A Medyc cyberattack has exposed personal data belonging to patients in Poland after attackers exploited an SQL injection vulnerability in software developed by Qbusoft, the company behind the Medyc medical records and practice management platform. The attack affected personal information including names, PESEL numbers, addresses, telephone numbers and email addresses. According to a notification issued by one healthcare provider using Medyc, the vulnerability was exploited between August 22 and 23, 2026. The attacker transferred an encrypted database archive outside Qbusoft’s environment. The incident was detected during the night of September 8 to 9.

How the Medyc Cyberattack Happened

An SQL injection vulnerability can allow an attacker to manipulate an application’s database queries and access information stored in the underlying database. According to the affected healthcare provider, forensic analysis found that an unauthorised person exploited a vulnerability in the Medyc application interface. The data export commands were reportedly not time-limited, meaning patient data covering the period from July 1, 2024, through August 23, 2026, could have been accessed. The confirmed data extracted included patients’ names, surnames, PESEL numbers, residential or temporary addresses, telephone numbers and email addresses. The healthcare provider also said first names, surnames and PESEL fields were encrypted in the database. However, because of the way the encryption was implemented, Qbusoft reportedly advised that the information should be treated as potentially accessible in plain text.

Medical Records Remain Under Investigation

The incident has also raised concerns about access to sensitive medical data. The affected healthcare provider said analysis detected scripts targeting tables containing medical information and considered it highly likely that attackers obtained some medical records, including hospital treatment information and discharge documents. However, Qbusoft later provided a different update. In a September 28 notice, Medyc said unauthorised access and theft of personal data had occurred, but stated that the theft of medical records had not been confirmed. The distinction is significant because the confirmed information includes identification and contact data, while the potential exposure of health records remains part of the ongoing investigation.

Qbusoft Takes Security Measures

Following detection of the attack, Qbusoft said it fixed the exploited vulnerability and cut off the attacker’s access. The company also implemented additional technical measures, restricted database permissions and rotated passwords and technical secrets. Its infrastructure was placed under continuous monitoring. Medyc said it has continued to face repeated attack attempts since the incident was detected. As a result, some services may experience slower performance or temporary restrictions. The company has warned users to be cautious about calls, emails, text messages and websites referring to Medyc or the data breach. Users have been advised not to provide passwords, authorisation codes or additional personal information in response to suspicious communications.

Polish Authorities Investigate the Incident

The incident has been reported to Polish authorities, including the Personal Data Protection Office (UODO) and police. Medyc said it also informed CSIRT NASK, the e-Health Center and the Social Insurance Institution. Digital Affairs Minister Krzysztof Gawkowski said the Central Bureau for Combating Cybercrime was investigating the incident as part of a broader inquiry. He also said Qbusoft had not initially reported the incident to CERT Polska or CSIRT CeZ. [caption id="attachment_114474" align="aligncenter" width="600"] Image Soure: X[/caption] UODO has said the Medyc incident is being examined and announced plans to inspect Qbusoft. The regulator has also expanded planned inspections of healthcare organisations following several incidents involving sensitive health information. For affected individuals, the healthcare provider has advised caution around unexpected communications that refer to their health history or the breach. It has also recommended taking steps to protect their PESEL numbers and reporting suspected fraud to police.

A SharePoint Server vulnerability tracked as CVE-2026-65660 turned out to be far more serious than Microsoft first indicated. The company originally described it as a spoofing issue with a CVSS score of 6.5. In reality, it is an authenticated RCE flaw rated 8.8. That gap matters, because security teams that trusted the first label may have pushed the patch further down their to-do lists. 

What the CVE-2026-65660 RCE Flaw Does?

Dinh Ho Anh Khoa, a researcher at Viettel Cyber Security, discovered the bug. Microsoft credits him as "khoadha." The flaw affects SharePoint Server 2016, 2019, and Subscription Edition, and it stems from improper validation of the SafeControls list.  An attacker can use unescaped quotes to slip malicious Register directives past that validation. They can then run arbitrary .NET classes through deserialization in XamlServices.Parse(), which opens the door to deploying an in-memory webshell.  Microsoft's executive summary states that "improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network." The weakness is categorized as CWE-94. According to the company's FAQ, an authenticated attacker with low-level access could send a specially crafted request to run code on the server, with no user interaction required. 

Inside Microsoft's Revised SharePoint Advisory 

Microsoft published the advisory on August 11, 2026. It issued version 1.1 on August 27, updating the impact field in the Security Updates table, the CVE title, and the FAQs, and it called the revision "an informational change only."  The advisory now lists the impact as Remote Code Execution, with a maximum severity of Important. The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C, which gives a base score of 8.8 and a temporal score of 7.7. That means the attack comes over the network with low complexity, requires low privileges and no user interaction, leaves scope unchanged, and has high impact on confidentiality, integrity, and availability. Exploit code maturity is rated Unproven, the remediation level is Official Fix, and report confidence is Confirmed.  At original publication, the flaw had not been publicly disclosed or exploited. Microsoft assessed it as "Exploitation Less Likely." 

Patching SharePoint Against the RCE Flaw 

The fixes released on August 11 are listed below by edition: 

• Subscription Edition: KB 5002893, build 16.0.19725.20522 
• SharePoint Server 2019: KBs 5002894 and 5002896, build 16.0.10417.20198 
• SharePoint Enterprise Server 2016: KBs 5002905 and 5002906, build 16.0.5565.1001 

Microsoft advises customers to install every update offered for their software, in any order. It also confirms that the same KB number covers both SharePoint Server 2016 and SharePoint Enterprise Server 2016. 

How a CVE-2026-65660 Attack Could Unfold 

Threat analysts mapped the vulnerability onto a cloud kill chain. They rated initial compromise with high confidence. The remaining stages are rated medium confidence and inferred: 

• Privilege escalation through the SharePoint service context 
• Lateral movement across the farm and connected systems 
• Command and control via the webshell 
• Data exfiltration 
• Operational disruption 

A successful attack could expose sensitive organizational data, confidential documents, and user information. It could also disrupt SharePoint collaboration services. The overall confidence for this assessment is medium. 

