A recent report from Arrakis Security reveals a concerning issue with AI agents in corporate environments. It found that about 76% of these agents had not been active for over 60 days, yet they still maintained access to sensitive company data through retained credentials and connections. This situation poses a significant risk, as these inactive agents can perform various actions, including reading and writing data or initiating workflows. Companies that utilize AI agents need to be aware of this vulnerability and take steps to manage and disable agents that are no longer in use, to prevent potential unauthorized access to their systems and data. The implications are serious, especially for organizations handling sensitive information.
Criminals are increasingly using synthetic identities to exploit established customer accounts, resulting in an estimated $2.4 billion in potential fraud exposure for U.S. lenders, according to a report by TransUnion. During the first half of 2026, a staggering 81% of suspected digital fraud incidents occurred during account logins and financial transactions. This indicates that simply verifying a person's identity at the start of a relationship does not guarantee trust in future interactions. Scammers are adept at manipulating legitimate customers, making it crucial for companies to enhance their fraud detection and prevention measures to protect sensitive information and financial assets. The report serves as a wake-up call for financial institutions to reassess their security protocols in light of these evolving tactics.
The OpenSSL project has released version 4.1.0, which introduces support for DTLS 1.3, a protocol variant designed for datagram transport over networks like UDP. However, this new version comes with four known bugs in the DTLS code, which could lead to applications misinterpreting connection data. Developers using DTLS 1.3 or the recently added DTLS support in OpenSSL’s SSL listener API are particularly at risk. This situation is concerning as it could affect the reliability and security of applications that rely on these protocols, potentially leading to data miscommunication. Users and developers should stay alert for updates or patches that address these issues.
A security researcher has revealed that vulnerabilities in Tailscale's SSH feature could allow an attacker to gain root access on other servers within the same network. This scenario arises when Tailscale SSH is configured to permit port forwarding, and an attacker has already compromised one device that the network's access rules allow to connect to the target server. This means that if a device is hacked, it could potentially serve as a gateway to escalate privileges on other connected servers. The implications of this discovery are significant, as it raises concerns for organizations using Tailscale, particularly regarding their network security configurations. Companies need to evaluate their Tailscale SSH settings to prevent unauthorized access and ensure that their systems remain secure.
Recent incidents reveal that attackers are exploiting vulnerabilities in PHP2Shell, identified as CVE-2026-109618 and CVE-2026-109619, to compromise systems. In one notable case, a government entity in Europe fell victim to these attacks. Within just two hours of the initial breach, hackers accessed sensitive information, including password hashes and multi-factor authentication keys. The situation is concerning as it indicates the use of AI-driven tools for post-exploitation tasks, which could enhance the attackers' capabilities. This incident underscores the urgency for organizations, especially those in the public sector, to bolster their defenses against such sophisticated threats.
Researchers discovered a malicious file named AGENTS.md in a user's Downloads folder that deceived an AI coding agent into installing a harmful npm package. This incident raises concerns about the security of AI tools, particularly how they can be manipulated through seemingly innocuous files. The attack could potentially compromise systems that rely on AI for coding assistance, exposing them to unwanted software and vulnerabilities. Users and developers should be aware of the risks posed by downloaded files and ensure their systems are safeguarded against such tactics. This incident serves as a reminder for companies to enhance their security measures when integrating AI into their workflows.
OpenAI has announced that it will conduct training for its advanced AI models without live internet access. This decision follows concerns about the security of current internet infrastructure and the need for effective monitoring systems. The goal is to enhance safety and alignment in AI development, particularly as the company resumes reinforcement learning training. The announcement comes amidst rising scrutiny over AI capabilities and their potential risks. By isolating training from the internet, OpenAI aims to mitigate risks associated with external threats and ensure a more controlled environment for its models.
