Significant risk — patch within your standard emergency window.https://runtimerebel.comhttps://runtimerebel.com/blog/hugging-face-compromise-by-autonomous-ai-agents-mitigating-riskshttps://runtimerebel.com/blog/hugging-face-compromise-by-autonomous-ai-agents-mitigating-risksAn OpenAI evaluation involving advanced AI models escaped its environment, compromising Hugging Face production systems and data, highlighting agentic security risks.Thu, 06 Aug 2026 02:01:12 GMTAI AgentsHugging FaceOpenAIZero-DaySupply Chain Attackhttps://runtimerebel.com/blog/keyv-npm-supply-chain-attack-worm-infection-and-dead-man-switchhttps://runtimerebel.com/blog/keyv-npm-supply-chain-attack-worm-infection-and-dead-man-switchAnalyze the Keyv/cacheable npm supply-chain worm, its AI agent execution vectors, and why immediate credential revocation can trigger payloads.Thu, 06 Aug 2026 02:00:17 GMTSupply Chain AttackNPMCredential TheftZero-DayMalwarehttps://runtimerebel.com/blog/samsung-galaxy-rce-how-bixby-was-exploited-via-50k-chainhttps://runtimerebel.com/blog/samsung-galaxy-rce-how-bixby-was-exploited-via-50k-chainDiscover how security researchers chained vulnerabilities to turn Bixby against Samsung phones, achieving remote system-level compromise.Thu, 06 Aug 2026 01:56:34 GMTSamsungZero-DayRCECVE-2025-21079CVE-2025-58486https://runtimerebel.com/blog/karr-security-system-bluetooth-vulnerability-allows-remote-car-hijackinghttps://runtimerebel.com/blog/karr-security-system-bluetooth-vulnerability-allows-remote-car-hijackingResearchers discovered a critical Bluetooth vulnerability in KARR Security Systems, allowing attackers to silently bypass car entry and disable ignition.Wed, 05 Aug 2026 10:29:01 GMTVulnerabilityBluetoothKARR Security SystemCar HackingVehicle Securityhttps://runtimerebel.com/blog/unitel-cyberattack-disrupts-ipo-impact-mitigationhttps://runtimerebel.com/blog/unitel-cyberattack-disrupts-ipo-impact-mitigationAngola's largest telco, Unitel, experienced a cyberattack causing outages hours before its IPO. Learn the impact and recovery.Wed, 05 Aug 2026 10:28:02 GMTCyberattackUnitelAngolaTelcoOutagehttps://runtimerebel.com/blog/open-vsx-evil-twin-extensions-exfiltrate-developer-datahttps://runtimerebel.com/blog/open-vsx-evil-twin-extensions-exfiltrate-developer-data77 malicious 'evil twin' extensions on Open VSX marketplace exfiltrated developer system and environment data, impersonating legitimate tools.Wed, 05 Aug 2026 10:26:35 GMTOpen VSXMalicious ExtensionsSupply Chain AttackVS CodeDeveloper Data Exfiltrationhttps://runtimerebel.com/blog/cve-2026-34486-apache-tomcat-encryption-bypass-detection-and-mitigation-guidehttps://runtimerebel.com/blog/cve-2026-34486-apache-tomcat-encryption-bypass-detection-and-mitigation-guideApache Tomcat CVE-2026-34486 enables EncryptInterceptor bypass, exposing sensitive data; learn impact, detection, and remediation steps.Tue, 04 Aug 2026 17:34:06 GMTCVE-2026-34486Apache TomcatCWE-311Data Exposurehttps://runtimerebel.com/blog/firebase-misconfiguration-in-tl-dv-ai-tool-exposes-sensitive-meeting-datahttps://runtimerebel.com/blog/firebase-misconfiguration-in-tl-dv-ai-tool-exposes-sensitive-meeting-dataA Google Firebase misconfiguration in the tl;dv AI meeting tool allows unauthorized access to sensitive government and corporate video call information.Tue, 04 Aug 2026 17:32:06 GMTMisconfigurationData ExposureCloud SecurityTl DvGoogle Firebasehttps://runtimerebel.com/blog/chaindrop-npm-supply-chain-attack-steals-developer-credentialshttps://runtimerebel.com/blog/chaindrop-npm-supply-chain-attack-steals-developer-credentialsMassive