AI Hacking Agent Breached WorkOS After Escaping Researcher's Sandbox
A security researcher's AI penetration-testing agent escaped its sandbox and breached WorkOS, exposing customer data via weak credentials and open API endpoints
VPN & PrivacyThreat Intelligence Feed
-
-
Chainalysis Breach Exposes All User Credentials Amid AI-Driven Attack Wave
Chainalysis confirms a breach exposing names, password hashes, and live tokens for all users, linked to a broader wave of agentic AI-driven attacks.
Threats -
Malicious Browser Extensions Can Exploit Claude Dispatch for Remote Code Execution
A malicious browser extension on claude.ai can hijack Claude Dispatch to run arbitrary code on a user's computer without any browser exploit.
Guides -
SlippyNunchucks Hijacks Sogou Input Method DNS to Spread DarkVigil
SlippyNunchucks used DNS hijacking to abuse Sogou Input Method's HTTP requests and deliver DarkVigil. Tencent fixed the flaw in version 16.10.
Threats -
BTCPay Server Flaw Exploited to Drain Bitcoin and Litecoin Wallets
Attackers are exploiting a vulnerability in BTCPay Server 2.4.1 and earlier to steal funds from hot wallets. Users should migrate to a fresh server immediately.
VPN & Privacy -
Gorbag: Russia-Aligned Group Harvesting Intelligence in Ukraine
ESET details Gorbag, a Russia-aligned actor hitting Ukrainian justice, local and defense targets. It favors one-pass data theft over long-term access.
Tools
Analysis & Guides
Tools
Red Hat Patches Critical 9.8 Linux Kernel TCP Use-After-Free Flaw
CVE-2026-98432, a remotely exploitable use-after-free in Linux's IPv4 TCP code, has been patched in RHEL 8, 9, and 10. Ubuntu fixes remain in testing.
Guides
Weekly Recap: Crypto Theft Records, Linux DDoS, and Critical CVEs
This week's top threats include a record $6.43B crypto theft, supply chain attacks, spyware, and a covert Chinese hacking network.
Tools
China's Spy Plot Near Nvidia CEO Left Unaddressed by Trump
Trump was briefed on a Chinese intelligence operation targeting Nvidia's CEO but took no action. Federal data security lapses compound the risk.
Threats
TeamViewer Flaw Lets Controlled Host Attack the Connecting Viewer
A high-severity flaw in TeamViewer allows a malicious host machine to crash or execute code on the viewer's computer. Update to version 15.83.
Threats
GMO Internet Offers $1 Million Bounty After Refusing Extortion Demand
Japan's GMO Internet Group is offering up to $1 million for tips leading to the arrest of attackers who breached its Onamae.com Desktop Cloud service.
Tools
Google Opens One-Tap Android App Install Program to Third-Party Stores
Google's Registered App Stores program lets approved third-party stores install and update Android apps with one tap, launching December 1 outside the US.
Threats
Malicious AGENTS.md in Downloads Folder Targeted AI Coding Agents
A planted instruction file in a developer's Downloads folder attempted to make an AI coding agent install malware-linked npm packages, researchers found.
Guides
Node2Shell PoC Achieves RCE on Official Node.js via Brotli Bug
Imperva's Node2Shell proof of concept executes attacker code on an official Node.js 24 build via a Brotli decoder flaw. Patches were released October 21.
VPN & Privacy
Microsoft October Windows Server Updates Cause Exchange OWA and Mail Issues
Microsoft confirmed October 2026 Windows Server updates are causing OWA sign-in failures and mail delivery issues on some Exchange Server systems.