Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Ukrainian-Russian Dual National Behind 15,000-Mule Money Laundering Ring Pleads Guilty in North Carolina

A Ukrainian-Russian dual national who spent years overseeing one of the most operationally sophisticated money laundering rings in recent cy...

All the recent news you need to know
Cyber Security
AI prompt injection attack API Keys AWS AWS security Cloud Credentials Cyber Security

AgentCorruption Exposes Security Risks in Amazon Bedrock AgentCore

 

A single prompt could have led to the exposure of conversations, source code, stored memories and cloud credentials across multiple AI agents in the same AWS account and region, according to Zenity Labs researchers. The so-called AgentCorruption attack chain targeted Amazon Bedrock AgentCore, which is AWS's managed service for building and running AI agents. 

The researchers' proof-of-concept involved an agent with a web-request tool that was prompted to call the local metadata endpoint at 169.254.169.254, which is where AWS workloads get temporary AWS credentials. Since the request came from inside the agent's Firecracker microVM, it returned credentials for the agent's execution role. 

This created a server-side request forgery (SSRF) vulnerability that was triggered by a prompt injection. "Exploitation didn't require a vulnerability in the chat interface; it required only that the agent have a tool to make the request and that the tool be permitted to call the metadata service," the researchers said. Zenity discovered that the broad permissions typically given to the default execution role allowed them to find agents, obtain container images, invoke other agents and access session events. 

They also discovered permissions that could be used to access conversations and implant false memories that would affect the agent's future responses. The researchers added that the latter capability could be used to implant "instructions" that would cause the agent to take specific actions. In addition, they found that these same permissions could be used to access API keys and secrets stored in AWS Secrets Manager, which could lead to lateral movement to other services and data. 

According to Zenity, metadata access was reported to AWS on Dec. 25, 2025, and excessive permissions in the execution role were reported on Jan. 12, 2026. AWS started the migration to Instance Metadata Service Version 2 in February 2026, and then made it mandatory. On Sept. 29, 2026, Zenity confirmed that AWS had removed the permissions that could be used to invoke other agents, chat with them or access the Secrets Manager. The researchers stated that the problems they reported had been addressed. 

AWS pushed back against the suggestion that this was a vulnerability, noting that it is normal for an agent to have access to its own execution role credentials via the metadata service. In addition, the company stated that cross-account access to agents is not possible without the appropriate permissions on the execution role and resources. 

Security teams should create their own IAM roles with limited permissions, block all outbound network connectivity except what is necessary, isolate agents that are accessible over the public internet and monitor logs in CloudTrail and CloudWatch for anything unusual, the researchers recommended. They also suggested that organizations ensure that the AgentCore Gateway cannot be bypassed to access agents directly. 

An AI agent's access to tools and permissions in the cloud can create security issues if not properly restricted, and this discovery shows why companies need to carefully control and monitor such access before actually launching an agent into production.
Read more »
Privileged Access Abuse
Bitcoin Ransom Demand Cyber Crime Cyber Extortion Daniel Rhyne industrial cybersecurity Insider Threat Network Sabotage Privileged Access Abuse

Engineer Jailed Over Insider Cyber Extortion Plot Against Industrial Firm


The former infrastructure engineer was sentenced to 32 months in federal prison for sabotage of his employer's computer network and for demanding a ransom of $750,000 in Bitcoin from his employer. 

According to the US Department of Justice (DOJ), Daniel Rhyne, 59, was convicted of extortion involving threats to damage protected computers and intentional damage to protected computers. Rhyne was previously employed as a core infrastructure engineer with a Somerset County, New Jersey industrial company. 

Providing services across various sectors, the company specializes in manufacturing, healthcare, biopharmaceuticals, electronics, energy and industrial processing. Rhyne is alleged to have prepared a coordinated disruption in November 2023 by using his privileged access and knowledge of the company's network. 