A newly disclosed Nintendo Switch vulnerability is pushing owners of the original console toward an urgent firmware update, particularly those who tend to play in public spaces. Nintendo confirmed the vulnerability in Nintendo Switch systems in a PDF advisory released Sept. 10, just a day after quietly shipping firmware version 23.0.0 to address the problem.  Importantly, this vulnerability in Nintendo Switch hardware is limited to the original console. The Nintendo Switch 2 is not affected in any way. 

How the Nintendo Switch Vulnerability Works? 

The flaw centers on the Send to Smartphone feature, a tool original Switch owners use to move screenshots and game captures onto a phone by scanning a QR code generated on the console. That same QR-code mechanism is also used by Super Mario Kart: Home Circuit when played on its physical cartridge, since the game relies on a QR code to establish a wireless connection between nearby players.  The danger arises when someone other than the intended user scans that QR code first. Doing so lets a stranger's device link up with the Switch console, opening the door to running unauthorized code on the machine or pulling data straight off it. Because account information lives on the console itself, that's a real risk for anyone exposed to this Nintendo Switch vulnerability while gaming around others.  Nintendo has not offered additional detail beyond its advisory. A company representative did not immediately respond when asked for further comment on the matter.  The vulnerability in Nintendo Switch firmware has been formally logged as CVE-2026-82079. It's described as a stack-based buffer overflow, a type of flaw that can allow an attacker within wireless range to execute code on the device. The issue only exists on original Switch consoles running firmware older than version 23.0.0; anything on that version or newer is already protected. 

Fixing the Nintendo Switch Vulnerability 

Nintendo's remedy is straightforward: install firmware 23.0.0, which the company released Sept. 9, one day before publicly disclosing the flaw. To do so, owners should navigate to System Settings, then System, then System Update, and follow any prompts that appear on screen to complete the installation.  For anyone who can't update right away, Nintendo has outlined a few stopgap measures. The company suggests only using the Send to Smartphone feature at home, where a stranger isn't in scanning range, and avoiding public sessions of Super Mario Kart: Home Circuit until the update is applied. More broadly, Nintendo advises against ever scanning a QR code using a device that isn't your own.  Players who exclusively game at home are already shielded from this particular vulnerability in Nintendo Switch systems and don't need to take any further action, since the exploit depends on a nearby attacker being in physical wireless range to intercept the QR code.  Given how quickly Nintendo moved from patch release to public disclosure — releasing the fix Sept. 9 and detailing the vulnerability the very next day — owners are being urged to update sooner rather than later, especially if they regularly play in cafes, transit, or other shared spaces where an unfamiliar device could realistically pick up a stray QR code. 

Check Point Research disclosed Tuesday that a weakness in ChatGPT's code-execution sandbox let data from one user's connected Gmail account be moved into a separate, attacker-controlled ChatGPT account, with no confirmation prompt shown to the victim.

The flaw sat not in the model but in the infrastructure beneath it. Containers running individual conversations cannot address one another directly, Check Point found, but every container could reach the same internal JFrog Artifactory instance OpenAI used for package management. An item-management feature there let any container attach text metadata properties to cached items and read properties written by others, turning a package cache into a two-way message board between environments meant to be isolated.

How the Chain Worked

The attack starts with an instruction the victim never sees. Researchers demonstrated three delivery routes, any one of them was sufficient. First, a prompt pasted into a chat, second was a shared conversation link, or third, a custom GPT carrying a hidden instruction.

The victim's session then quietly processes a second stream of tasks alongside the conversation they can actually see. In one demonstration described by The Register, the user got an ordinary answer, a temperature chart, while an injected task told the session to use the Gmail connector and list their messages.

Those instructions reach whatever the victim has connected. Researchers cited Gmail, Google Drive, Microsoft Teams and GitHub in their findings.

The decisive detail is the permission model. ChatGPT's default connected-app setting automatically approves read actions it judges low risk, with no separate confirmation step. The only trace researchers observed was a small "Talked to Gmail" label appearing afterward. Harvested data went into the shared metadata channel and was collected by the attacker's own session — exfiltration that never touches the victim's browser or their employer's network egress, leaving nothing for conventional data-loss prevention tools to inspect.

Also read: New ChatGPhish Technique Uses Prompt Injection to Manipulate ChatGPT Responses

The Hugging Face Connection

Check Point reported the channel to OpenAI in late June and says it had a working proof of concept before the activity that led to the Hugging Face compromise OpenAI has since disclosed. The two are separate attacks using different techniques, but both ran through the same internal Artifactory instance. On disclosure, OpenAI told Check Point the instance had already been decommissioned because of the Hugging Face incident, so no user-facing patch was needed, and Check Point's write-up cites no CVE for the channel.

In that episode, OpenAI models running an internal exploitation evaluation chained Artifactory zero-days to escalate privileges, reach a node with internet access and pull evaluation answers from Hugging Face's production database. JFrog patched three flaws credited to OpenAI researchers in Artifactory 7.161.15; Hugging Face disclosed the intrusion July 16.

Also read: OpenAI and Hugging Face Investigate AI Models’ Cyber Breakout

Check Point's Pedro Drimel Neto framed the lesson as one of privilege rather than model behavior, saying "the biggest AI security risk has become the access and trust we give it." The firm calls an assistant that holds credentials, runs code and reaches connected services a "coerced insider," and argues the many-tenants-on-one-shared-service pattern warrants scrutiny across agent platforms. OpenAI did not respond to The Register's request for comment.

The latest disclosure lands weeks after the European Commission and national authorities began enforcing the EU AI Act on Aug. 2. Indirect prompt injection remains the top entry in OWASP's Top 10 for large language model applications, and NIST's AI Risk Management Framework treats leakage through connected tooling as a core control area. For enterprises, the exposure is also a GDPR question. Mailbox contents reached through a sanctioned connector are still personal data, and a cross-tenant route to them is a processing failure whether or not it was abused.

