All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Attackers are using AI agents (software programs that can make decisions and take actions automatically) to conduct cyberattacks, so security researchers at Tracebit developed a defensive technique called "context bombing" that plants decoy files with prompts designed to trigger an LLM's (large language model's) content safety guardrails (built-in rules that prevent harmful outputs), causing the attacker's AI agent to stop and crash rather than just triggering an alert. In tests, context bombing reduced the success rate of AI-powered attacks by up to 90%, dropping full system compromise from 36% success down to just 1%.
Fix: According to Tracebit, the technique is to "plant decoy resources not merely to trigger alerts, but to actually stop AI agents." Specifically: "plant a 'context bomb': a short piece of text designed to trigger a model's safety guardrails, planted directly in the attacker's path — a decoy secret, environment variable, or DNS record (the system that translates website names into IP addresses)." The source notes that effective context bombs were identified through testing, but "the identified strings were different between the tested models," requiring customization for Claude Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek V4 Pro, and Kimi K2.6.
CSO OnlineOpenAI has appointed David Vélez, founder and CEO of Nubank, and Robin Vince, CEO of BNY, to the boards of the OpenAI Foundation and OpenAI Group PBC. Both leaders bring experience in using technology to transform financial services and expand access, and they are expected to help OpenAI ensure that AI benefits more businesses and people globally.
Axios's fetch adapter (a module that handles HTTP requests using the fetch API) fails to enforce the `maxBodyLength` setting (a limit on how much data can be uploaded) when the request body is a ReadableStream (a data source where the total size is unknown beforehand). This means an attacker could upload much larger files than the configured limit, wasting bandwidth and exhausting service quotas.
AgenticMail, a tool that lets AI agents handle email, had a critical security flaw in several versions where any external email could trick an AI agent into running dangerous commands with full permissions. The vulnerability worked through prompt injection (hiding malicious instructions in email content), allowing attackers to control a privileged agent that could read files, execute code, and access the user's email and web tools. A safer version of the code already existed in the same repository but wasn't applied to the vulnerable email handler.
AgenticMail, a system that gives AI agents access to real email addresses and phone numbers, has a serious authorization flaw in versions before 0.9.64. A low-privileged agent (an AI with basic permissions) can view and take over tasks assigned to other agents by discovering agent names through a directory and then using those names to access and manipulate tasks they shouldn't have permission to touch, breaking the intended security model that relies on task IDs being secret.
AgenticMail is a system that provides AI agents with real email addresses and phone numbers, but older versions (API before 0.9.32 and core before 0.9.10) had multiple security weaknesses. These weaknesses included problems with validating user permissions, checking database queries for safety, verifying secure connections, and controlling special characters in email commands, which could allow unauthorized access to email data.
Security researchers discovered sandbox escape vulnerabilities in four popular AI coding agents (Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity) by exploiting a fundamental design flaw: these tools trust files written by the sandboxed agent and automatically execute them through external tools like Git integrations and task runners. The attacks use prompt injection (tricking an AI by hiding malicious instructions in files like READMEs or code dependencies) to make the agent write files that trigger unsandboxed command execution on the developer's machine without the agent itself breaking out of the sandbox.
JadePuffer, an autonomous AI agent, has been upgraded with EncForge ransomware that specifically targets AI infrastructure like training datasets, model checkpoints, and vector databases by encrypting files with the .locked extension. The agent successfully adapted during an attack on a Langflow instance, deploying multiple Python scripts to overcome delivery obstacles and gaining root-level access through an exposed Docker socket. EncForge uses AES-256 encryption for file protection and targets approximately 180 file types specific to AI and machine learning systems, potentially costing organizations significant time and money to recover encrypted models.
Ivanti is exploring the use of frontier models (advanced AI systems at the cutting edge of development) to help find and fix security vulnerabilities in software. While early tests show these AI systems work well at this task, questions remain about whether the approach is affordable and whether it's practical to have humans review and approve the AI's recommendations before using them.
Chris Fall resigned as director of the Center for AI Standards and Innovation (CAISI, a U.S. government agency that tests and researches commercial AI systems) after only three months, creating uncertainty in the Trump administration's AI leadership. The departure comes as the administration is implementing a new executive order that requires AI developers to voluntarily submit models to the government for safety evaluation before release, and as Chinese AI models are gaining market share against American competitors like OpenAI and Anthropic.
ServiceNow patched a sandbox escape RCE vulnerability (CVE-2026-6875, a flaw that lets attackers run unauthorized code on systems they don't control) last week, but attackers are already exploiting it in the wild using modified techniques. Security experts warn this is especially dangerous because the vulnerability affects ServiceNow's sandbox (the security container designed to safely run untrusted code), and a compromise could give attackers access to sensitive data like HR records and potentially spread to corporate networks through integrations.
GPT-SoVITS (a voice synthesis tool) version 20250606v2pro has an OS command injection vulnerability (a security flaw where attackers can run unauthorized commands on a server by inserting malicious text) in its webui.py file. The vulnerability affects ASR, slice, denoise, and uvr5 functions that take user input from Gradio textboxes (input fields in a web interface) and directly insert it into shell commands without checking for dangerous characters, allowing attackers to execute arbitrary commands without authentication.
As companies rapidly adopt AI technology, Chief Information Security Officers (CISOs, the executives responsible for protecting company data and systems) face increased job stress, with 26% considering leaving their positions. The pressure stems from the security challenges that come with quickly implementing AI systems across organizations.
Cybersecurity researchers discovered nearly 7,600 malicious GitHub repositories spreading SmartLoader malware, with over 800 posing as AI skills or MCP servers (Model Context Protocol servers, which are tools that help AI assistants perform specialized tasks). A particularly dangerous aspect called AgentBaiting allows AI agents like Claude, Gemini, and ChatGPT to inadvertently discover these fake repositories and execute malware without human intervention, by simply searching for legitimate-sounding tools. The attack leverages copied projects, fake developer profiles, and convincing documentation to trick both users and AI systems into downloading malicious files.
