Security researchers have warned of a major new Shai-Hulud-based campaign which has already compromised more than 430 packages with a combined two billion monthly installs. The ChainDrop campaign began on August 4 when attackers compromised the GitHub account of a… Read More "ChainDrop Worm Hits 400 npm Packages with Two Billion Monthly Installs"
Prompt Injection Remains Biggest LLM Risk, Despite Limited Incidents
Prompt injection attacks continue to present the most dangerous threat from large language models (LLMs), despite the relatively low number of recorded incidents relating to this vector, according to an updated analysis from the Open Worldwide Application Security Project (OWASP).… Read More "Prompt Injection Remains Biggest LLM Risk, Despite Limited Incidents"
Paperclip AI Flaws Let Unauthenticated Attackers Run Commands
Three vulnerabilities in an open-source AI agent orchestration platform have exposed sensitive data and allowed unauthenticated command execution on servers and developers’ machines, with two rated critical and one carrying a maximum CVSS score of 10.0. According to new research… Read More "Paperclip AI Flaws Let Unauthenticated Attackers Run Commands"
Fake Open VSX Extensions Harvest Private Repo and CI Data
Counterfeit extensions impersonating real developer tools have been found on the Open VSX registry, with roughly a quarter of them harvesting the git and continuous integration identity of the organizations running them. New research Manifold Security published on August 4… Read More "Fake Open VSX Extensions Harvest Private Repo and CI Data"
NVIDIA Group Proposes SAFE Initiative for Agentic Threat Intel Sharing
A group of over 120 tech organizations have published plans for a new information-sharing initiative focused on agentic AI threats. Members of NVIDIA’s Open Secure AI Alliance announced details of the Shared AI Findings Exchange (SAFE) on August 4. The… Read More "NVIDIA Group Proposes SAFE Initiative for Agentic Threat Intel Sharing"
Canadian Hacker Pleads Guilty Over Snowflake Extortion Campaign
A Canadian cybercriminal has pleaded guilty in a US court to involvement in the widespread compromise of Snowflake customer accounts, which enabled a lucrative extortion campaign. On August 5 2026, Connor Riley Moucka, aged 26, from Ontario, pleaded guilty to… Read More "Canadian Hacker Pleads Guilty Over Snowflake Extortion Campaign"
Violent Physical Crypto Thefts Surge to $30m in Losses
Crypto thieves are increasingly looking to steal virtual currency from victims in physical attacks, with tens of millions lost so far this year, according to a new Chainalysis report. The blockchain analytics firm revealed new information from its forthcoming mid-year… Read More "Violent Physical Crypto Thefts Surge to $30m in Losses"
Meta Joins OpenAI and Anthropic in Reporting AI Exploit Incident
Meta has confirmed that one of its AI models exploited a vulnerability in a third-party service during testing, joining OpenAI and Anthropic in reporting similar incidents. Meta said the incident occurred during testing by independent firm Irregular. A misconfiguration by… Read More "Meta Joins OpenAI and Anthropic in Reporting AI Exploit Incident"
Ransomware Surges in July After Q2 Lull
Ransomware attacks surged by 19% in July compared to June, with finance, tech and healthcare industries heavily impacted, new analysis by Comparitech has found. The consumer service firm observed a total of 799 claimed ransomware attacks in July, making it… Read More "Ransomware Surges in July After Q2 Lull"
Google Links Redact Extortion Group to BlackFile Rebrand
The BlackFile extortion group, which targets its victims through vishing scams, has rebranded. According to an analysis by Google Threat Intelligence Group (GTIG), despite BlackFile (UNC6671) having announced the retirement of its brand in 2026, it had now rebranded to… Read More "Google Links Redact Extortion Group to BlackFile Rebrand"