AI & software security
-
Starland RAT hides inside familiar software
A Russian-speaking criminal operation is disguising malware as familiar administration, database, conferencing, and gaming software, with potential exposure identified in Germany and Romania.
-
Gemini CLI ran a live botnet migration
Trend Micro says a Russian-speaking operator used Gemini CLI to migrate, debug, and control a small botnet through natural-language instructions rather than direct technical commands.
-
Claude deep links exposed prompt controls
A crafted link could open Claude Desktop and submit hidden attacker instructions automatically, exposing the boundary between browsers, AI agents, and locally authorised tools.
-
A repository can trigger code in Cursor
Mindgard says Cursor automatically runs a malicious Git binary placed inside an opened Windows repository, without displaying a warning or requiring further user action.
-
Old UEFI signatures reopen Secure Boot
Eleven old but validly signed bootloaders could be introduced onto modern systems to bypass Secure Boot, extending software supply chain risk beneath the operating system.
-
AsyncAPI release breach poisons npm packages
Attackers compromised AsyncAPI release processes and published malicious npm packages capable of installing a persistent remote shell on developer workstations and build systems.
-
AI enters the live intrusion chain
Check Point research documents AI performing operational work during live intrusions, while enterprise telemetry shows rising prompt injection and sensitive-data exposure through routine AI use.
-
Adobe warns ColdFusion flaw is exploited
Adobe says CVE-2026-48282 has been exploited in limited attacks against ColdFusion, with updates available for ColdFusion 2025 and 2023.
-
SAP fixes critical NetWeaver and Commerce flaws
SAP’s July Security Patch Day includes critical issues in NetWeaver Application Server ABAP, SAP Approuter, SAP Commerce Cloud, and NetWeaver Application Server Java.
-
Microsoft patches exploited AD FS and SharePoint flaws
Microsoft’s July security update includes exploited vulnerabilities affecting Active Directory Federation Services and SharePoint Server.