Security News
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot (BleepingComputer)
A new bootkit active in espionage campaigns since early 2026 bypasses Secure Boot via the Baton Drop vulnerability to load a driver that disables Kaspersky and Avast protection. Firmware patching is the mitigation.
Autonomous attack agent in 'Skynet mode' hijacks other AI models (The Register)
Symantec uncovered a threat actor-built AI agent capable of 100,000 autonomous steps that hijacks exposed AI models to carry out attacks on its behalf — a significant escalation in offensive AI use.
Tailworm — Tailscale Vulnerabilities (Hacker News)
Multiple vulnerabilities disclosed in the Tailscale zero-trust networking tool. Check if you're running Tailscale in your environment.
Argus — open-source agentic security operations platform (Hacker News)
MIT-licensed autonomous security monitoring and response platform released — an early-stage but interesting tool for smaller teams.
Hacker finds Samsung TV silently sending data to OpenAI (Hacker News)
Reverse engineering revealed on-board AI quietly transmitting data; Samsung's OpenAI account was subsequently suspended.
Root exploit published for TCL Android TVs via CVE-2022-22706 (Hacker News)
Working PoC released using an unpatched 2022 Mali GPU vulnerability, highlighting ongoing IoT firmware patching failures.
Ransomware Activity
22 victims · 8 groups
Qilin (4 victims)
⚠️ Castle Howard Estate 🇬🇧 — Hospitality
Commonwealth Community Bank 🇺🇸 — Financial Services
Heber City, UT 🇺🇸 — Government & Defense
SLTN Inter Access 🇳🇱 — IT Services
Krybit (6 victims)
Choice Goodwill 🇺🇸 — Real Estate
Main Place Mall 🇲🇾 — Retail
MODON Developments 🇪🇬 — Real Estate
⚠️ ZH Healthcare — Healthcare/EMR (India)
Grupo Euro Corporativo 🇲🇽 — Manufacturing
Optika Eye Care 🇨🇦 — Healthcare
N0n (5 victims — all exposed)
⚠️ Asisken Asistencia Médica 🇦🇷 — Health Insurance [139,006 client records, 402,988 medical claims, bank account details]
⚠️ Arthritis Center of Riverside 🇺🇸 — Healthcare [patient lab records, billing files]
Adirondack Networks 🇺🇸 — IT Services [live accounting DB, 627 MB]
GPIC Projectos Con Instalacoes 🇵🇹 — Engineering [hospital installation records]
Texcar Inc. 🇺🇸 — Manufacturing [vendor SSNs, customer accounts]
Deadlock (2 victims)
Trinity Custom Homes 🇺🇸 — Construction
Hensel Elektrik 🇩🇪 — Electrical Manufacturing
Emperador (2 victims)
Frommann Energie GmbH 🇩🇪 — Energy/Fuel
Phoenix S&S GmbH 🇩🇪 — Facilities/Security
Panzer (1 victim)
⚠️ Family Planning Association of Pakistan 🇵🇰 — Healthcare/Reproductive Health [100 GB claimed; previously hit by RansomHub Oct 2024]
Rhysida (1 victim)
Sanders Law Group 🇺🇸 — Legal Services [8 TB / 4.5 million files; case DB with settlement ceilings, 12,803 client credit reports, IOLTA trust accounts, medical records]
Lamashtu (1 victim)
Vins Viallet 🇫🇷 — Retail/Wine Production
Read the full show notes on apjone.uk