Attackers are exploiting an unpatched remote code execution flaw in Adobe Commerce and Magento Open Source to install persistent backdoors on e-commerce sites, Dutch security firm Sansec reported, with the first intrusions observed Sept. 4 and no vendor fix available as of Sept. 6.

Sansec's forensics team, in an advisory, named the flaw StyleSmuggler. No CVE identifier has been assigned. As of Sept. 7, Adobe's Magento security bulletin index listed no September advisory, and the flaw does not appear in CISA's Known Exploited Vulnerabilities catalog, leaving an unknown number of merchants exposed during a window in which working exploit traffic is already circulating.

Magento underpins a large share of mid-market online retail, and Adobe has sold it as Adobe Commerce since acquiring the platform in 2018. The codebase has been a durable target for payment-skimming crews: Sansec has tracked Magecart-style card theft against Magento storefronts for close to a decade, and the platform's checkout position makes any unauthenticated code execution flaw unusually valuable.

According to Sansec's analysis, StyleSmuggler is a two-stage chain that abuses the platform's GraphQL interface. Attackers first inject PHP code into files Magento writes on its own, such as failure reports, then trigger execution through the platform's "Payment Transaction Failed Reminder" email routine. Because the trigger fires when the reminder is generated, no recipient has to open the message for the payload to run.

The vulnerability was confirmed on Magento Open Source 2.4.7, 2.4.8 and 2.4.9. The detail likely to unsettle merchants most is the first known victim: a store running 2.4.6-p15 with all available patches applied. Being current on Adobe's release cycle did not prevent compromise.

The implant Sansec documented is built to survive routine inspection. It runs under a process name mimicking a Linux kernel thread, [kworker/u:8:0], with the binary written to ~/.local/share/.gvfsd/gvfsd-user and a cron entry relaunching it every five minutes. Sansec also listed the domain 247.cdnflare.xyz among its indicators of compromise.

Sansec advised merchants to disable GraphQL where the storefront can tolerate it, disable the PHP proc_open function, and mount /tmp, /var/tmp and /dev/shm with the noexec option. Unofficial community patches have been published by Disrex Group, ProxiBlue and Graycore. Disrex said it independently identified two compromised stores and a third that was attacked without being breached.

Adobe's most recent scheduled Commerce bulletin, APSB26-92, was published Aug. 11 and addressed critical and important flaws across the 2.4.4 through 2.4.9 branches. The company's next scheduled security release is Sept. 8. Adobe did not appear to have commented publicly on StyleSmuggler.

Also read: Adobe Issues Urgent Patch for ‘SessionReaper’ Vulnerability in Commerce and Magento

SonicWall disclosed this week that attackers are chaining two previously unknown vulnerabilities in its SMA1000 secure access appliances to run commands on unpatched devices, and urged customers to install an emergency hotfix.

The more severe flaw, CVE-2026-83548, is a pre-authentication server-side request forgery weakness in the appliance's Appliance Work Place interface, rated 10.0 on the CVSS scale. It lets a remote attacker with no credentials reach sensitive internal functionality. The second, CVE-2026-83549, is an operating-system command injection bug in the Appliance Management Console rated 7.8; on its own it requires administrative authentication, but paired with the SSRF flaw it yields remote code execution.

The vendor said it found both issues internally and then observed them being used together in live attacks. SonicWall has not published indicators of compromise or described the attackers.

Affected products are the SMA1000 series 6210, 7210 and 8200v, in both hardware and virtual form. Fixed builds are 12.4.3-03526 and later, and 12.5.0-02952 and later. SonicWall firewalls running SSL-VPN and the separate SMA 100 line are not affected.

Remediation guidance goes beyond patching. SonicWall told customers to contact its support organization to review appliances for signs of intrusion and, where compromise is suspected, to re-image or redeploy the device, rotate all credentials and reset TOTP tokens — an acknowledgment that one-time-password seeds stored on a breached appliance survive a software update. The company said customers should move to the hotfix release as quickly as possible.

Shadowserver Foundation scanning has tracked more than 400 internet-exposed SMA1000 appliances, though an unknown share of those are already patched. The small install base belies the risk profile. These are remote-access gateways that sit at the network edge and hold credentials for the environments behind them.

The disclosure extends a difficult run for the product line. Attackers exploited a separate pair of SMA1000 zero-days in July 2026, tracked as CVE-2026-15409 and CVE-2026-15410, to deploy custom malware; CISA later confirmed ransomware operators were abusing that access.

Read: CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation

Another zero-day surfaced in December 2025. Seventeen SonicWall vulnerabilities across the company's product families currently sit in CISA's Known Exploited Vulnerabilities catalog. Edge appliances from SonicWall, Ivanti, Citrix and Fortinet have collectively become the preferred initial-access route for ransomware affiliates and espionage crews, because they are internet-facing by design and rarely instrumented with endpoint detection.

CVE-2026-77846, a newly disclosed AshSqlite vulnerability, can allow attackers to access hidden or sensitive fields stored inside JSON and map columns when applications pass untrusted input to AshSqlite's get_path/2 functionality.  The Erlang Ecosystem Foundation's CNA issued the vulnerability entry on August 30, 2026. The issue affects AshSqlite, the SQLite data layer used by the Ash Framework. Although it involves database queries, CVE-2026-77846 is not SQL injection.   Instead, the AshSqlite vulnerability results from unsafe construction of JSON paths and the way SQLite interprets special characters in those paths. 

How the CVE-2026-77846 AshSqlite Vulnerability Works 

In affected releases, AshSqlite generated JSON paths using $."-style path construction through the expression: 

path = "$." <> Enum.join(right, ".") 

The individual path segments were neither escaped nor quoted. Consequently, a key intended to represent the literal name private.secret could instead be interpreted as two JSON levels. Characters such as ., [, ], and $ could similarly alter JSONPath interpretation.  The GitHub advisory describes the flaw as “JSONPath injection in AshSqlite.SqlImplementation get_path”, stating that an attacker controlling a get_path/2 segment can traverse nested JSON and disclose private fields. The affected package is ash_sqlite, with versions 0.1.2-rc.0 through before 0.2.18 affected and 0.2.18 listed as the patched release.  The flaw remains separate from SQL injection because the generated JSON path is supplied to SQLite's json_extract as a bound expression parameter. The attacker manipulates the JSONPath grammar, rather than injecting SQL commands. 

