vulnerability

Apple's Bug Bounty Program Is Drowning in so Much AI Slop, It Is in Danger of Missing Serious Exploits

, , ,

Apple has imposed strict limits and a 30-day cool-off period on its bug bounty submissions after being overwhelmed by low-quality, AI-generated vulnerability reports that often describe non-existent flaws. This surge in automated, plausible-sounding but false reports risks causing serious exploits, like a critical macOS zero-day, to be delayed or missed. Apple and other companies are now balancing the challenge of filtering AI slop from genuine security findings to protect their software effectively.

https://www.bitdefender.com/en-us/blog/hotforsecurity/apple-bug-bounty-ai-missing-exploits

AI Notetaker Exposes Government, Corporate Video Calls

, , ,

A vulnerability in the AI meeting assistant tl;dv, caused by a misconfigured Google Firebase backend, allows any user to access other users' meeting metadata and potentially join live government and corporate video calls. Security researcher BobDaHacker found that missing isolation in the app's “meetings” data exposed records from over 80,000 users, including sensitive calls from multiple countries and large organizations, with some meetings left publicly accessible. The incident highlights security risks in AI notetakers, which have deep access to communications and often lack sufficient scrutiny or proper privacy configurations.

https://www.darkreading.com/application-security/ai-notetaker-spy-government-corporate-video-calls

Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw

,

Researchers from Nanyang Technological University disclosed 84 security vulnerabilities in 4G and 5G core networks, including flaws enabling denial-of-service attacks and session hijacking. These issues stem from implicit trust between core network components and affect widely used open-source LTE/5G implementations, exposing risks in cloud-native deployments where interfaces may be accessible to attackers. The study demonstrated how adversaries could exploit these flaws to hijack user sessions by injecting malicious protocol messages, leading to traffic interception, manipulation, or selective service disruption.

https://thehackernews.com/2026/07/researchers-report-84-flaws-in-4g-and.html

Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents

, ,

Microsoft Copilot for Word can be exploited to copy hidden instructions from a malicious document into new files. The vulnerability allows Copilot to mistake hidden instructions for user requests, potentially leading to data manipulation. While Microsoft has deployed mitigations, the attack remains exploitable, and user vigilance is recommended when handling external documents.

https://thehackernews.com/2026/07/microsoft-copilot-for-word-can-copy.html

Agentic Browsers Rewind Web Security by 20 Years

, , ,

Security researchers have uncovered a new class of vulnerabilities called “PleaseFix” in agentic browsers—tools that autonomously perform web tasks—which compromise fundamental browser security mechanisms like cross-origin restrictions. These flaws allow attackers to socially engineer zero-click attacks, resulting in account takeovers, browser escapes, and remote code execution. The findings highlight that recent agentic browsers have effectively reversed two decades of web security advances, exposing users and systems to significant risks.

https://www.darkreading.com/endpoint-security/agentic-browsers-rewind-web-security-20-years

New Certighost PoC Exploit Lets Attackers Hijack Windows Domains

, ,

A proof-of-concept exploit for the Certighost vulnerability (CVE-2026-54121) in Windows Active Directory Certificate Services allows authenticated attackers to impersonate domain controllers and gain domain-level privileges. The flaw exploited a fallback mechanism in certificate enrollment requests, permitting attackers to obtain unauthorized certificates and perform privileged Active Directory operations, including DCSync attacks. Microsoft addressed the issue in the July 2026 Patch Tuesday updates by validating domain controller identities during certificate requests, and administrators are urged to apply these patches promptly.

https://www.bleepingcomputer.com/news/security/new-certighost-poc-exploit-lets-attackers-hijack-windows-domains/

Hackers Compromise Hotel Wi-Fi Gateways to Hijack Microsoft 365 Accounts

, , , , ,

Hackers have compromised hotel Wi-Fi gateways to redirect employees connecting to the network to fake Microsoft 365 login pages, enabling them to steal credentials and authorization tokens without phishing emails or malware. The attack, identified by ReliaQuest since June 2026 across multiple countries, involves DNS manipulation and may exploit weak administrator passwords on gateway devices. Using an always-on VPN that routes traffic through a company network can prevent these redirects, while employees should reject unexpected Microsoft login prompts on public Wi-Fi.