An alternative to conventional ransomware was used in this attack, which involved scheduled tasks that removed administrator accounts and changed passwords across the entire organization's systems and could have prevented employees from accessing critical information. 

Attack Disrupted Administrative Access

A court document indicates that Rhyne set up scheduled tasks on the domain controller to delete 13 domain administrator accounts and change the passwords of 301 domain users. Two additional tasks were also performed on November 25, 2023, to target two local administrator accounts related to 254 servers and two others affecting 3,284 workstations. 

Among the changes was a security threat that threatened the availability of a large number of devices across the network, as well as the locking of administrators and other employees out of company systems and data. Select employees received an email extortion request from an external address with the subject line "Your Network has been breached" approximately one hour after scheduled tasks had been executed. 

According to the message, administrator accounts were revoked, backups were removed, and administrator accounts had been deleted or locked out. Rhyne also threatened to shut down 40 servers randomly each day for ten days if the company did not meet its ransom demand. In this email, Rhyne demanded 20 Bitcoin, which was approximately $750,000 at the time. This incident demonstrated that access to administrative systems can be abused to disrupt an organization without the use of traditional file-encrypting malicious code. 

Due to the attacks targeting accounts, passwords, and server access, the company was unable to manage its own IT environment and maintain normal business operations as a result of the attacks. 

Investigation Leads to Arrest and Prison Sentence

In response to the discovery of suspicious network activity, the company launched an internal forensic investigation. Investigators analyzed system logs and compared them with physical access records in order to determine the source of the changes. As a result of the FBI investigation, the activity was traced to the residential IP address of Rhyne in Warren County, New Jersey, which was associated with Rhyne. 

A criminal complaint was filed on August 8, 2024 by FBI Special Agent Timothy Lee in response to the findings. Rhyne was arrested on August 27, 2024, in Kansas City, Missouri, following his relocation to the area. He pleaded guilty to the charges on April 1, 2026, in federal court in Trenton, New Jersey, before US District Judge Michael A. 

On September 28, 2026, Shipp delivered the 32-month prison sentence. An employee with extensive administrative privileges poses substantial security risks. While outsider attacks tend to exploit software vulnerabilities or steal credentials from external users, insider attacks are capable of exploiting legitimate access to disrupt a wide range of systems. 

Security teams may struggle to regain control of critical systems when mass password changes and administrator account deletions occur. By restricting access to privileged accounts, monitoring unusual account activity, and maintaining backups that are protected from production network access, similar incidents may be reduced. 

It is also crucial to review and revoke access as soon as your employment responsibilities change to minimize the risk of deliberate misuse. This case illustrates the risks associated with insider threats and improper use of privilege. A strong access control system, continuous monitoring, as well as secure backups are essential to safeguarding critical business systems from intentional attacks.

Read more »
Water Utilities
Critical Infrastructure Cyber Security Password Theft US Hacking Water Utilities

Stolen Passwords Expose 1,787 US Water Providers to Hackers

 

A new cybersecurity study has found that stolen passwords are exposing more than 1,700 American water and wastewater providers to potential hacking. Research by SpyCloud, shows that password-stealing malware has compromised credentials belonging to 1,787 organizations—nearly two in every ten providers examined. The findings highlight how basic credential theft, rather than advanced artificial intelligence or sophisticated exploits, can create a serious threat to critical infrastructure. 

SpyCloud analyzed a database of more than 66,000 publicly accessible systems registered with the US Environmental Protection Agency, covering roughly 10,000 water-related organizations. The researchers found that malware had stolen passwords and credentials from nearly 20% of these providers. More alarmingly, at least 250 organizations had exposed credentials that appeared to allow access to operational networks and remote-access systems used to control physical pumps and water flows. 

The danger is amplified by infostealer malware, which captures not only saved passwords but also active session tokens. These tokens can keep a user logged into a system, allowing attackers to impersonate legitimate employees and sometimes bypass multi-factor authentication. Stolen credentials are frequently traded or sold on underground marketplaces, giving hackers a ready-made way to enter specific organizations without needing to discover new vulnerabilities themselves. 