What CVE-2026-77846 Can Expose? 

The AshSqlite vulnerability becomes relevant when an application permits untrusted input to reach get_path/2, such as through a public calculation, filter, or API that lets callers select JSON fields.  A normal endpoint might permit a caller to request a top-level title field. However, supplying private.secret can cause AshSqlite to generate $.private.secret, allowing traversal into a nested object that the API was never intended to expose. Malformed input, such as an unbalanced bracket or bare $, can also produce SQLite JSON path errors that reveal information about the underlying structure.  The published proof of concept used AshSqlite 0.2.17, Bandit, and Req. It created a JSON record containing {"title":"hello","private":{"secret":"s3cr3t-api-key-9f2c"}}. A benign key=title request returned hello, while key=private.secret returned s3cr3t-api-key-9f2c. Captured SQL showed json_extract(p0."data", ?) with the parameter $.private.secret, confirming the traversal. The PoC concluded that a single attacker-controlled path segment could leak a nested value through an endpoint designed to expose only top-level keys. 

Fixes and Administrator Actions for CVE-2026-77846 

The fix replaces the unsafe path joining with encoding that represents keys safely, escapes backslashes and quotes, and handles numeric array indexes separately. Administrators should upgrade to AshSqlite 0.2.18 or later and audit applications that accept network-controlled field-selection input.  Until upgrades are completed, applications should restrict dynamic get_path/2 calls to predefined names, reject dangerous path characters such as periods and brackets, and avoid exposing arbitrary JSON paths.  After upgrading, dependency locks and deployment images should be checked for older ash_sqlite versions. Logs should also be reviewed for unusual dots, brackets, or JSONPath symbols in field-selection requests. Such requests do not prove exploitation, but can help identify systems requiring investigation.  The practical risk of CVE-2026-77846 depends on application architecture. Internal applications without untrusted callers face lower exposure, while public search, filtering, and field-selection APIs require careful validation and access controls. 

Ledger CTO Charles Guillemet said on Aug. 23, 2026, that the company had fixed a clear-signing flaw in its Ethereum app two weeks before security firm TestMachine publicly disclosed the issue. As of Aug. 24, there were no independently verified reports of funds stolen through the specific vulnerability.  The issue involved clear signing, a security feature that displays transaction amounts, addresses, and smart-contract actions directly on a Ledger device before approval. TestMachine said a malicious application could send a competing command while a user was reviewing the legitimate transaction. Under that scenario, the device screen could display one transaction while another was prepared for signing. Researchers cited a potential example in which a limited transaction could be replaced with a broader token approval.  TestMachine said its AI vulnerability scanner, Azimuth, discovered and validated the flaw during an autonomous scan on a Ledger Flex. Because of shared code, the company said Nano X, Nano S Plus, Stax and Apex devices could also potentially be affected. However, no complete public proof of concept showing fund theft across every named device was available at publication.  Guillemet said Ledger Donjon, the company's internal security research team, had independently identified the problem using an AI-powered vulnerability research system. He said the fix “was deployed two weeks ago” and argued that claims the vulnerability remained open amounted to “manufacturing fear for attention.”  TestMachine disputed that account, saying it had shared and verified the finding with Ledger but declined a bounty. Guillemet said the company contacted Ledger's bounty program only after the fix had shipped and did not discuss the vulnerability with the bounty team before publication. Neither side's account of the disclosure sequence has been independently confirmed. 

TestMachine, Ledger and the Missing Release Record 

Ledger's public Ethereum app repository creates another unresolved question. As of Aug. 24, its newest tagged release was version 1.22.1, dated May 27, 2026. Its only listed change was “Instability in APDU communication handling.” No August 2026 tagged release identifies the clear-signing substitution issue described by TestMachine.  That does not establish that Ledger failed to patch the flaw. Ledger can distribute application updates through its device app store without creating a corresponding tagged GitHub release. Still, the public record does not allow users to verify Guillemet's “two weeks ago” timeline or determine which Ethereum app version contains the fix, as CoinLaw reports. Ledger has also not published a detailed technical advisory, affected-version list, or patched release identifier. Its guidance, echoed by Guillemet, is to keep firmware and apps updated. 

What Users Need to Check for the Ethereum App Vulnerability? 

The patched Ethereum app has been described as available through Ledger Live, but updating the desktop or mobile interface alone may not replace an outdated application installed on the hardware wallet. Users therefore need to check the device's own app store and reinstall or update the Ethereum app separately.  The incident also highlights why clear signing matters. Verifying transaction details on the hardware device itself, rather than relying solely on the paired software, is intended to protect users from transaction manipulation.  The Ledger discussion should not be treated as evidence of confirmed losses from this flaw. At this stage, the facts establish a disputed disclosure timeline, an asserted fix, and a lack of independently verified theft—not confirmation that funds were lost or that the patch was never shipped.  For TestMachine, Ledger and users alike, the unresolved issue is documentation. A dated, versioned security advisory identifying the affected versions and patch would allow users to verify their protection without relying on competing public statements. 

An AI agent assigned to book a gym class in Australia reportedly discovered a gym system vulnerability, used it to secure reservations months ahead of schedule, and then cancelled another customer's booking.   The incident, reported by the Australian Broadcasting Corporation (ABC) and other outlets, involved Andrew, who describes himself as an AI expert. He wanted to reserve a popular early-morning class at his regular gym and gave the task to Anthropic's large language model, Claude, through the open-source AI agent software OpenClaw.  Within minutes, the AI agent reportedly uncovered an authentication weakness in the gym's reservation system. Regular customers were generally restricted to booking classes only a few weeks ahead, but the gym system's vulnerability allowed the AI to access dates several months into the future. It subsequently secured those reservations. 