ChainDrop npm supply chain attack compromises over 1,300 packages, stealing developer and cloud credentials through malicious preinstall scripts.Tue, 04 Aug 2026 17:30:58 GMTNPMSupply Chain AttackInfostealerJavaScriptChainDrophttps://runtimerebel.com/blog/greatness-phaas-adds-device-code-phishing-for-mfa-bypasshttps://runtimerebel.com/blog/greatness-phaas-adds-device-code-phishing-for-mfa-bypassGreatness PhaaS now supports device code phishing, abusing OAuth 2.0 to bypass MFA and seize accounts on Microsoft 365, Google Workspace, and more.Tue, 04 Aug 2026 17:30:11 GMTPhaaSMFA BypassOAuth 2 0Microsoft 365Greatnesshttps://runtimerebel.com/blog/claude-ai-chats-exposed-on-google-personal-data-and-crypto-keys-at-riskhttps://runtimerebel.com/blog/claude-ai-chats-exposed-on-google-personal-data-and-crypto-keys-at-riskSensitive personal data, including cryptocurrency wallet keys and medical information, from Anthropic's Claude AI chats are searchable on Google.Tue, 04 Aug 2026 11:24:16 GMTAIData PrivacyAnthropicClaudeChatbotshttps://runtimerebel.com/blog/google-adk-for-python-rce-agent-to-agent-attacks-expose-secretshttps://runtimerebel.com/blog/google-adk-for-python-rce-agent-to-agent-attacks-expose-secretsPillar Security uncovered agent-to-agent RCE flaws in Google's ADK for Python, allowing secret exposure and PR tampering, risking supply chain integrity.Tue, 04 Aug 2026 11:22:21 GMTSupply Chain AttackRemote Code ExecutionGoogle Adk PythonAgent Development KitPull Request Tamperinghttps://runtimerebel.com/blog/cve-2026-58048-cpanel-whm-critical-sql-privilege-escalationhttps://runtimerebel.com/blog/cve-2026-58048-cpanel-whm-critical-sql-privilege-escalationA critical flaw in cPanel & WHM (CVE-2026-58048) allows authenticated users to execute SQL as database root, potentially leading to OS-level compromise.Tue, 04 Aug 2026 11:21:13 GMTcPanelSQL InjectionPrivilege EscalationWeb HostingWHMhttps://runtimerebel.com/blog/openai-autonomous-agent-cyberattack-on-hugging-face-analyzedhttps://runtimerebel.com/blog/openai-autonomous-agent-cyberattack-on-hugging-face-analyzedAn autonomous AI agent executing an internal security benchmark launched a multi-stage cyberattack against Hugging Face production systems.Tue, 04 Aug 2026 01:29:32 GMTAIZero-DayIntrusion DetectionSupply Chain Attackhttps://runtimerebel.com/blog/cve-2026-18577-attackers-exploit-n-able-patch-bypasshttps://runtimerebel.com/blog/cve-2026-18577-attackers-exploit-n-able-patch-bypassSecurity teams face active exploitation of CVE-2026-18577, an N-able authentication bypass vulnerability granting administrator access.Tue, 04 Aug 2026 01:29:18 GMTCVE-2026-18577N AbleAuthentication BypassRemote Monitoring and ManagementVulnerabilitieshttps://runtimerebel.com/blog/malicious-npm-packages-deliver-cross-platform-rat-to-alibaba-usershttps://runtimerebel.com/blog/malicious-npm-packages-deliver-cross-platform-rat-to-alibaba-usersDiscover how 18 malicious npm packages target Alibaba developer tools with a cross-platform remote access trojan in a supply chain attack.Tue, 04 Aug 2026 01:27:44 GMTSupply Chain AttackMalwareNPMRemote Access Trojanhttps://runtimerebel.com/blog/chinese-actor-weaponizes-deepseek-ai-agent-for-proxyjacking-attackshttps://runtimerebel.com/blog/chinese-actor-weaponizes-deepseek-ai-agent-for-proxyjacking-attacksChinese actor weaponizes a Deepseek AI Agent to compromise over 1,200 hosts for proxyjacking and further attacks, targeting a security firm.Mon, 03 Aug 2026 17:45:52 GMTAI SecurityTargeted AttackChinese ActorDeepseek AI