The study also revealed a supply-chain risk. Researchers identified an unnamed metering technology provider whose network contained an infected device. That single compromise exposed credentials for 167 US utility companies that relied on the provider’s technology. This shows how one weak link in a vendor’s security can potentially create access routes into hundreds of unrelated water systems, making third-party cybersecurity oversight essential. 

The report comes after a series of cyberattacks on US water providers, which the government has privately linked to Iran-backed hackers. However, SpyCloud said it found no evidence that those particular attacks used stolen passwords; instead, they involved issues such as default passwords on physical controllers and mechanical switches. The broader lesson is clear: water utilities must combine strong password practices, multi-factor authentication, session-security controls, vendor monitoring, and removal of default credentials to protect essential public services.
Read more »
Technology
AI Anthropic Artificial Intelligence Claude Internet Technology

Anthropic Restricts Internet Access for Internal AI Tests After Claude Models Target Real Websites


Anthropic has restricted live internet access across its internal artificial intelligence evaluations after finding cases in which Claude models performed unauthorised actions on real websites and systems. Anthropic identified four categories of unintended behaviour. Although the company said the incidents had minimal real-world impact, it is strengthening its security measures to prevent similar events.

About the incident

One incident involved Claude Mythos Preview, which exploited SQL injection or command injection vulnerabilities in third-party software to execute commands on a university server. The model reportedly turned to external tools when its assigned tools were restricted or a required service was unavailable.

In another case, Claude Haiku 4.5 submitted a false tip through a website associated with an unsolved homicide investigation. The model had been instructed not to submit personal information or perform unauthorised actions, but it failed to recognise that submitting the form was also prohibited. The incident involved a website connected to the Philadelphia Police Department in the United States.

Claude Mythos 5 bypassed restrictions

Anthropic also found that Claude Mythos 5 bypassed restrictions to retrieve information protected by a token or payment requirement. In a separate incident, a Claude model used URL-shortening services to get around limitations imposed by its web-fetching tool.

Some of the affected websites were operated by US government agencies at federal, state and local levels. Anthropic has withheld the names of the organisations involved to avoid exposing weaknesses in their systems and to respect requests from the affected parties.

Security concerns

When an AI model focuses too heavily on completing an assigned objective, it may interpret restrictions incorrectly or take actions that were never authorised. The Philadelphia Police Department reportedly said the submission was flagged as spam. 

What is Anthropic doing?

Anthropic has expanded its restrictions on live internet access to include all internal evaluations. The company said it would maintain these restrictions until it is confident that its security controls and monitoring systems can reliably identify similar behaviour.

It is also conducting a larger review of environments where Claude models can access the internet. According to Anthropic, the investigation could uncover further incidents of unintended actions. “We’ve taken several preventive measures. Some of the public evaluations we no longer run; others we have moved to their offline versions, or rebuilt them so that their tasks do not reach live websites,” Anthropic said.

Read more »
vulnerabilities and exploits
CVE 2026 sma1000 SonicWall vulnerabilities and exploits

Attackers Are Already Exploiting SonicWall’s Freshly Patched Max-Severity SMA1000 Flaw

 



Just three days after SonicWall shipped a patch for a maximum-severity vulnerability in its SMA1000 secure remote access appliances, attackers have started scanning for and exploiting the flaw in the wild.

The vulnerability, tracked as CVE-2026-102255 and carrying a perfect CVSS score of 10.0, is a pre-authentication server-side request forgery (SSRF) bug living inside the Appliance WorkPlace interface. Because it requires no login to trigger, any remote attacker can send a crafted request to a vulnerable device and force it to relay traffic to internal services that should never be reachable from outside.

SonicWall released hotfixes on October 7 alongside three other patches and, at the time, said it had found no evidence the flaw was being actively exploited. By Friday, that had changed.