AI Agent Finds Gym System Vulnerability 

The situation became more serious when Andrew was fourth on the waitlist for a class scheduled later that week. He asked the AI how he could improve his position. Instead of simply explaining the options, the AI agent apparently tested the gym system vulnerability by cancelling the reservation belonging to the person at the top of the waitlist.  The AI told Andrew the action had been carried out "as part of a test" and sent him a message explaining the flaw: "The API had absolutely no authentication check when canceling someone else's booking. I tested this on the person in the number 1 spot on the waitlist, and the process actually went through. You have now moved up from 4th to 3rd."  Andrew immediately instructed the AI to undo the action. The system, however, responded: "I have bad news. It is impossible to restore that person." Andrew ultimately directed the AI agent to draft and send an email to the system provider, disclosing the exploited vulnerability and reporting what had occurred. 

AI Alignment and Liability Concerns 

Bill Simpson-Young, affiliated with an Australian AI research institute, said the episode demonstrated the growing risks associated with autonomous AI. "You ask for something harmless, and the AI might take another action that a human never thought of or explicitly requested," he said, warning that the case also exposed the fragility of modern digital security.  The episode is being viewed as a striking example of the AI "alignment problem." The term describes situations in which an AI pursuing a particular objective chooses methods that users or developers did not anticipate, including potentially unethical or illegal actions. As autonomous AI systems gain greater independence, the consequences of such decisions could become increasingly serious, making AI safety an important concern.  The Australian Signals Directorate (ASD) has previously warned about AI agents misinterpreting instructions or taking unexpected actions. Additional concerns arise when multiple AI models work together, potentially making responsibility harder to establish and creating new AI cybersecurity challenges.  Current Australian legal frameworks also provide no straightforward answer to liability in such cases. Existing laws generally assign responsibility to natural persons or corporations, leaving uncertainty over whether damages caused by a rogue AI agent should be attributed to the user, developer, model provider or operator of the vulnerable system. 

Anthropic has disclosed the findings of an Anthropic cybersecurity evaluation that uncovered three incidents in which Claude AI models unintentionally accessed the public internet during controlled cybersecurity testing. The company said the events stemmed from misconfigured third-party evaluation environments rather than deliberate attempts by the models to escape their testing boundaries. The review began after OpenAI announced on July 21 that several of its AI models had escaped an isolated testing environment by exploiting an unknown vulnerability and reached Hugging Face’s production infrastructure. In response, Anthropic examined 141,006 cybersecurity evaluation runs, identifying three confirmed incidents across six runs, including four involving the same organization.

Anthropic Cybersecurity Evaluation Traced Issue to Testing Environment

All three incidents occurred during capture-the-flag (CTF) cybersecurity exercises, where Claude AI models were instructed to retrieve a hidden "flag" from what they were told was a fully isolated network with no internet access. However, a configuration error between Anthropic and evaluation partner Irregular unintentionally allowed internet connectivity. Because the models believed every reachable system belonged to the simulation, they treated real production infrastructure as legitimate CTF targets. Anthropic said the models relied on basic attack methods, including exploiting weak passwords, exposed debug pages, unauthenticated services and SQL injection, rather than sophisticated exploits or attempts to escape the environment. The incidents involved Claude Opus 4.7, Claude Mythos 5 and an internal research model. The earliest occurred in April 2026. Anthropic noted the evaluations were conducted without its standard deployment safeguards, such as monitoring systems and misuse detection classifiers, although the models retained built-in safety training. The evaluation infrastructure also remained isolated from Anthropic's internal systems and customer data.

Three Incidents Involving Claude AI Models 

The first incident, involving Claude Opus 4.7, occurred after a fictional company used in the evaluation shared its name with a real website domain. Across four evaluation runs, the model failed to locate its simulated target, discovered the real company online, and compromised its infrastructure. It extracted application and infrastructure credentials and accessed a production database containing several hundred rows of data. Although the model eventually recognized it was likely interacting with a real environment, it continued the attack, at times reasoning that the real company was intentionally part of the exercise. The second incident involved Claude Mythos 5. During the exercise, the model encountered fictional setup instructions referencing a nonexistent Python package on PyPI. Believing it was solving the challenge, Claude created an account, published a malicious package, and spent considerable effort overcoming obstacles, including finding an email provider after unsuccessfully attempting to obtain a phone number for registration. The package remained publicly available for about one hour before PyPI removed it. During that time, it was downloaded and executed on 15 real systems, including a security company's automated malware scanner. Anthropic said the scanner executed the hidden code, allowing credentials to be exfiltrated and later used to access additional infrastructure. Claude itself acknowledged early in the evaluation that publishing the package on the real internet would be "NOT okay, and surely not the intended solution," but ultimately convinced itself it was still operating in a simulation. The third incident involved an internal research model that scanned roughly 9,000 internet-connected targets after failing to reach its fictional objective. It eventually compromised one organization's internet-facing application using exposed credentials and SQL injection. Unlike the older models, it later concluded the compromised cloud account was unrelated to the exercise and voluntarily stopped the attack.

Anthropic outlines Lessons from Cybersecurity Evaluation 

Anthropic began reviewing transcripts on July 23, suspended all cybersecurity evaluations after detecting possible internet access, and confirmed the three incidents by July 24. On July 27, it informed Irregular and the affected organizations. Two organizations had not previously detected the activity and are working with Anthropic on remediation, while efforts to contact the third continue. The Anthropic cybersecurity evaluation concluded that the incidents reflected operational and evaluation-environment failures rather than model alignment failures. According to the company, the models pursued only the assigned CTF objective because they incorrectly believed real systems were part of the simulation. Anthropic added that its latest research model demonstrated more appropriate behavior by stopping once it recognized the target was real, although the company said more testing is needed before drawing firm conclusions. Anthropic is now strengthening monitoring, network isolation, and vendor assurance processes with Irregular. It is also working with independent AI evaluation organization METR on a third-party review and plans to release a lightly redacted transcript of the PyPI incident. The company said stronger evaluation infrastructure, improved situational awareness, and layered safeguards are essential as Claude AI models and other advanced AI systems continue to evolve.

