A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base instead of serving one complete malicious file from a fixed URL. Confiant, which detailed the campaign on July 23, 2026…
How UTHealth Houston built HIPAA-compliant generative AI at scale: iDFax’s 2-year journey with Amazon Bedrock Amazon Web Services (AWS)
A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory. [...]
Threat actors are using email addresses exposed in data breaches leaked by the ShinyHunters extortion group to send sextortion emails demanding $2,000 in Bitcoin. [...]
OpenAI launched ChatGPT Health and quietly moved your medical records outside HIPAA Startup Fortune
O ExploitGym é o nome do benchmark entregue pela OpenAI a dois de seus modelos (um é o GPT-5.6 Sol e outro uma versão de pré-lançamento ainda mais avançada) para testes numa sandbox. Para cumprir os desafios do benchmark, os modelos descobriram vulnerabilidades na sandbox, alcanç…
We have rounded up some reports and surveys from around the industry that we thought were of interest from Fortified Health Security, Surescripts, PerfectServe, BioLongevity Supplements, Royal Philips, Sage Growth Partners, Atlas Systems, Experian Health, mPulse, Nurse.com, and m…
Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process. Tracke…
For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the credentials, and accounts were compromised later when an opportunity arose. That model is changing. Rec…
Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign. "Attackers chain a pre-authentication info…
The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims. Swiss cybersecurity company PRODAFT is tracking the c…
ChatGPT, the famous artificial intelligence chatbot that allows users to converse with various personalities and topics, has connectivity issues worldwide. [...]
Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server. An ordinary authenticated user triggers it by committing two crafted Jupyter notebooks and request…
Escalating threats are forcing boards to prioritize security, but communication gaps persist. Boards and security teams each say they need more support to bridge the divide.
OnTrac parcel delivery company is informing that hackers breached its corporate network and may have accessed personal details belonging to its customers. [...]
The hacking of Hugging Face by a rogue OpenAI agent is significant, but unsurprising — and preventing the next AI model escape will be difficult, at best.
A threat actor used the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation activity during an alleged breach of Thailand's Ministry of Finance. [...]
The post What the OpenAI–Hugging Face Incident Means for Healthcare AI appeared first on Clearwater.
Dois sistemas de inteligência artificial da OpenAI romperam as limitações de um ambiente de teste, acessaram a internet e invadiram a rede da Hugging Face, uma plataforma que fornece recursos para pesquisadores e desenvolvedores de IA, mais ou menos nos moldes do GitHub. O incide…
Hackers are changing the DNS settings on Wi-Fi devices at hotels and conference centers to redirect users to fake Microsoft 365 login pages. [...]