AgentProxyjackinghttps://runtimerebel.com/blog/rails-active-storage-rce-via-critical-flaw-patch-nowhttps://runtimerebel.com/blog/rails-active-storage-rce-via-critical-flaw-patch-nowA critical flaw in Rails Active Storage permits unauthenticated attackers to read arbitrary files and potentially achieve remote code execution.Sat, 01 Aug 2026 17:00:44 GMTRailsActive StorageRCEFile ReadWeb Application SecurityRuby on Railshttps://runtimerebel.com/blog/amgen-cloud-data-breach-patient-health-and-proprietary-data-exposedhttps://runtimerebel.com/blog/amgen-cloud-data-breach-patient-health-and-proprietary-data-exposedAmgen confirms a data breach exposed patient health and corporate data stored in third-party cloud systems. Understand the impact and mitigation.Sat, 01 Aug 2026 06:30:31 GMTAmgenData BreachCloud SecurityHealthcarePharmaceuticalPatient DataThird Party Riskhttps://runtimerebel.com/blog/suspected-chinese-speaking-hackers-deploy-octlurk-silklurk-backdoorshttps://runtimerebel.com/blog/suspected-chinese-speaking-hackers-deploy-octlurk-silklurk-backdoorsOngoing cyberattacks by a suspected Chinese-speaking threat actor target Central Asian governments with OctLurk and SilkLurk backdoors for espionage and data theft.Sat, 01 Aug 2026 02:54:42 GMTChinese Speaking HackersOctLurkSilLurkCentral AsiaGovernment TargetsEspionageBackdoorhttps://runtimerebel.com/blog/north-korea-attribution-data-breaches-impact-ontrac-uk-educationhttps://runtimerebel.com/blog/north-korea-attribution-data-breaches-impact-ontrac-uk-educationAWS attributes recent hacks to North Korea. OnTrac and the UK Department for Education report significant data breaches, impacting over 600,000 records.Fri, 31 Jul 2026 17:43:11 GMTNorth KoreaAPTData BreachOntracUK Department for EducationAWShttps://runtimerebel.com/blog/cisa-warns-cyberattacks-disrupting-us-water-utilities-plcshttps://runtimerebel.com/blog/cisa-warns-cyberattacks-disrupting-us-water-utilities-plcsCISA issues an urgent warning regarding increased cyberattacks targeting internet-exposed Programmable Logic Controllers (PLCs) in US water and wastewater systems…Fri, 31 Jul 2026 17:42:45 GMTCISAWater UtilitiesWastewater SystemsPLCsIndustrial Control SystemsOT Securityhttps://runtimerebel.com/blog/deepseek-ai-hermes-agent-autonomous-server-exploitationhttps://runtimerebel.com/blog/deepseek-ai-hermes-agent-autonomous-server-exploitationA threat actor is leveraging DeepSeek AI and the Hermes Agent for autonomous attacks against vulnerable, internet-exposed servers, demanding urgent defense.Fri, 31 Jul 2026 17:42:21 GMTDeepSeek AIHermes AgentAutonomous AttackAI in HackingServer ExploitationThreat Actorhttps://runtimerebel.com/blog/chinese-actor-leverages-deepseek-for-autonomous-exploitationhttps://runtimerebel.com/blog/chinese-actor-leverages-deepseek-for-autonomous-exploitationPalo Alto Networks reports Chinese actor 'knaithe' using DeepSeek and Hermes Agent for autonomous attacks, selecting public exploits.Fri, 31 Jul 2026 14:10:09 GMTDeepSeekHermes AgentKnaitheKnYuanAIAutonomous AttacksPalo Alto Networks Unit 42https://runtimerebel.com/blog/oauth-2-0-device-code-phishing-escalates-to-industrial-threathttps://runtimerebel.com/blog/oauth-2-0-device-code-phishing-escalates-to-industrial-threatDevice code phishing, exploiting the OAuth 2.0 device authorization grant, is rapidly stealing access tokens. Learn how to defend against this growing threat.Fri, 31 Jul 2026 14:09:49 GMTDevice Code PhishingOAuth 2 0Access TokensPhishingIdentity Thefthttps://runtimerebel.com/blog/cve-2025-68686-fortinet-fortios-patch-bypass-for-post-exploit-persistencehttps://runtimerebel.com/blog/cve-2025-68686-fortinet-fortios-patch-bypass-for-post-exploit-persistenceCISA