BragJack Exploit Threatens AI Assistants Across Major Browsers
PremiumBragJack PoC lets a malicious browser extension hijack AI assistants in Chrome, Edge, Opera Neon, Comet, and Claude-in-Chrome.
§The archiveMon · Wed · FriM · W · F
News.
Every dispatch we've sent. AI-curated, human-reviewed, from 50+ cybersecurity sources.
Follow on LinkedInBrowse by topic
Monday, September 21
Malicious npm Packages Bypass Security by Activating at Runtime
PremiumAn npm campaign hides malicious runtime code to avoid install-script defenses, persisting by executing during normal package usage.
Ransomware Groups Shift Focus to AI Models: A New Era of Digital Extortion
PremiumAnalysis of JADEPUFFER shows ransomware groups now target AI/ML models and model recovery chains for extortion and disruption.
Critical Flaw in Cisco Identity Services Engine Poses Severe Security Risks
PremiumCVE-2026-76460 authentication bypass in Cisco ISE scored 10/10 CVSS, exposing API endpoints to unauthenticated access.
Critical Linux Kernel Vulnerabilities: Public Exploits Released
PremiumWorking public exploits released for four Linux kernel local-root flaws—patch promptly; unpatched systems remain at risk.
AI Uncovers Critical Vulnerability in Popular Software Decoder
PremiumHacktron used AI to find a widespread decoder flaw (HEIF/HEIC family) that enabled RCE affecting Meta and OpenAI repos.
Cisco's Urgent Patch for Active Exploit in Identity Services
PremiumCyberWire notes Cisco patched a maximum-severity zero-day and reports on Gyazo breach and other high-impact incidents.
Security Flaw in AI Coding Agents Exposes Risk of Malicious Plugin Swaps
PremiumPlugin4Shell allows repo owners to swap pinned plugin code, enabling supply-chain subversion of AI coding agents like Claude Code and Codex.
Critical Vulnerability in Check Point Software Exposes Systems to Root-Level Attacks
PremiumCheck Point released fixes for a critical vulnerability allowing remote code execution as root on management systems.
Orkes Conductor Vulnerability Exploited: What You Need to Know
PremiumCVE-2026-58138 is an unauthenticated Orkes Conductor RCE vulnerability being actively exploited via inline workflow definitions.
Steam Vulnerability Opens Door to SYSTEM Privilege Escalation on Windows
PremiumBrokenPipe PoC abuses Steam Client Service to silently escalate a local standard user to NT AUTHORITY\SYSTEM privileges.
Colorado Water Systems Breach Highlights Infrastructure Vulnerabilities
PremiumTwo privately managed Colorado water systems suffered cyber intrusions, highlighting operational and public-safety risks to utilities.
Global Fraud Network Dismantled by Turkish Authorities in Major Crackdown
PremiumTurkish authorities dismantled a transnational investment fraud network, arresting 201 suspects and seizing significant assets.
CISA Urges Immediate Action on Exploited Linux Kernel Vulnerabilities
PremiumCISA added multiple Linux kernel CVEs (including CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to KEV for immediate remediation.
North Korean Hackers Exploit 30,000 Devices, Steal Millions in Crypto
PremiumAdvisory links WaterPlum to at least 30,000 infected devices worldwide and over $10.7 million in stolen crypto transfers.
Revolut Breach and Cisco Vulnerabilities Highlight Ongoing Cybersecurity Threats
PremiumReports claim a Cisco Email Gateway zero-day was exploited while Revolut data breach details surfaced, indicating active user data exposure.
Supply Chain Attack on Brevo Compromises 100,000 Websites
PremiumCompromised Brevo API key deployed a Cloudflare worker to inject malware into about 100,000 websites.
Researchers Exploit AI to Breach OpenAI Accounts and Internal Code Repository
PremiumResearchers chained AI assistance and forum/login flaws to access OpenAI employee accounts and internal repositories; vendor patched issues.
Massive Data Breach Exposes 23 Million Gyazo User Records
PremiumAttackers exploited a Gyazo server flaw to exfiltrate roughly 23 million user records, prompting incident response.
Microsoft Fixes Critical Vulnerability in Azure AI Foundry
PremiumCVE-2026-85889 allowed unauthenticated privilege escalation in Azure AI Foundry; Microsoft released an urgent patch.
Get these articles delivered to your inbox.
Subscribe free