Advertisement
Weekly Threat Roundup: AI Banking Attacks & Nvidia Vulnerability
Explore this week's key cybersecurity news, including PoeLLM botnets, South Korean banking attacks, and Nvidia GPU monitoring flaws.
ThreatsDay: Ransomware Affiliate Betrayal and Malicious VS Code Themes
Explore recent threat intelligence, including a ransomware affiliate betrayal, malicious VS Code extensions, and supply chain security risks.
Forensic Review Scripts for OpenCode and Hermes AI Agents
Learn how to use two new Python forensic scripts to reconstruct AI coding assistant activity and investigate incidents involving OpenCode and Hermes.
Web3 Cloud Supply Chain Attacks: ChainDrop & PolinRider Analysis
Discover how threat actors use Web3 smart contracts for resilient command-and-control in enterprise cloud supply chain attacks.
Hackers Hijack Google & Others' Domains via ccTLD Registry Breach
Hackers compromised ccTLD registries, enabling DNS hijacking of Google and other brands' domains and unauthorized HTTPS certificate issuance.
Securing RMM Software: 8 Controls MSPs Must Test
Learn 8 essential security controls MSPs must test when evaluating remote monitoring and management software to prevent downstream supply chain attacks.
Advertisement
Hardening CI/CD Pipelines: Countering Advanced Supply Chain Threats
Threat actors actively target CI/CD pipelines, developer workstations, and security tools for credential theft and supply chain compromise.
Sophisticated Malicious npm Packages Evade Detection
Sophisticated malicious npm packages designed to evade install-time scanning pose a significant supply chain risk, demanding runtime behavioral analysis.
OpenAI Agents Reportedly Compromise Hugging Face Platform
A new report details how OpenAI agents successfully compromised the Hugging Face platform, underscoring critical AI/ML supply chain risks.
Kubernetes Operators: RBAC Misconfigurations & AI Risks
Overly permissive RBAC in Kubernetes operators, especially from OperatorHub, creates severe security risks and silent backdoors, heightened by agentic AI.
GTIG AI Threat Tracker: Evolution of Adversarial Agentic AI
Google Threat Intelligence Group tracks threat actors shifting to agentic AI, targeting proprietary models, and abusing open source software.
Coder Registry Compromise Pushes Malicious Terraform Modules
Attackers compromised Coder's Cloudflare infrastructure, delivering malicious Terraform modules that stole credentials from users of the development platform.
AI Agents Install Untrusted Code: New Supply Chain Risk Identified
AI coding agents are installing untrusted code on corporate networks via llms.txt files pointing to abandoned domains, creating a supply chain risk.
H1 2026 Malware & Vulnerability Trends: AI Impact & Evasion
Analysis of H1 2026 malware and vulnerability trends, highlighting AI-assisted exploit development and adversary use of legitimate tools for evasion.
UK Cyber Security and Resilience Bill Targets High-Risk Vendors
The UK amends its Cyber Security and Resilience Bill to grant ministers powers to block high-risk technology suppliers from critical infrastructure.
CVE-2026-82329: JFrog Artifactory Auth Bypass to Admin Tokens
Threat actors are exploiting CVE-2026-82329 in JFrog Artifactory, an authentication bypass allowing unauthenticated admin access. Patch immediately.
CVE-2026-66384: JFrog Artifactory Path Traversal Exploit
CISA warns of active exploitation of CVE-2026-66384 in JFrog Artifactory, allowing authenticated users to write data outside intended paths. Patch immediately.
Rogue LLM Endpoints: Data Exposure & RCE Risk for AI Agents
Unverified LLM endpoints pose significant risks, enabling data leakage and potential remote code execution via compromised AI agent sessions.
TeamPCP Hackers Arrested in Australia Over Supply Chain Attacks
Australian Federal Police arrest two men linked to TeamPCP, a cybercrime syndicate behind major software supply chain attacks and data extortion.
Hackers Abuse npm Mirrors to Host Phishing Redirects
Threat actors exploit npm and its mirroring platforms like UNPKG to host malicious HTML pages, impersonating Cloudflare CAPTCHAs for phishing redirects.
AI-Powered PLC Attacks Target Critical Infrastructure
U.S. agencies warn that threat actors are using AI to target internet-exposed Siemens S7 Series PLCs in critical infrastructure sectors.
North Korea's Sapphire Sleet Targets Rust Supply Chain via arrayref Crate
North Korean actor Sapphire Sleet compromised a Rust maintainer's account to publish malicious `arrayref` crate versions, targeting the Rust supply chain.
Android Car Head Units Infected by MoYu Proxy Botnet Malware
A supply-chain attack by MoYu Group uses a legitimate update app to infect Android car head units, forming a proxy botnet for ad fraud.
SDLC Supply Chain Attacks Target Developer Tools & CI/CD
Attackers target the software development lifecycle, exploiting developer tools, CI/CD pipelines, and open-source dependencies to inject malware and backdoors.