⚡ Anthropic says Claude models breached three organizations after a misconfigured CTF gave them live internet access.

The test was simulated. The internet was not.

One model accessed production data. Another published a PyPI package downloaded by 15 real systems.

Full report: https://thehackernews.com/2026/07/anthropic-says-claude-mistook-open.html

🚨 A Chinese-speaking threat actor used DeepSeek to autonomously find exposed systems, choose public exploits, and launch attacks after an initial Telegram command.

Experts say the wider operation attempted to exploit 460+ targets.

Read the full story → https://thehackernews.com/2026/07/chinese-hacker-commands-deepseek-via.html

🚨 New from Ethiack: A crafted MATLAB/HDF5 upload can make Rails Active Storage read server secrets.

Attackers could then use a stolen secret_key_base to forge a variation key and reach RCE via CVE-2025-24293.

Rails also released a forensic toolkit to check exposure and hunt for exploitation.

Read the updated story: https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html

🛑 Researchers found 84 flaws across seven open-source 4G and 5G cores.

If internal interfaces are exposed, some could crash core components or redirect a subscriber’s uplink traffic. A session-hijacking flaw also turned up in two commercial 5G cores.

Details: https://thehackernews.com/2026/07/researchers-report-84-flaws-in-4g-and.html

Passkeys cannot stop an attack that starts after login.

Device code phishing sends victims to Microsoft’s real login page, where one copied code can grant an attacker access. Push now tracks 25+ kits. Barracuda counted 7 million attacks in four weeks.

See how it works: https://thehackernews.com/2026/07/6-reasons-why-device-code-phishing-is.html

😲 Google fixed 1,442 security flaws across three recent Chrome releases.

Versions 149 and 150 alone patched more bugs than the previous 23 milestones combined. Chrome 151 added 370 more, including 7 critical flaws.

Google is now testing twice-weekly security releases as AI speeds up vulnerability discovery and cyberattacks.

Full story: https://thehackernews.com/2026/07/three-recent-chrome-releases-fix-1442.html

Malware investigations often stop at the first file.

Stairwell's new Backstory is the first agentic investigation platform that traces related malware variants, identifies affected systems, and maps the full blast radius of an incident in seconds.

Instead of stopping at a single alert, security teams can quickly understand what happened, where malware spread, and what needs to be contained before an incident escalates.

Learn more about Backstory: https://thn.news/demo-stairwell

⚠️ Cheap Android TV boxes are posing as Samsung, Huawei, Xiaomi, and Vivo phones to click ads on operator-run sites.

When HDMI is active, they often switch to routing strangers’ traffic through the owner’s broadband as SOCKS5 proxies.

Inside the Fuyao botnet: https://thehackernews.com/2026/07/cheap-android-tv-boxes-pose-as-phones.html

🚨 A fake “Case Documents” shortcut launched HollowFrame and the Matryoshka backdoor on two law firm endpoints.

The attack disabled parts of Microsoft Defender, established persistence, and used HTTP or a private GitHub repository for commands, file transfers, and more payloads.

Inside the attack chain: https://thehackernews.com/2026/07/hollowframe-loader-deploys-matryoshka.html

🚨 A suspected Chinese-speaking threat actor is targeting government networks across Central Asia with two backdoors that run mostly in memory.

OctLurk and SilkLurk can steal credentials, collect email, scan networks, and load additional plugins, while LurkProxy routes traffic through compromised hosts.

Inside the campaign: https://thehackernews.com/2026/08/suspected-chinese-speaking-hackers.html

⚠️ You join hotel Wi-Fi. The network redirects you to a fake browser update.

Microsoft says compromised guest networks are delivering CornFlake lures to travelers. The implant can steal browser credentials, log keystrokes, capture webcam images, and record microphone audio.

How the hotel Wi-Fi trap works: https://thehackernews.com/2026/08/hijacked-hotel-wi-fi-pushes-fake.html

🚨 Adobe patched a CVSS 10.0 vulnerability in Campaign Classic that could execute arbitrary code without any user interaction.

A second bug could expose files on the system. Eight Adobe Bridge flaws were also fixed.

Here's what users need to patch - https://thehackernews.com/2026/08/adobe-campaign-classic-cvss-100-flaw.html

🛑 Attackers hijacked Adform’s shared tracking script to swap crypto wallet addresses in users’ browsers.

The code could rewrite addresses copied, pasted, or entered into forms while the page remained open.

How the adtech supply-chain attack worked: https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html

‼️ WARNING: A 41-minute sweep drained 1,196 Bitcoin addresses of 1,082.65 BTC, worth about $70 million.

Researchers linked the incident to a Coldcard firmware vulnerability that weakened wallet seed generation.

Installing the patch is not enough.

Here's what Coldcard users need to know: https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html

⚡ UPDATE - Coldcard-linked theft estimates have jumped from $70 million to $88.6 million.

Galaxy Research says two more suspected sweep waves bring the total to 1,367.05 BTC across 4,585 addresses.

The activity appears ongoing, and the third wave may involve a different operator.

Read: https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html

🚨 Hugging Face Diffusers can run code it was told not to trust.

Three high-severity flaws let crafted model repositories bypass trust_remote_code during custom pipeline loading.

How FaceHugger gets past the check: https://thehackernews.com/2026/08/hugging-face-diffusers-flaws-could-let.html

🛑 Attackers took over N-central servers.

N-able says they reached customer endpoints through Take Control and left Cloudflare tunnels for persistent access. The first fix missed an alternate exploit path.

What MSPs need to check: https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html

⚠️ DNA test files could be altered before analysts ever see them.

In a CVE-2026-17583 demonstration, a researcher combined two people’s profiles into one Applied Biosystems file.

It raised no warning and appeared untouched since 2015.

How the tampering works - https://thehackernews.com/2026/08/thermo-fisher-patches-flaw-that-could.html

🚨 PNLD breach puts U.K. police and government contact details on the dark web.

Names, organisations and work emails were exposed, potentially making phishing aimed at named officers more convincing.

ExfilSquad, a newly surfaced extortion group, claimed the breach.

Read - https://thehackernews.com/2026/08/pnld-breach-exposes-uk-police-and.html

🚨 Fake AWS and Apple login pages are triggering an iPhone exploit chain.

Experts tied more than 100 web properties to an unknown Chinese threat actor using the leaked DarkSword kit. Successful exploitation deploys GHOSTBLADE to steal credentials and files.

Read: https://thehackernews.com/2026/08/chinese-threat-actor-uses-leaked.html

Low severity does not mean low risk.

Analysis of more than 25 million alerts found nearly 1% of confirmed incidents began with low-severity or informational alerts. An autonomous AI SOC can investigate the full queue, while Claude helps analysts hunt, write detections, and make decisions.

See where each type of AI fits: https://thehackernews.com/2026/08/fomo-in-soc-where-ai-platforms-like.html