AI reads 36 sources every 2 hours and ranks each story by importance from 1 to 5 - so you see what actually matters.
Researchers report that threat actors are using a new ClickFix-based distribution service called ROMULUS to deliver LegionLoader and other malware families. ClickFix attacks trick victims into pasting and executing malicious commands copied from fake browser verification prompts. The platform matters because packaged tooling like this lowers the effort needed to run widespread malware delivery campaigns.
Hackers are exploiting Plex2Shell vulnerabilities to install cryptocurrency miners and a Linux proxy backdoor on vulnerable systems. The campaign matters because compromised media servers can be turned into proxy nodes or mining bots, exposing users to network abuse and resource theft.
Attackers hijacked the popular Rank Math PRO WordPress SEO plugin to distribute a self-restoring backdoor to affected sites. The compromise raises supply-chain risks for WordPress users because a trusted plugin can silently maintain attacker access. Site owners should check for compromises and update or remediate promptly.
Wired reports that WhatsApp help pages exposed hidden instructions intended for a Meta chatbot, revealing how the company guides the AI's behavior. The leak matters because it sheds light on chatbot rules that users normally cannot see, raising questions about transparency and control in Meta's AI products.
The Hacker News rounds up the week's biggest security stories, led by 98 zero-day vulnerabilities, incidents involving rogue AI agents, a $100 million cryptocurrency theft, and a breach affecting 700 supermarkets. The digest highlights how quickly attack surfaces are expanding across AI systems, crypto platforms and retail supply chains. It matters as a snapshot of the threats defenders are currently facing.
US investigators reportedly suspect a professional ransom negotiator of running the ShinyHunters extortion site, according to Krebs on Security. The case could expose conflicts of interest in the cybercrime recovery industry and affect how victims and insurers use negotiators. ShinyHunters has been linked to high-profile data breaches and extortion campaigns.
Attackers dubbed GhostAction planted malicious font files in 94 GitHub repositories to deliver credential-stealing malware. The campaign targets developers through a software supply chain vector, risking theft of credentials and access to code and CI systems.
The Hacker News article examines how inherited AI agents, from email-to-case workflows to boardroom use, can bypass governance designed for traditional software. It argues that because these agents inherit permissions and context, organizations need new controls to manage risks that existing software governance cannot address.
Schneier on Security discusses efforts to train AI systems to solve CAPTCHA challenges. The piece highlights how advances in machine learning could weaken a widely used defense against automated bots and abuse.