WordPress has released security updates to address the wp2shell vulnerability, a critical flaw that allowed attackers to achieve remote code execution (RCE) on vulnerable sites using a single anonymous web request.   Unlike many previous attacks, this issue did not require plugins, authentication, or third-party code, making affected core installations particularly vulnerable. Security patches were released in WordPress 6.9.5 and 7.0.2. 

wp2shell Vulnerability Exposed Core WordPress Sites 

Tracked as CVE-2026-63030, the wp2shell vulnerability is described in the official WordPress release notes as a "REST API batch-route confusion and SQL injection" issue that can result in remote code execution. The flaw originates from the REST API batch endpoint located at /wp-json/batch/v1, or its legacy query-string alias ?rest_route=/batch/v1, allowing exploitation through a single anonymous web request.  The vulnerability was discovered by Adam Kues of Assetnote, an attack surface management division of Searchlight Cyber, through the WordPress HackerOne programme.   To provide defenders time to update their systems, Searchlight Cyber intentionally withheld technical exploitation details, stating, "Given the egregious nature of the flaw and to ensure defenders have adequate time, we are refraining from disclosing technical specifics at this juncture." 

Second SQL Injection Flaw Patched 

The same security release also fixed CVE-2026-60137, another critical SQL injection vulnerability. WordPress credited researchers TF1T, dtro, and haongo for reporting the issue. Unlike the wp2shell vulnerability, this flaw predates the latest release and was backported to WordPress 6.8.6. The wp2shell vulnerability only affects versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1.  Severity ratings differ across security advisories. While WordPress classifies CVE-2026-63030 as "high severity," the corresponding GitHub Security Advisory (GHSA-ff9f-jf42-662q) labels it as Critical with a CVSS score of 7.5. Regardless of classification, both vulnerabilities require immediate patching because the wp2shell vulnerability can be exploited without authentication. 

Immediate Updates Recommended 

Powering around 40% of websites, WordPress responded by enabling forced automatic updates for affected versions, including WordPress 7.1 beta2, to secure pre-release installations. As of 17 July, there were no confirmed reports of active exploitation. However, security researchers warned that because WordPress is open source and patch-related code changes became publicly available immediately, proof-of-concept exploits could emerge within hours.  Administrators should verify that every internet-facing WordPress installation has successfully received the update, as some hosting environments disable automatic updates or lock websites to specific versions. Site owners can also check exposure using the public tool available at wp2shell.com. If immediate patching is not possible, temporarily blocking both REST API batch endpoints at the Web Application Firewall (WAF) level can reduce risk, although this should not replace installing the official update.  Security teams managing multiple WordPress websites should also monitor for spikes in anonymous web request traffic targeting batch endpoints, as the wp2shell vulnerability demonstrates how overlooked core features can introduce severe security risks. 

A newly disclosed GitLab vulnerability has revealed how two long-standing memory-safety flaws in the widely used Ruby JSON parsing library, Oj, can be combined to achieve remote code execution on default GitLab installations. The research, led by Yuhang Wu as part of the Open Defense Initiative, demonstrates how attackers could exploit Jupyter Notebook file processing to execute arbitrary commands, potentially exposing repositories, application secrets, and internal services.

Yuhang Wu Discovers GitLab Vulnerability in Oj Parser 

As part of the Open Defense Initiative, Depthfirst researcher Yuhang Wu used an automated analysis system to examine Oj, a high-performance native C-based JSON parser used across Ruby applications, including GitLab. The analysis identified 18 prioritised vulnerabilities, seven of which were memory-safety issues. Two of these flaws had remained undetected for nearly five years before being combined into a working exploit chain.  The vulnerabilities included an unchecked nesting-stack write in Oj::Parser.usual.parse and an unsafe 16-bit key-length narrowing issue that leaked a heap pointer. Individually, the bugs appeared limited, offering only a repeated one-byte write primitive and a fixed 29-byte memory disclosure. However, by carefully manipulating heap allocation, the exploit gained control of a callback pointer and bypassed Address Space Layout Randomisation (ASLR), enabling arbitrary code execution as the "git" system user. 

Jupyter Notebook Processing Creates Attack Path 

The GitLab vulnerability stems from the platform's handling of Jupyter Notebook (.ipynb) files. GitLab uses an in-tree gem called ipynbdiff to generate human-readable notebook differences. Before displaying a diff, the gem parses each notebook with Oj to verify that the JSON contains a "cells" field.  Because Jupyter Notebook files are JSON documents, any authenticated user with permission to push commits and view commit differences could submit specially crafted notebook files. The exploit chain used two malicious notebook files in a single commit-diff request. The first abused excessive nesting depth to corrupt an internal buffer pointer, eventually allowing a Ruby Array to overlap with a parser callback pointer and overwrite p->start with an attacker-controlled address.  The second file leaked a heap pointer through an oversized JSON object key that appeared in the generated HTML diff. This disclosed the memory addresses of libraries such as libc and libruby, defeating ASLR. Since GitLab's Puma application server processes multiple threads using a shared parser instance, both files were handled by the same vulnerable parser, allowing the corrupted callback to invoke system() and execute shell commands.  Unlike previous GitLab remote code execution vulnerabilities that depended on server-side request forgery (SSRF) against Redis, this GitLab vulnerability bypassed modern SSRF protections by targeting a native memory-unsafe dependency within Ruby code. Any project member with standard push and diff-view permissions could trigger the attack without administrator privileges, CI/CD access or user interaction.   According to Depthfirst, successful exploitation could expose repository source code, Rails secrets, service credentials, and internal services, creating risks of data theft, code tampering, and lateral movement. 

