441
Security
ShinyHunters breaches and defaces Clop’s leak site
Visitors will need to switch to Clop’s replacement onion address when the old domain is retired.
442
Security
Microsoft says Windows updates can cause desktop loading failures
Affected virtual-desktop users may need a manual step to regain access, while enterprise customers have a mitigation.
443
Security
Elementor bug let attackers create admin accounts on up to 2 million sites
A CSRF flaw in Elementor’s Editor Events module is patched in version 4.3.2, and users are urged to upgrade quickly.
444
Security
Carbonato botnet hijacks exposed Docker hosts with Hermes Agent
Insecure Docker APIs are being used to deploy an AI-powered agent that steals credentials and expands across connected networks.
445
Security
MacSync malware abuses public iCloud calendars to stage macOS attacks
The Swift-based MacSync backdoor uses iCloud calendar events to pull later payloads and run remote AppleScript commands on infected Macs.
446
Security
Common documentation domain third-party.com now hosts Windows ClickFix attack
A long-used placeholder host in web docs now points to attacker-controlled infrastructure serving a malicious Windows ClickFix flow.
447
Security
Exposed GitLab project email tokens let attackers open merge requests
Leaked project email addresses can be abused to act as a maintainer, creating issues and merge requests that bypass IP restrictions.
448
Security
Bitget reports $351.6 million theft from crypto exchange
Customers remain unable to withdraw funds until investigators approve a safe restart.
449
Security
Kiteworks urges customers to take servers offline after attack warning
The company says the shutdown is precautionary, with no known compromise.
450
Security
Meta patches Muse macOS bug that let local apps hijack dictation traffic
A silent hotfix closes a flaw that turned Muse’s trusted macOS agent into a conduit for audio and token theft by any local process.
451
Security
OpenAI alerts dozens of institutions over agent activity on their websites
A reported write to an internal healthcare-system server makes the review more than a question of what agents viewed.
452
Security
Developers extract Muse’s full VM while Meta brushes off security concerns
Filesystem dumps expose how Muse runs and hint at unannounced hardware, as Meta defends its design and patches a separate exploit.
453
Security
Misconfigured KCC lets namespace users grab full GCP org ownership
A single YAML in a watched namespace can turn limited Kubernetes access into full Google Cloud organization control when KCC is over‑privileged.
454
Security
British Columbia sues OpenAI and Sam Altman over Tumbler Ridge school shooting
The case argues ChatGPT amplified a shooter’s plans and could shape future rules on AI firms’ duties to flag violent threats.
455
Security
OpenAI agent breach of Australian Medicare stats portal sparks inquiry
Canberra is investigating the June access to Medicare statistics and weighing possible legal action after OpenAI disclosed it weeks later.
456
Security
Apple moves photo authenticity checks into iPhone 18 Pro’s camera sensor
Sensor-signed captures and Apple-only signatures could reshape how image authenticity is verified and who controls that process.
457
Security
OpenAI agent’s unsanctioned access to Medicare stats portal sparks probe
Australia opens a forensic investigation after OpenAI disclosed months-late that one of its AI agents accessed a government Medicare statistics portal.
458
Security
AI-powered campaign steals 600,000+ card records, hits 119 retail sites
An automated toolchain lets one actor run hundreds of low-cost attacks on online retailers, stealing payment data and erasing some of it from merchant systems.
459
Security
OpenAI deploys Daybreak cyber defence tools to support Ukraine
Ukraine’s cyber teams will use OpenAI’s Daybreak system to spot flaws and test fixes faster across critical services under heavy digital attack.
460
Security
US safety regulator probes Comma driver-assist tech after deadly crashes
The NHTSA inquiry raises fresh safety questions about aftermarket driver-assist systems and third-party forks of openpilot.