Hugging Face disclosed a groundbreaking cyberattack in which an autonomous AI agent independently executed the entire intrusion—from initial compromise to privilege escalation and lateral movement. The attacker exploited vulnerabilities in the dataset-processing pipeline, performing more than 17,000 automated actions over a single weekend without direct human control. Although public models, datasets, and the software supply […]
Indirect prompt injection is the most widespread and serious vulnerability in AI agents today, not just a theoretical risk. Research shows attacks can transfer across models and behaviors, revealing a fundamental weakness in how agents interpret context. More capable models aren’t safer, high performance often comes with equally high vulnerability. Attacks are especially dangerous because […]
Security researchers uncovered “Coruna,” a powerful iPhone exploit toolkit containing 23 exploits and five attack chains that can compromise devices. The toolkit can infect iPhones simply by visiting a malicious website, requiring little or no user interaction. Evidence suggests it was originally built for U.S. intelligence contractors, but the tools were leaked. After the leak, […]
Logitech reports attackers stole data likely belonging to customers, employees, and suppliers. The breach stemmed from a zero-day flaw in a third-party software platform that has since been patched. Logitech has not disclosed which data types or which platform were affected. The Cl0p ransomware group claims it exploited an Oracle E-Business Suite vulnerability to access […]
Clorox is suing IT provider Cognizant after a 2023 ransomware attack cost the company $380 million. The lawsuit claims Cognizant’s helpdesk handed over employee passwords to attackers posing as staff. No hacking skills were needed, just a phone call and a convincing story, Clorox alleges. Cognizant denies responsibility, stating it only offered limited helpdesk support. […]
Victims of Finland’s largest psychotherapy data breach are seeking higher compensation. In 2020, a hacker stole sensitive information from 40,000 clients of Vastaamo, including patient records, and used it for extortion. While the Finnish government has offered compensation ranging from €500 to €1500, lawyers argue that this is insufficient, given the severe privacy violations the […]
The UK’s Electoral Commission leaked personal details of 40 million voters due to unpatched vulnerabilities in their Microsoft Exchange Server, spanning registrations from 2014 to 2022. Hackers accessed the server through known ProxyShell vulnerabilities in August and October 2021, installing malware and sending spam before the issues were detected and partially mitigated. The ICO investigation […]
A UK national, Joseph James O’Connor, has pleaded guilty to his involvement in the July 2020 Twitter hack that targeted numerous high-profile accounts and defrauded users of the platform. O’Connor and his co-conspirators seized control of 130 Twitter accounts, including those belonging to Barack Obama, Bill Gates, and Elon Musk, to perpetrate a cryptocurrency scam […]
Irish university MTU Cork has decided to close all four campuses for two days and cancel all classes due to an intrusion into its IT systems. The attack took place last weekend and would have been detected at an early stage. The university gives no details about what kind of attack it is exactly and […]
Twilio, which earlier this month became a sophisticated phishing attack, disclosed last week that the threat actors also managed to gain access to the accounts of 93 individual users of its Authy two-factor authentication (2FA) service.