the platform’s security sandbox and execute operating system commands on the server running n8n. This issue … Continued