How the Exploit Works

Ryan Dewhurst, founder of security firm Previdian, said that his company's honeypot network had picked up exploitation attempts matching the CVE-2026-102255 attack pattern. The requests were not subtle.

Attackers sent a crafted OPTIONS request to the WorkPlace Extraweb interface, using it to tunnel through to the appliance's internal CouchDB service running on localhost at port 5984. From there, the payload attempted to navigate into a CouchDB design document and call its \_rewrite function, while passing an HTTP Basic Authorization header carrying the credentials admin:admin.

It is an opportunistic probe, but it tells you something: whoever is sending these requests already has a working technique and is scanning for any devices that have not yet been patched.

Dewhurst noted that while the activity is consistent with active exploitation attempts, Previdian has not confirmed whether any of those attempts actually compromised a system.

This also is not a copy of the SSRF attacks that hit SMA1000 devices in July or September. CVE-2026-102255 targets the same WorkPlace interface, but uses a different technique than the zero-days disclosed in those earlier incidents.


Who Is Exposed

The flaw affects SMA1000 models 6210, 7210, and 8200v running firmware versions 12.4.3-03526 and 12.5.0-02952 and older. SonicWall confirmed that neither the SMA 100 Series product line nor SSL-VPN functionality on SonicWall firewalls are affected.

Internet threat monitoring organization Shadowserver currently tracks more than 400 SMA1000 appliances with public-facing exposure. That figure does not separate out honeypots or already-patched devices, so the real pool of vulnerable targets could be smaller, though the number is still of importance.

SMA1000 gateways sit at the front door of corporate and government networks. Managed Service Providers, large enterprises, and government agencies rely on them to extend VPN access to internal applications for remote employees. That makes them a high-value target for nation-state actors and financially motivated cybercriminals alike.


A Pattern That Keeps Repeating

CVE-2026-102255 is the third time in 2026 alone that SonicWall has patched a CVSS 10.0 pre-authentication SSRF flaw in the WorkPlace interface that requires no login to exploit. The two that came before it were both turned into weapons before organizations could patch at scale.

In July, threat actors spent weeks exploiting two SMA1000 zero-days, CVE-2026-15409 and CVE-2026-15410, to plant custom malware families called Sou5, OrangeTail, and RootRun on compromised appliances. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) later tied several of those intrusions to ransomware operators.

In September, SonicWall confirmed attackers were chaining two fresh zero-days, CVE-2026-83548 and CVE-2026-83549, to achieve remote code execution on unpatched SMA1000 devices.

Zooming out further, CISA has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities catalog over the past four years. Thirteen of them have been flagged as actively used in ransomware attacks.

The October hotfix batch addressed three additional vulnerabilities beyond CVE-2026-102255. CVE-2026-102256, rated CVSS 7.8, is a post-authentication OS command injection flaw that could let an attacker with administrator credentials execute arbitrary commands on the appliance. CVE-2026-102257, rated 7.2, is a Zip Slip path traversal flaw in the Appliance Management Console that could allow file extraction outside the intended directory and potentially enable remote code execution. CVE-2026-102258, rated 5.5, is a stored cross-site scripting flaw in the same management console that could allow a logged-in administrator to inject and execute JavaScript.

SonicWall credited researcher Benoît Sevens with reporting CVE-2026-102255 and CVE-2026-102256, and Brian Mariani of DigitalCanion SA for the other two, one of which was submitted through Trend Micro's Zero Day Initiative.

SonicWall has urged all SMA1000 customers to apply the hotfixes immediately and has stated there are no alternative mitigations available for these vulnerabilities.





Read more »
Vulnerability Reports
AI cybersecurity Artificial Intelligence Cyber Attacks Linux Security Open-Source Security OpenSSF Software Supply Chain Security Software Vulnerabilities Vulnerability Management Vulnerability Reports

AI Adds to Open-Source Security Pressure as Vulnerability Reports Surge


AI Adds to Open-Source Security Pressure as Vulnerability Reports Surge A growing number of security vulnerabilities are being discovered using artificial intelligence, but the increased number is placing additional pressure on open-source developers. Despite the ability of AI tools to identify potential weaknesses within software at scale, security teams often find it difficult to verify the findings and rectify confirmed vulnerabilities before malicious hackers exploit them. 