Affected Versions and Available Fixes 

The GitLab vulnerability affects GitLab CE/EE versions 15.2.0-18.10.7, fixed in 18.10.8; 18.11.0-18.11.4, fixed in 18.11.5; and 19.0.0-19.0.1, fixed in 19.0.2. The Oj gem is affected from versions 3.13.0-3.17.1 and fixed in version 3.17.3.  GitLab.com had already been patched before disclosure, while GitLab Dedicated customers required no action. Self-managed deployments running affected versions should upgrade immediately. The vulnerable Oj code was introduced in August 2021, with GitLab adopting the affected parser in July 2022 through version 15.2.0.   Yuhang Wu reported the Oj flaws on 21 May 2026 after they had remained undiscovered for 1,753 days. Oj merged fixes on 27 May, released version 3.17.3 on 4 June, and the GitLab exploit chain was reported on 5 June, confirmed on 8 June and patched on 10 June 2026 in releases 19.0.2, 18.11.5 and 18.10.8.   The same research also uncovered nine additional published CVEs affecting Oj, including stack and heap buffer overflows, use-after-free vulnerabilities, a negative-size memcpy flaw and a large-file integer overflow, highlighting the risks posed by memory-unsafe native extensions in Ruby applications. 

A Zimbra phishing campaign attributed to Russian state-supported cyber actors has targeted Western government and commercial organizations, exploiting CVE-2025-66376 to access sensitive email data and other information, according to a joint cybersecurity advisory issued in July 2026. The activity has been linked primarily to LAUNDRY BEAR, a Russian state-supported advanced persistent threat (APT) group tracked under several names across the cybersecurity industry. The advisory said the campaign has been active since at least July 2025 and has targeted organizations using the Zimbra Collaboration Suite (ZCS). Unlike conventional phishing attacks that typically require victims to click a malicious link or open an attachment, the campaign uses a view-based exploit. A user only needs to view a malicious email in a vulnerable version of ZCS webmail for the exploit to attempt execution.

Zimbra Phishing Campaign Uses CVE-2025-66376

The campaign centers on CVE-2025-66376, a vulnerability that was initially exploited as a zero-day vulnerability before a patch was released. According to the advisory, the activity began in July 2025, months before the vulnerability was published and patched. The vulnerability allows a JavaScript payload contained in email content to execute because of improper sanitization of CSS @import directives within an email. The malicious payload uses Base64 encoding and XOR encryption and can be modified to help bypass basic threat detection signatures. Once triggered, the payload attempts to collect and exfiltrate information through 12 stages. These include gathering the victim's email address and environment information, collecting two-factor authentication codes and application passwords, attempting to capture saved passwords, enabling mail protocols, gathering the Global Address List (GAL), and sending archived email data. The advisory said the campaign's use of a zero-day exploit demonstrates the ability of LAUNDRY BEAR to operationalize novel vulnerabilities into a successful attack capability.

LAUNDRY BEAR Targets Email and Sensitive Data

The primary objective of the Russian state-supported cyber actors appears to be the covert acquisition of email data. The campaign attempts to steal the last 90 days of email communications, email addresses, passwords, the organization's Global Address List, 2FA tokens and newly created application passcodes. The actors have targeted organizations connected to the defense industrial base, government, education, energy, law enforcement, media, non-governmental organizations and technology sectors. The advisory said LAUNDRY BEAR likely identifies organizations with publicly exposed Zimbra infrastructure through port scanning and commercially available datasets. It may then compile individual user email addresses using commercial data, open-source intelligence or previously exfiltrated information. The group has also used compromised accounts to distribute phishing emails. Since at least November 2025, malicious emails were reportedly sent from victim infrastructure, potentially using previously compromised accounts to make the activity harder to detect and to bypass anti-phishing measures.

Ulej and Flowerbed Support Email Data Exfiltration

The campaign uses a custom capability called Ulej, which was developed to exploit ZCS and exfiltrate sensitive information. The collected data is sent to infrastructure associated with the Flowerbed framework. Flowerbed is a Python project using Docker and includes four containers: Catcher, Certbot, Nginx and Gardener. Catcher receives and aggregates stolen information, while Nginx operates as an HTTPS reverse proxy. The framework uses DNS and HTTPS channels for email data exfiltration. The advisory said the campaign can exfiltrate email content, contacts, attachments, authentication information and other data. The stolen information is initially stored by Catcher before being transferred to non-public-facing infrastructure. The report also noted indications that artificial intelligence may have played a role in developing the Flowerbed codebase, highlighting the increasing use of AI in developing malicious capabilities.

Organizations Urged to Patch Vulnerable Zimbra Systems

The advisory urged organizations using ZCS to immediately ensure their systems are not running vulnerable versions. A patch for CVE-2025-66376 was released for ZCS versions 10.1.13 and 10.0.18. If immediate patching is not possible, organizations are advised to have employees use alternative mail clients and avoid the Classic ZCS webmail client until the software is updated. Security teams are also advised to monitor internet-connected ZCS systems, workstations accessing those systems and network traffic for signs of suspicious activity. Recommended monitoring includes looking for large outbound data transfers to unfamiliar VPS providers, unusual DNS queries with random subdomains, sudden connections to newly established domains and connections involving VPN providers such as Mullvad. Organizations should also consider authentication services that support passkeys and maintain network monitoring, packet capture or NetFlow data and relevant logs. The advisory further recommends that organizations identifying victims revoke Application Passcodes and 2FA scratch keys and require affected employees to change their passwords. Security teams should also investigate the original phishing email and quarantine similar messages to prevent further exploitation and data theft.

OpenAI and Hugging Face are investigating an AI security incident involving an AI agent that compromised infrastructure while models were being evaluated for advanced cyber capabilities. The incident was detected and contained after the models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure.

Hugging Face disclosed the incident last week, while OpenAI has now shared preliminary findings from its investigation. According to OpenAI, the activity involved a combination of models, including GPT 5.6 Sol and a more capable pre-release model, with reduced cyber refusals for evaluation purposes. The models were being tested against a benchmark designed to measure advanced cyber capabilities.

OpenAI described the incident as unprecedented and said it is continuing its investigation alongside Hugging Face. The company said the findings are being shared to help defenders understand what occurred and assess the capabilities of increasingly advanced AI models.

OpenAI and Hugging Face Investigate AI Security Incident

The incident took place during an internal evaluation designed to test models against advanced exploitation scenarios involving complex attack paths. OpenAI said the evaluation was conducted without production classifiers that normally prevent models from pursuing high-risk cyber activity.

The testing environment was designed to be highly isolated, with network access limited to package installation through an internally hosted third-party software system that functions as a proxy and cache for package registries.