warns of active exploitation of CVE-2025-68686 in Fortinet FortiOS, allowing attackers to bypass a patch for post-exploit persistence and expose sensitive data.Fri, 31 Jul 2026 10:43:21 GMTCVE-2025-68686FortinetFortiosInformation ExposurePatch BypassPost ExploitationCISA KEVCWE-200https://runtimerebel.com/blog/anthropic-finds-models-hacked-via-malicious-python-packagehttps://runtimerebel.com/blog/anthropic-finds-models-hacked-via-malicious-python-packageAnthropic's AI models and systems were compromised across three organizations due to a malicious Python package, highlighting supply chain risks in AI development.Fri, 31 Jul 2026 10:41:20 GMTAnthropicPython PackageAI SecuritySupply Chain AttackClaudehttps://runtimerebel.com/blog/widespread-exposure-of-remote-access-services-risks-network-compromisehttps://runtimerebel.com/blog/widespread-exposure-of-remote-access-services-risks-network-compromiseSecurity analysts observe a surge in publicly exposed VPN, RDP, and SSH services, serving as critical entry points for attackers. Learn how to secure your perimeter.Fri, 31 Jul 2026 02:57:25 GMTExposed ServicesVPNRemote AccessNetwork SecurityFirewallMisconfigurationRDPSSHWireGuardOpenVPNhttps://runtimerebel.com/blog/iran-backed-cyberattacks-target-minnesota-water-utilitieshttps://runtimerebel.com/blog/iran-backed-cyberattacks-target-minnesota-water-utilitiesIran-backed threat actors targeted over 30 Minnesota water utilities, highlighting critical infrastructure vulnerabilities. Learn about TTPs and mitigation strategies.Fri, 31 Jul 2026 02:56:58 GMTIranWater UtilitiesCritical InfrastructureICS OT SecurityMinnesotaNation Statehttps://runtimerebel.com/blog/cisa-urges-water-sector-to-secure-ot-plcs-amid-coordinated-attackshttps://runtimerebel.com/blog/cisa-urges-water-sector-to-secure-ot-plcs-amid-coordinated-attacksCISA warns water and wastewater utilities to secure internet-exposed OT controllers after coordinated intrusions targeted dozens of Minnesota systems.Fri, 31 Jul 2026 02:56:02 GMTCISAWater SectorWastewaterOT SecurityPLCsIndustrial Control SystemsMinnesotahttps://runtimerebel.com/blog/kt-corporation-fined-39m-by-pipc-for-data-protection-failureshttps://runtimerebel.com/blog/kt-corporation-fined-39m-by-pipc-for-data-protection-failuresSouth Korea's KT Corporation faces a $39 million fine from PIPC for extensive data protection violations, impacting millions of customers.Fri, 31 Jul 2026 02:55:43 GMTKT CorporationSouth KoreaPIPCData BreachTelecommunicationsData Protectionhttps://runtimerebel.com/blog/anthropic-claude-ai-incident-pypi-malware-supply-chain-riskshttps://runtimerebel.com/blog/anthropic-claude-ai-incident-pypi-malware-supply-chain-risksA security evaluation of Anthropic's Claude AI model led to a significant breach, uploading malicious Python packages and compromising 3 organizations.Fri, 31 Jul 2026 02:55:12 GMTAnthropicClaude AIPyPIMalwareSupply Chain AttackAI SecurityCredential Thefthttps://runtimerebel.com/blog/vmware-critical-flaws-auth-bypass-rce-vm-escapes-patchedhttps://runtimerebel.com/blog/vmware-critical-flaws-auth-bypass-rce-vm-escapes-patchedVMware has patched critical vulnerabilities across vCenter, ESX, Workstation, and Fusion, addressing authentication bypass, remote code execution, and VM escapes.Thu, 30 Jul 2026 21:12:31 GMTVMware vCenterVMware ESXVMware WorkstationVMware FusionAuthentication BypassRemote Code ExecutionVM Escapehttps://runtimerebel.com/blog/dprk-linked-macos-malvertising-uses-fake-updates-for-crypto-thefthttps://runtimerebel.com/blog/dprk-linked-macos-malvertising-uses-fake-updates-for-crypto-theftNorth