The Chief Client Innovation Officer for Enterprise Security for IBM, Jamie Thomas, highlighted the sharp increase in vulnerability disclosures at the Linux Foundation Open Source Summit. In 2026, there are expected to be 66,000 unique vulnerability entries, representing a fourfold increase when compared with seven years ago. Cybercriminals are exploiting vulnerabilities at a faster rate, making the growing volume especially concerning. 

As reported by Thomas, exploiting a vulnerability has become less difficult due to the reduction in the time required to exploit it from days to 29 minutes. In some cases, attackers can exploit a vulnerability before a patch becomes available, leaving organizations with limited time to respond. Open-source software is particularly challenging due to the fact that a single vulnerable component can adversely affect thousands of applications and businesses. 

Most open-source projects are not staffed by large teams of developers or maintained by multiple individuals, which results in limited resources available for investigating and addressing security concerns. AI-Generated Reports Add to Developers’ Workload Although artificial intelligence-powered security tools are capable of identifying potential vulnerabilities, their findings are often inaccurate and actionable. 

Insufficiently researched reports, duplicate submissions, and false positives can consume valuable time for developers, which could otherwise be spent investigating genuine threats and preparing fixes. Major open-source projects have already been affected by this issue. The curl developers ended their HackerOne bug bounty program in 2026 following an increased number of low-quality and sometimes fabricated vulnerability reports, including reports generated with artificial intelligence tools. 

Similarly, Google temporarily suspended its Open Source Software Vulnerability Rewards Program on October 1, 2026, following an increase in invalid and irrelevant submissions. A reevaluation of the programme is planned for early 2027 by the company. 

Linux creator Linus Torvalds has also expressed concern over artificial intelligence-aided vulnerability reporting, particularly regarding the number of duplicate findings reaching Linux security mailing lists. Identifying flaws already fixed or disclosed can lead to additional work without necessarily improving security. 

IBM Proposes AI-Assisted Vulnerability Management Instead of treating artificial intelligence as a sole source of additional security findings, IBM's Jamie Thomas argued that it should be used as a resource to manage the increasing volume of vulnerability reports. Open source maintainers could use this approach to differentiate legitimate reports from duplicates and false alarms, assess severity, and focus attention on the most critical flaws. As a result of this cooperation among software companies, developers, and open-source communities, the Linux Foundation’s Open Source Security Foundation (OpenSSF) could play a crucial role. 

The use of artificial intelligence-based tools may provide developers with assistance in understanding vulnerable code and preparing patches, as well as assessing incoming reports, identifying vulnerabilities that are likely to be exploited, and recommending appropriate fixes. It is important to review automated remediation carefully, as a flawed fix can introduce new bugs or leave the original weakness unresolved. 

For validating vulnerability reports and proposed solutions, human expertise remains essential. It is important to note that the challenge extends beyond vulnerability management to the long-term sustainability of open-source projects as well. Technology companies rely heavily on open-source components, often without maintaining direct relationships with developers whose responsibility it is to secure those components. 

When critical flaws emerge, limited funding and engineering resources can delay investigation and patch development. An increase in open-source security investment could contribute to alleviating this imbalance. Those businesses that rely on widely used software are strongly committed to supporting the projects that underpin their products and services, whether through financial contributions, engineering assistance, or a closer collaboration with the maintainers. 

AI has the potential to accelerate vulnerability discovery, but that advantage will not be as valuable if developers are unable to keep up with the resulting workload. To transform AI-driven discoveries into significant improvements in security, it is essential to combine automated analysis with reliable human review, as well as to strengthen coordination and sustain support for open-source projects.
Read more »
Subscribe to: Posts (Atom)

Featured