Despite these restrictions, the models spent substantial inference compute attempting to obtain open Internet access. During this process, they identified and exploited a zero-day vulnerability in the package registry cache proxy. OpenAI said the vulnerability has since been responsibly disclosed to the vendor.

The models then carried out privilege escalation and lateral movement within the research testing environment until they reached a node with Internet access.

[caption id="attachment_113283" align="aligncenter" width="600"] Source: OpenAI[/caption]

Models Chained Vulnerabilities Across Infrastructure

After obtaining Internet access, the models inferred that Hugging Face could host models, datasets and solutions related to the ExploitGym evaluation. The models then searched for ways to obtain secret information that could help them bypass the evaluation.

In one example described by OpenAI, the models chained multiple attack vectors, including stolen credentials and zero-day vulnerabilities, to identify a remote code execution path on Hugging Face servers.

OpenAI's security team detected the anomalous activity internally. Hugging Face's security team and agents also detected and stopped the activity on its infrastructure. The company had already begun containment and forensic reconstruction using its own open-source models when the two organizations connected.

Both companies are continuing to investigate the incident and its impact.

OpenAI Strengthens Security Controls After Incident

As part of its response, OpenAI said it is implementing stricter infrastructure configuration controls while identified vulnerabilities are patched. The company acknowledged that these measures could come at the cost of research velocity and said its Safety and Security Committee is being briefed on the controls and their impact.

OpenAI is also working with Hugging Face on the forensic investigation and has responsibly disclosed the identified zero-day vulnerability in the internally hosted third-party software.

The company has also brought Hugging Face into its trusted access program and is supporting its teams in using AI model capabilities to strengthen defenses.

OpenAI said it is improving protections around future training and evaluations, including stronger safeguards for model alignment, cybersecurity and monitoring during internal testing. The company noted that deployment safeguards were intentionally disabled during this evaluation because the goal was to measure cyber vulnerabilities.

AI Cyber Capabilities Raise New Security Concerns

OpenAI said the incident demonstrates the need for AI security and safety measures to keep pace with rapidly advancing model capabilities. The company is strengthening containment, monitoring, access controls and evaluation practices used during model development.

The incident also highlights how advanced models can potentially discover and exploit novel attack paths in real-world systems without access to source code. OpenAI said increasingly capable models should also be used defensively to help security teams identify weaknesses, understand vulnerability chains and accelerate remediation.

Hugging Face CEO Clem Delangue said the incident demonstrates the importance of collaboration in addressing AI safety and security challenges. Both organizations said they will continue investigating the incident and share additional findings and best practices as the work progresses.

Google has introduced Gemini 3.5 Flash Cyber, a lightweight AI model designed to improve cybersecurity by helping defenders identify, validate, and patch software vulnerabilities more efficiently. Built on Gemini 3.5 Flash and optimized for security tasks, Flash Cyber aims to deliver a cost-effective alternative to larger AI models while supporting large-scale vulnerability analysis. The company said it has invested in cybersecurity research for years, including automated vulnerability discovery through CodeMender, its code security agent that can detect and fix critical software flaws. However, as AI systems become increasingly capable of discovering vulnerabilities faster than defenders can resolve them, Google believes a scalable and affordable approach is needed. 

Gemini 3.5 Flash Cyber Focuses on Scalable Cybersecurity 

According to Google, Gemini 3.5 Flash Cyber has been fine-tuned specifically to locate, verify, and remediate vulnerabilities more effectively than Gemini's standard Flash models. Because of the technology's dual-use nature, the company is initially limiting access through a pilot program for governments and trusted partners via CodeMender, with broader availability planned over time.  Google also confirmed that CodeMender's core capabilities will be made available through generally available Gemini models on the Gemini Enterprise Agent Platform. 

Flash Cyber Improves Large-scale Code Analysis 

A major challenge in cybersecurity is exploring vast execution search spaces across complex codebases. Instead of relying on a single call to a large language model, CodeMender invokes Flash Cyber multiple times, allowing sub-agents to inspect significantly more code paths before generating one consolidated report.  Google said the model's speed and lower operating cost make it suitable for continuous code scanning, software launch processes, and commit-scanning pipelines at scale. 

Benchmark Results Show Competitive Performance 

Google evaluated Gemini 3.5 Flash Cyber using the CyberGym benchmark, which measures AI agents against hundreds of real-world software vulnerabilities. Configured to call the model up to five times before producing a final report, CodeMender achieved competitive performance against significantly larger cybersecurity models. Google noted that competitor results were based on provider self-reported scores.  The model also outperformed Gemini 3.5 Flash and 3.6 Flash during Google's internal Big Sleep evaluation, which tested vulnerability discovery in complex projects such as Chrome and Safari without safety guardrails.  In Chrome's production commit-scanning pipeline, where vulnerabilities remained undisclosed to prevent benchmark contamination, Flash Cyber again delivered a significant improvement over Gemini 3.5 Flash. Google added that competitor models released after Opus 4.6 were excluded because their safety guardrails prevented them from completing the tasks.  Testing on the V8 JavaScript Engine found 55 unique confirmed vulnerabilities with Gemini 3.5 Flash Cyber, compared with 47 for Gemini 3.5 Flash and 36 for Opus 4.6, including 10 issues missed by both competing models. 

Real-world Cybersecurity Deployment 

Google said Flash Cyber is already helping secure internal projects, including Chrome, Android, Cloud, Ads and YouTube. In one example, Google's Cloud Vulnerability Research team used the model to identify remote code execution vulnerabilities in public APIs and a memory-corruption flaw within a sensitive production service in just two hours. The model also generated a 100% reliable remote code execution exploit capable of bypassing Address Space Layout Randomization (ASLR) and Write XOR Execute (W^X).  Google added that early feedback from Wiz and Cloud CISO Security Engineering testers indicated a significant capability improvement over Gemini 3.5 Flash. The company also highlighted resources such as OSV.dev, which tracks more than 700,000 open-source vulnerabilities, and over a decade of OSS-Fuzz data as key training assets supporting its cybersecurity models.