A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories On July 25, 2026, we chained two critical vulnerabilities to compromise multiple OpenAI employees’ ChatGPT accounts. With these accounts, we could then access internal OpenAI repositories, and potentially many other connectors.
Source: hacktron.ai
While large language models present real risks to society, experts say they can be tested and largely controlled using well-worn cybersecurity and policy choices. By Derek B. Johnson September 17, 2026 Listen to this article 0:00 Learn more. This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. In recent conversations, cybersecurity and national security professionals raised questions about both the technical solutions OpenAI and Anthropic use to contain their models, as well as the glaring absence of federal oversight from federal regulators or truly independent third-party review. (Image via Getty)
New KREMLIN Malware Bypasses Chrome and Edge Integrity Checks to Silently Install Malicious Extensions. Security researchers have uncovered a banking malware operation, tracked under the toolkit name “KREMLIN,” that is able to force malicious extensions into the Chrome and Edge browsers without any action or approval from the user.
Source: pbxscience.com
While people around the U.S. are tearing down Flock cameras, one group of hackers went a step further: extracting the camera’s software too. Hackers ripped down a Flock camera above a roadway, made a near-complete copy of the data stored inside it, and shared the files with 404 Media and WIRED, revealing in new detail how exactly Flock Safety’s cameras track the movements of both vehicles and people. The hackers say they are also publishing details on how they managed to obtain the software, in the hopes that other people may copy them.
DeepSeek’s 11/11 result showed why advanced agent benchmarks need to check both the outcome and the attack path: our audit confirmed six planned exploits and found five unexpected routes. Across the full benchmark, the model used 2,349 Bash commands and almost two hours and 38 minutes of active model time. The median successful run took four minutes and 38 seconds. The provider reported 268.3 million input tokens and about two million output tokens.
In the mid-2010s, Chinese cyber espionage actors stole complementary data from a variety of sources that, together, would be useful for analyzing the U.S. intelligence apparatus. Various Chinese APT groups stole information from the health insurance company Anthem, credit reporting company Equifax, Marriott hotels, United Airlines, and, perhaps most significantly, security clearance information from the Office of Personnel Management.
Source: lawfaremedia.org
ConnectWise has released urgent patches for a critical-severity vulnerability in the ScreenConnect remote access and support software that has been exploited in worm-like attacks. Tracked as CVE-2026-84869 (CVSS score of 9.9/10), the security defect is described as a missing authorization and improper privilege management issue. The bug creates “a condition in the ScreenConnect client that may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances,” ConnectWise explains in its advisory.
Businesses received a staggering amount of cyberattacks in June, according to Check Point, showing a rise of 20% over the previous 12 months. The breakout of AI agents from OpenAI in July to hack into the Hugging Face website, and subsequent similar events from Anthropic and Meta, indicate agentic-powered attacks will explode over the coming year. Currently, malicious hackers have the advantage because publicly released frontier models from the US incorporate guardrails that can’t distinguish between malicious or defensive activities. As a consequence, these models default to a refusal to get involved. Hugging Face discovered this the hard way when they attempted to utilize a model to defend against the OpenAI intrusion. Their solution was to adapt a Chinese open weight model to analyze the 17,000 attack logs, find the vulnerability, and contain the intrusion. With incidents like these happening more often, an arms race has begun with AI being both the problem and the solution.
The Defense Innovation Unit (DIU), a development unit of the US Department of Defense, has tested a quantum sensor-based flight navigation system over the Pacific as part of the MagNav program. The DIU announced on Friday. This allows the position to be determined precisely without relying on GPS; for example, if it is jammed by the enemy in military conflicts, the GPS signal fails or cannot be received. The MagNav system, developed by Honeywell Aerospace, uses quantum sensors. These sensors detect changes in the Earth’s natural magnetic field and create a magnetic field map from the measurements. Based on this map, the system can determine the position in aircraft entirely independently of GPS signals, weather, and visibility conditions.
Anyone who owns an LG smart TV must inform all guests and family members that they are being monitored – this is required by LG’s current terms of use. Meanwhile, LG monitors install potential malware and surveillance software on a connected Windows computer.
Source: notebookcheck.net