Hackread – Cybersecurity News, Data Breaches, AI and More
Researchers have introduced a new technique called SPECTER, which can extract data from air-gapped computers—those not connected to the internet—by manipulating USB power signals. This method uses changes in power levels during phone charging or the use of USB peripherals to transmit sensitive information. The implications of this discovery are significant, as it reveals vulnerabilities in systems that are typically considered secure due to their isolation. Organizations relying on air-gapped systems for sensitive operations need to reassess their security protocols to guard against this potential data leakage. As air-gapped environments are often used for critical infrastructure and sensitive data, understanding and mitigating this risk is crucial for protecting valuable information.
LiteLLM has reported a serious security incident stemming from the accidental exposure of a master key in a public GitHub repository. This key, which was found in a configuration file committed on May 27, 2026, enabled an attacker to manipulate the release pipeline of the popular Python package. As a result, the attacker was able to push a malicious version of the software, potentially compromising users who downloaded it. This incident raises significant concerns about the security practices surrounding sensitive information in open-source projects, particularly how such keys are managed and stored. Developers and organizations using LiteLLM's tools should review their security protocols to prevent similar incidents in the future.
In a significant cybersecurity move, the Dutch security firm Eye Security has remotely pushed over 2 million updates to computers to disable a background updater associated with Time4Popcorn, a discontinued version of the Popcorn Time app known for streaming pirated content. This updater posed a potential risk as it could allow unauthorized users to take control of affected machines. The updates were carried out between November 2025 and March 2026, targeting devices that did not belong to the firm. The action underscores the ongoing risks linked to abandoned software and highlights the need for users to be cautious about outdated applications. This incident serves as a reminder of the vulnerabilities that can arise from using unsupported software, especially those associated with illegal activities.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged two critical vulnerabilities that are actively being exploited. These vulnerabilities affect the Collabora Online Built-in CODE Server and the Arista VeloCloud Orchestrator (VCO). The first vulnerability, identified as CVE-2026-110447, carries a CVSS score of 9.2, indicating its severity. Organizations using these products need to take immediate action, as attackers are actively exploiting these flaws. Prompt remediation is essential to protect sensitive data and maintain system integrity.
Recent reports indicate that fraudsters are increasingly using social engineering tactics rather than sophisticated malware to compromise organizations. They are calling help desks and posing as legitimate users to gain unauthorized access, often employing artificial intelligence tools to improve their chances of success. This shift in tactics highlights a growing vulnerability in corporate security protocols, where trust is exploited to bypass technical defenses. Organizations that rely heavily on help desk verification without additional safeguards are particularly at risk. As these tactics become more prevalent, companies need to reassess their security measures and train staff to recognize and respond to these types of social engineering attacks.
Researchers have successfully disabled a vulnerable updater in the Time4Popcorn app, a variant of the Popcorn Time BitTorrent client that has been abandoned. This updater contained a security flaw that could let attackers run malicious code with elevated privileges on millions of computers. The flaw affected users who still had the outdated app installed, potentially putting their systems at risk. With many users unaware of the app's abandonment, this incident serves as a reminder of the dangers associated with using unsupported software. It’s crucial for users to regularly check and update their applications to avoid such vulnerabilities.
Recent vulnerabilities in PHP, known as PHP2Shell, have raised concerns among cybersecurity experts. These flaws pose risks to numerous web applications that rely on PHP, potentially allowing attackers to exploit these weaknesses for unauthorized access or data manipulation. Users and administrators of PHP-based systems are advised to assess their exposure and implement protective measures. Simply updating software may not suffice, as the vulnerabilities require careful evaluation and tailored remediation strategies. This situation underscores the need for vigilance in maintaining web application security and keeping software up to date.
Hackread – Cybersecurity News, Data Breaches, AI and More
GoDaddy has revoked over 404,000 SSL/TLS certificates due to policy errors, impacting a variety of websites, including some associated with the Gibraltar government. This action was taken after the company discovered that certain certificates did not comply with their established policies. The revocation means that sites using these certificates may experience trust issues, leading to potential downtime or security warnings for users. This incident underscores the importance of maintaining strict standards for certificate issuance, as failures in this area can affect both site credibility and user security. Affected organizations will need to replace the revoked certificates to restore secure connections for their visitors.