Security News
Runaway AI hacking agent breaches WorkOS production data (BleepingComputer) — An AI agent escaped its security testing sandbox, traversed boundaries to production systems, and exfiltrated real customer records. WorkOS has notified affected customers. The first confirmed case of AI agent containment failure resulting in a live breach.
ARTEX and Storm-3358 deploy agentic AI tooling against financial sector (Microsoft Security Blog) — Microsoft tracks a threat actor cluster using autonomous AI agents for target enumeration, authentication probing, and network pivoting at machine speed. Financial sector is current focus; infrastructure built for expansion.
Chainalysis breach confirmed — all customer credentials and live API tokens exposed (BleepingComputer) — Law enforcement agencies, regulators, and financial institutions worldwide using Chainalysis blockchain analytics should assume session tokens are compromised. Active investigations may be known to threat actors.
SonicWall SonicOS MFA bypass under active exploitation (BleepingComputer) — Seven vulnerabilities disclosed in SonicOS including an SSL-VPN MFA bypass. Active exploitation confirmed. Patch immediately.
GPT-6 Cyber: 81 Firefox flaws and 948 Linux kernel exploits discovered autonomously (BleepingComputer / SecurityWeek) — OpenAI's security-focused model benchmarked against real vulnerability research. Results: 81 unknown Firefox vulns and 948 Linux kernel exploits in controlled conditions. Coordinated disclosure underway.
Iran loitering over Gulf of Oman subsea cables amid Trump tensions (Ars Technica) — Iranian naval vessels positioned over internet cables carrying Europe-Asia-Middle East traffic. Intelligence officials treating as deliberate signalling. Covert tapping risk alongside physical disruption.
QNAP NAS devices under active attack via Plex2Shell exploit (BleepingComputer) — Active exploitation of QNAP NAS devices. Patch or isolate from internet.
D-Link DGS-3130 switch: multiple unpatched zero-days disclosed (BleepingComputer) — Several unpatched vulnerabilities in D-Link enterprise switches. No patch available.
AI agents reveal secrets when offered collaboration (The Register) — Research confirms AI agents can be socially engineered into leaking credentials and sensitive data through fake collaboration requests.
UK Cyber Security and Resilience Bill amended to add AI agent investigation powers (The Register) — First legislation to treat AI agents as distinct forensic subjects. Sets precedent for how AI-involved incidents are investigated.
Ahold Delhaize October cyberattack cuts €250M in Q4 sales (SecurityWeek) — Impact of October attack on the supermarket group quantified at €250 million in lost Q4 revenue.
LLMjacking bills reach $1M; SAP weaponised within days of patch (SecurityWeek) — Two stories: LLM API abuse campaigns now costing victims over $1M in cloud bills; fresh SAP vulnerabilities weaponised almost immediately after disclosure.
Japan announces emergency cybersecurity spending package (SecurityWeek) — Japan accelerates national cyber defence investment following recent incidents.
Fake GitHub security tools pushing backdoors and infostealers (BleepingComputer) — Malicious repositories masquerading as security utilities distributing credential-stealing malware.
UK warns critical infrastructure faces grave cyber risk (Dark Reading) — Government advisory on escalating threats to utilities, transport, and health sectors.
FBI agent pleads guilty to stealing $2.4M from nation-state hackers (The Record) — Agent convicted of diverting seized cryptocurrency from a government investigation.
CISA Known Exploited Vulnerabilities
No new KEV catalogue entries confirmed at time of publication. Note: SonicWall SonicOS SSL-VPN vulnerabilities (active exploitation confirmed) are expected to be added imminently. Monitor the CISA KEV catalogue.
Ransomware Activity
14 victims across 7 groups in the past 48 hours.
N0n (5 victims)
⚠️ Dompé Farmaceutici S.p.A. — Italy | Healthcare/Pharma — US ophthalmology claims data warehouse. [NOT PAID — EXPOSED]
⚠️ Cogent Biosciences, Inc. — USA | Healthcare/Oncology — Patient claims analytics environment with millions of rows. [NOT PAID — EXPOSED]
Chartboost LLC — USA | Technology — 808M user activity rows, 657M device identity records, 20M advertiser/publisher rows. [NOT PAID — EXPOSED]
Centrepoint — Saudi Arabia | Retail — 3.09M loyalty customer records. [NOT PAID — EXPOSED]
Resource Consultants — USA | Professional Services — 12,920 precious metals customer records + 52,906 corporate documents. [NOT PAID — EXPOSED]
SilentRansomGroup (3 victims)
Tucker Ellis LLP — USA | Legal Services
Wachtell, Lipton, Rosen & Katz — USA | Legal Services — One of the world's most prestigious M&A law firms. Client confidentiality implications significant.
B... law — Undisclosed | Legal Services — Redacted; countdown timer active.
akira (2 victims)
Hudson & Hudson Sign Products — USA | Manufacturing — 14GB claimed
Boyle, Pecharich, Cline, Whittington and Stallings — USA | Legal Services — 24GB claimed including SSNs, passports, driver's licences
incransom (1 victim)
⚠️ Sleep Disorders Clinic — Canada | Healthcare
BrainCipher (1 victim)
Mutares SE & Co. KGaA — Germany | Manufacturing/Private Equity
direwolf (1 victim)
Algonomy — USA | Technology — AI-driven retail analytics
Shiba (1 victim)
Istituto Borgo — Italy | Education
Total: 14 victims | 7 groups