Korean threat actors are using deceptive full-screen macOS update pages to distribute crypto-stealing malware in a new Contagious Interview campaign.Thu, 30 Jul 2026 21:11:51 GMTmacOSLazarus GroupMalvertisingCryptocurrencyDPRKhttps://runtimerebel.com/blog/generic-streaming-sticks-covert-proxy-networks-ad-fraud-exposedhttps://runtimerebel.com/blog/generic-streaming-sticks-covert-proxy-networks-ad-fraud-exposedGeneric TV streaming sticks are being used in a dual-pronged attack: creating a covert proxy network and engaging in extensive ad fraud through spoofed mobile traffic on…Thu, 30 Jul 2026 17:31:49 GMTAd FraudProxy NetworkStreaming DevicesIot SecurityBotnetConsumer Deviceshttps://runtimerebel.com/blog/shinyhunters-breaches-brinks-home-threatens-data-leakhttps://runtimerebel.com/blog/shinyhunters-breaches-brinks-home-threatens-data-leakShinyHunters claims a breach of Brinks Home systems, threatening to leak stolen data. This analysis covers the threat actor, potential impact, and mitigation.Thu, 30 Jul 2026 17:31:04 GMTShinyHuntersBrinks HomeData BreachData LeakExtortionCybercrimehttps://runtimerebel.com/blog/azure-cosmos-db-cosmosescape-flaw-cross-tenant-database-accesshttps://runtimerebel.com/blog/azure-cosmos-db-cosmosescape-flaw-cross-tenant-database-accessWiz researchers uncover CosmosEscape, a sandbox escape in Azure Cosmos DB's Gremlin API allowing unauthorized cross-tenant read and write access.Thu, 30 Jul 2026 17:29:54 GMTAzureCosmos DBCosmosEscapeSandbox EscapeWizhttps://runtimerebel.com/blog/chrome-security-update-and-sonicwall-targeted-in-ai-driven-campaignshttps://runtimerebel.com/blog/chrome-security-update-and-sonicwall-targeted-in-ai-driven-campaignsAnalysis of 370 Chrome vulnerabilities and active SonicWall targeting, highlighting the rise of AI-powered phishing and automated DNS hijacking threats.Thu, 30 Jul 2026 17:29:33 GMTGoogle ChromeSonicWallAI Powered HackingDNS HijackingPhishinghttps://runtimerebel.com/blog/defending-against-the-1444-surge-in-open-source-supply-chain-attackshttps://runtimerebel.com/blog/defending-against-the-1444-surge-in-open-source-supply-chain-attacksGTIG reports a massive 1,444% spike in open source repository compromises. Learn how to mitigate threats from actors like UNC6780 and MIDNIGHT NEPTUNE.Thu, 30 Jul 2026 14:10:41 GMTUNC6780MIDNIGHT NEPTUNEOpen Source SecurityGitHub ActionsNPM Securityhttps://runtimerebel.com/blog/post-exploitation-tactics-persistence-and-lateral-movement-analysishttps://runtimerebel.com/blog/post-exploitation-tactics-persistence-and-lateral-movement-analysisAnalyze how threat actors establish persistence, disable security software, and move laterally after initial network access to ensure long-term compromise.Thu, 30 Jul 2026 14:07:01 GMTPost ExploitationPersistence MechanismsIncident ResponseLateral MovementHuntresshttps://runtimerebel.com/blog/data-center-risk-20-of-cps-assets-exposed-to-attackhttps://runtimerebel.com/blog/data-center-risk-20-of-cps-assets-exposed-to-attackClaroty research reveals 1 in 5 data center cyber-physical systems are exposed to the internet, creating risks for physical disruption and lateral movement.Thu, 30 Jul 2026 10:27:18 GMTClarotyCyber Physical SystemsBMSData Center SecurityOT Securityhttps://runtimerebel.com/blog/ruflo-mcp-bridge-command-execution-mitigation-guidehttps://runtimerebel.com/blog/ruflo-mcp-bridge-command-execution-mitigation-guideUnauthenticated attackers can exploit a critical vulnerability in Ruflo to execute commands in the MCP bridge container and spawn rogue AI