https://hackread.com/hackers-hotel-wi-fi-gateways-hijack-microsoft-365-accounts/

Hacked Public Wi-Fi Gateways Used to Harvest Corporate Credentials

, , , , ,

A threat actor has been compromising public Wi-Fi gateway appliances at venues like hotels and conference centers across the US, India, and Saudi Arabia to hijack DNS settings and redirect users to attacker-controlled sites, harvesting Microsoft 365 credentials of traveling corporate employees. This ongoing campaign since June 2026 resembles tactics used by the Russian-linked APT28 group but shows differences in infrastructure and targeting, suggesting a possible reuse of known tradecraft by a different actor. Organizations providing captive portal Wi-Fi services face heightened risks as attackers employ adversary-in-the-middle techniques to intercept sensitive information from multiple industries.

https://www.securityweek.com/hacked-public-wi-fi-gateways-used-to-harvest-corporate-credentials/

ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents Via a Phishing Link

, ,

Cybersecurity researchers discovered a critical cross-site request forgery vulnerability, dubbed AgentForger, in OpenAI’s ChatGPT Workspace Agents that allowed attackers to deploy rogue autonomous AI agents within an organization via a phishing link. By exploiting URL parameters, the flaw enabled an attacker to create and activate an AI agent with employee-level access and disabled approval prompts, granting persistent access to sensitive workspace data and allowing the agent to impersonate users and send phishing messages. OpenAI patched the vulnerability on June 8, 2026, after responsible disclosure.

https://thehackernews.com/2026/07/chatgpt-agentforger-flaw-could-deploy.html

New RefluXFS Linux Flaw Lets Attackers Gain Root Privileges

,

A nine-year-old race condition vulnerability named RefluXFS (CVE-2026-64600) in the Linux kernel's XFS filesystem allows local attackers to overwrite protected files and gain root privileges, affecting systems with reflink enabled on kernel versions 4.11 and later. The flaw bypasses standard security defenses and leaves persistent, undetectable on-disk changes, prompting urgent patching by vendors and users, with no current reliable mitigations besides immediate kernel updates and reboots.

https://www.bleepingcomputer.com/news/linux/new-refluxfs-linux-flaw-lets-attackers-gain-root-privileges/

N-day Is Becoming N-Hour. Patching Faster Won’t Save You.

, ,

Anthropic's AI model Claude Mythos can now transform security patches into working exploits within an hour, drastically shortening the traditional weeks-long reverse-engineering timeframe and shrinking the window for defenders to respond. This accelerates the “N-day” exploitation race to an “N-hour” reality, rendering faster patching insufficient because patches themselves reveal vulnerabilities to attackers immediately upon release. Organizations must shift to continuous exploitability validation against active controls rather than relying solely on patch speed, using methods like autonomous penetration testing, attacker behavior simulation, and live control effectiveness monitoring to prioritize and prove actual risk exposure in real time.

https://thehackernews.com/2026/07/n-day-is-becoming-n-hour-patching.html

Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

,

A critical heap buffer overflow vulnerability (CVE-2026-42533) in NGINX's script engine can be triggered remotely by crafted HTTP requests under a specific regex-based map configuration, causing worker process crashes and potential remote code execution if ASLR protections are bypassed. F5 released patches in nginx versions 1.30.4, 1.31.3, and NGINX Plus 37.0.3.1; users are urged to upgrade promptly, as mitigations like switching to named captures are partial and not a complete fix. This flaw affects many NGINX products and extends back over a decade, with exploitation risk increasing once public proof-of-concept code is released.

https://thehackernews.com/2026/07/critical-nginx-vulnerability-can-crash.html

New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands

, ,

Researchers have identified a new class of AI attack called agent data injection (ADI), where attackers manipulate the trusted data fields—such as sender names or button IDs—that AI agents rely on, causing them to misclick or execute malicious commands without altering the agent’s task instructions. This probabilistic delimiter injection exploits AI models' probabilistic parsing of punctuation to fake trusted data, bypassing typical prompt-injection defenses and affecting various AI tools including web agents and coding assistants. While some mitigations like randomizing element IDs can reduce the attack’s success, the vulnerability remains significant as AI agents continue to blend trusted and untrusted data without clear separation.

https://thehackernews.com/2026/07/new-agent-data-injection-attack-can.html

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

, ,

Security researcher Chaotic Eclipse released a new proof-of-concept exploit called LegacyHive, which leverages a Windows User Profile Service vulnerability to achieve arbitrary hive load elevation of privileges. The exploit works on all supported Windows versions, including those patched in the latest July 2026 update, and allows non-admin users to modify registry hives of other accounts, posing a significant privilege escalation risk. Microsoft is investigating the vulnerability and committed to addressing it, while the incident highlights ongoing challenges in coordinated vulnerability disclosure and security patching.

https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html

Scroll to Top