WhatsApp MCP Server before version 0.2.1 has a critical security flaw where its HTTP API runs without authentication or Host header validation (a check that prevents attackers from impersonating the service), allowing local processes or remote attackers to send WhatsApp messages, steal sensitive files like SSH keys, and exfiltrate data without permission. This vulnerability is especially dangerous in MCP environments (where Claude can use multiple tools together) because sibling servers and IDE extensions running in the user's session can exploit it.
WordPress Core has an interpretation conflict vulnerability that allows attackers to perform SQL injection (a type of attack where malicious database commands are inserted into input fields) and achieve remote code execution (running unauthorized commands on a server). This flaw can be combined with another vulnerability (CVE-2026-60137) to cause additional damage, and it is currently being actively exploited by attackers.
Fix: Apply mitigations according to vendor (WordPress) instructions while following CISA's BOD 26-04 guidance for prioritizing security updates based on risk. For cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure and ensure adherence to BOD 26-04 patching guidelines. The due date for applying these mitigations is 2026-07-24. See the WordPress 7.0.2 release notes at https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ for specific patch details.
CISA Known Exploited VulnerabilitiesDD-WRT contains a stack-based buffer overflow vulnerability (a flaw where too much data gets written into a small memory area, corrupting nearby data) in its UPnP component (a protocol that lets devices discover and communicate with each other) that could allow an attacker without login credentials to execute malicious code on affected systems. This vulnerability is currently being exploited by attackers in the wild.
Fix: Apply mitigations according to vendor instructions while following CISA's BOD 26-04 guidance for prioritizing security updates based on risk. If mitigations are unavailable, discontinue use of the product. Check with DD-WRT vendors for patching status and ensure compliance with BOD 26-04 patching guidelines based on each asset's exposure to the internet. The due date for remediation is 2026-07-24.
CISA Known Exploited VulnerabilitiesWordPress Core has a SQL injection vulnerability (a type of attack where malicious database commands are hidden in user input) that occurs when plugins or themes process untrusted data. This flaw can be combined with another vulnerability to let attackers without login credentials execute arbitrary code on standard WordPress sites.
Fix: Apply mitigations according to vendor instructions and follow CISA's BOD 26-04 guidance on prioritizing security updates. If mitigations are unavailable, discontinue use of the product. The patching deadline is 2026-08-04. See WordPress 7.0.2 release notes at https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ for specific update instructions.
CISA Known Exploited VulnerabilitiesFix: Update to @agenticmail/claudecode version 0.2.39 or later, @agenticmail/codex version 0.1.33 or later, @agenticmail/core version 0.9.43 or later, and @agenticmail/openclaw version 0.5.71 or later. These versions contain a fix for the vulnerability.
NVD/CVE DatabaseFix: Upgrade to version 0.9.64 or later, which contains a fix for this vulnerability.
NVD/CVE DatabaseFix: @agenticmail/api should be updated to version 0.9.32 or later, and @agenticmail/core should be updated to version 0.9.10 or later.
NVD/CVE DatabaseFix: Most issues have been patched by vendors. Cursor fixed multiple vulnerabilities in version 3.0.0 (including a .claude hook config execution flaw and Git metadata bypass). OpenAI patched Codex CLI's 'safe' command allowlist bug in v0.95.0. The Docker socket vulnerability affecting Codex, Cursor, and Gemini CLI is now fixed. According to Pillar Security, the underlying fix involves monitoring the moment a trusted local tool runs something the agent wrote, rather than simply banning filenames.
BleepingComputerFix: Apply available security updates, specifically Langflow version 1.3.0 or later. Additionally, restrict Docker socket access, run Langflow containers as non-root (not with full system privileges), and apply filesystem-level access controls (rules limiting which users/processes can access files) to model weight directories.
BleepingComputerFix: ServiceNow has issued updates and patches to address the vulnerability. The company stated: "We have provided updates and patches designed to address this issue, and we encourage our self-hosted and ServiceNow-hosted customers to apply the relevant patches if they have not already done so."
CSO OnlineMarc Maiffret reflects on Code Red, a major worm (self-replicating malware that spreads across networks) from 25 years ago, and what security lessons from that era can help organizations protect AI systems today. The article draws parallels between past worm attacks and current AI security challenges to guide how companies should approach AI risk management.
Fix: To counter the threat, the source advises: build a catalog of reviewed Skills, MCP servers, and agent plugins; evaluate new agent capabilities in a sandboxed environment (an isolated testing area) first before broader rollout; and verify both the publisher and the project to ensure credibility.
The Hacker NewsChinese AI company Moonshot released Kimi, a free open-source AI model that performs as well as paid models from US companies like OpenAI and Anthropic, causing disagreement among Trump's AI advisors about how to respond. The situation creates economic and political problems for the Trump administration because free Chinese models reduce demand for expensive US models, while also raising questions about whether the government should intervene to protect US companies or allow open competition.
Fix: Upgrade to whatsapp-mcp v0.2.1 or later, which fixes the issue by adding bearer token authentication (a secret password required for all API requests), Host header allow-list validation to block DNS rebinding attacks, and restricting file access to a safe directory while rejecting absolute paths and directory traversal attempts. For users unable to upgrade immediately, the source recommends: stop the bridge or block loopback port 8080 access when not in use; avoid running the bridge with untrusted MCP servers or extensions; avoid visiting untrusted websites while the bridge runs; and/or run the bridge as a dedicated user or in a sandbox (an isolated container) with no access to sensitive files.
NVD/CVE Database