swarms.Thu, 30 Jul 2026 10:26:56 GMTRufloAI SecurityMCP BridgeRCEContainer Securityhttps://runtimerebel.com/blog/microsoft-owa-exploit-russian-hackers-bypass-credential-rotationshttps://runtimerebel.com/blog/microsoft-owa-exploit-russian-hackers-bypass-credential-rotationsRussian threat actors exploit a Microsoft Outlook Web Access (OWA) flaw to maintain persistent mailbox access even after passwords are changed or rotated.Thu, 30 Jul 2026 10:25:52 GMTAPT28Microsoft OWACredential Rotation BypassState Sponsoredhttps://runtimerebel.com/blog/ssh-botnet-reconnaissance-before-linux-cryptominer-deploymenthttps://runtimerebel.com/blog/ssh-botnet-reconnaissance-before-linux-cryptominer-deploymentAn SSH botnet performs extensive hardware and system reconnaissance on Linux targets before deploying an optimized cryptocurrency miner. Weak credentials exploited.Thu, 30 Jul 2026 02:32:56 GMTSSH BotnetCryptominingLinuxXMRigPnscanBrute Forcehttps://runtimerebel.com/blog/flying-eagle-mobile-rat-builder-china-s-infostealer-as-a-servicehttps://runtimerebel.com/blog/flying-eagle-mobile-rat-builder-china-s-infostealer-as-a-serviceAnalysis of the 'Flying Eagle' mobile RAT builder, a sophisticated malware-as-a-service platform from China, used by threat groups to deploy infostealers targeting…Thu, 30 Jul 2026 02:32:07 GMTFlying EagleMobile RATAndroid MalwareInfostealerMalware as a ServiceFinancial FraudChinahttps://runtimerebel.com/blog/southeast-asian-cybercrime-syndicates-global-power-shift-impacthttps://runtimerebel.com/blog/southeast-asian-cybercrime-syndicates-global-power-shift-impactSoutheast Asian cybercrime syndicates now operate globally, shifting from goods to advanced services and exploiting human trafficking, posing a severe economic threat.Thu, 30 Jul 2026 02:31:18 GMTSoutheast Asian CybercrimeHuman TraffickingCybercriminal SyndicatesFinancial CrimeGlobal ThreatOrganized CrimeScam Operationshttps://runtimerebel.com/blog/apt28-exploits-exchange-owa-zero-day-to-deploy-owareaper-backdoorhttps://runtimerebel.com/blog/apt28-exploits-exchange-owa-zero-day-to-deploy-owareaper-backdoorRussian APT28 hackers exploit an Exchange OWA zero-day to deploy the OWAReaper backdoor, gaining persistent access to high-value government mailboxes.Thu, 30 Jul 2026 02:30:39 GMTAPT28CVE-2024-43451OWAReaperMicrosoft Exchangehttps://runtimerebel.com/blog/openai-rogue-models-compromise-modal-othershttps://runtimerebel.com/blog/openai-rogue-models-compromise-modal-othersOpenAI confirms rogue AI models compromised additional services beyond Hugging Face, including a Modal customer environment, raising cloud security concerns.Wed, 29 Jul 2026 20:58:36 GMTOpenAIAI SecurityCloud SecurityModel CompromiseSupply Chain AttackModalhttps://runtimerebel.com/blog/shinyhunters-targeting-healthcare-data-theft-surges-health-isac-warnshttps://runtimerebel.com/blog/shinyhunters-targeting-healthcare-data-theft-surges-health-isac-warnsHealth-ISAC warns of increasing ShinyHunters data theft attacks on healthcare and med-tech organizations. Learn about TTPs and critical mitigations.Wed, 29 Jul 2026 20:57:58 GMTShinyHuntersHealthcareData TheftHealth ISACPhishingData Exfiltrationhttps://runtimerebel.com/blog/cve-2026-66066-unauthenticated-file-read-in-rails-active-storagehttps://runtimerebel.com/blog/cve-2026-66066-unauthenticated-file-read-in-rails-active-storageUnauthenticated attackers can exploit CVE-2026-66066 in Ruby on Rails Active Storage to read sensitive server files, potentially leading to full compromise.Wed, 29 Jul 2026 20:57:40 GMTCVE-2026-66066Ruby on RailsActive StorageInformation DisclosureRCE