EPIC FAILS in Application Development Security practice processes, training, implementation, and incident response
CISA orders feds to patch actively exploited Ivanti flaw in 3 days
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch an actively exploited Ivanti Sentry flaw within three days, as mandated by the newly issued Binding Operational Directive (BOD) 26-04.
CVE-2026-10520, this maximum-severity vulnerability was found in Ivanti's security gateway appliance (formerly known as MobileIron Sentry) and stems from an OS command injection weakness.
One day after Ivanti released patches for CVE-2026-10520 and said that it had no evidence of in-the-wild exploitation, the Shadowserver Internet security watchdog reported that attackers had already backdoored many of the Sentry gateways exposed online.
US Gov asks Anthropic to ban 'foreign national' access to Fable, Mythos
Anthropic has suspended access to its two most capable AI models, Fable 5 and Mythos 5, for all users worldwide after the US government issued an export control directive ordering the company to block access by any foreign national.
The directive, which Anthropic says it received at 5:21pm ET on June 12, cites "national security" authorities and bars access to both models by foreign nationals inside or outside the United States, including Anthropic's own foreign-national employees.
The order's net effect, the company says, is that it must disable both models for all customers to comply. All other Anthropic models, including Claude Opus 4.8, are unaffected.
[rG: Impact this will have on AI fueled vulnerability discovery and attacks? Zero because there are competitive alternatives.]
Fable5: Anthropic releases its first Mythos-class model to the public
Anthropic initially deemed Mythos-class models too dangerous to release owing to their increased ability to find cybersecurity weaknesses. It also comes just over a week after the company confidentially filed for IPO paperwork.
Fable 5 and Mythos 5 are being offered at $10 per million input tokens and $50 per million output tokens—twice the price of the standard version of the next most advanced model, Opus 4.8.
Maine disables data breach notification portal after fake disclosures
Maine has taken its public data breach reporting portal offline after fraudulent breach disclosures were published on the state's website, prompting a review of procedures to prevent abuse in the future.
Fake data breach disclosures had been submitted to Maine's official breach notification portal impersonating Discord and the multiplayer social virtual reality platform VRChat. VRChat says filing was fraudulent and had been submitted using the name of a fictitious employee.
The Meta hack shows there’s more to AI security than Mythos
On June 5, 404 Media reported that attackers had been using Meta’s AI customer support agent to steal Instagram accounts. Their approach was simple: They asked the agent to link the accounts to email addresses that they controlled, and the agent complied. One attacker broke into the dormant Obama White House account and made pro-Iran posts; others took over accounts with valuable, single-word handles, possibly in order to sell them.
AI was the target rather than the attacker, and the method was far simpler than anything Mythos would cook up. But as companies offload more work to AI, these comparatively unsophisticated attacks could wreak their own havoc.
Scholars have been issuing warnings about the security vulnerabilities of AI agents for a while. They publish papers and blog posts detailing exploits such as indirect prompt injection, which involves hijacking agents using commands hidden in websites, emails, or other seemingly anodyne data sources. Compared with these techniques, the Meta hack was practically mindless. The only complication that hackers had to overcome was using a VPN that matched the true account owner’s location; then they directly asked the support agent to change the account’s email address, and it complied.
There are ways to mitigate the risks. Companies can use traditional software to build guardrails that make sure agents follow strict rules, such as always asking for answers to security questions before sending sensitive account information to a new email address. And the experts consulted for this article all agree that agents should undergo rigorous red-teaming, a process in which developers try their best to attack a system in order to discover its vulnerabilities before it is deployed.
Everybody wants to be the first to do something and just push things out without careful scrutiny and red-teaming
[rG Pay now or more later: In all the AI hype land-grab rush, fundamental SDLC QA Integration and Regression Testing for AI functionality and security has been abandoned, resulting more expensive business disruptions and customer damage.]
ShinyHunters hacked 100+ orgs by exploiting an Oracle PeopleSoft 0-day
The cybercrime crew exploited CVE-2026-35273 to break into the University of Nottingham’s PeopleSoft system and steal 40 GB of personal data and billing records.
ShinyHunters posted the stolen files later that same day, presumably because the school refused to pay the extortion demand.
Google said it spotted malicious activity, “consistent with the exploitation of CVE-2026-35273,” between May 27 and June 9, and notified more than 100 global orgs “whose IP addresses correlated with potentially vulnerable endpoints."
Most of these are based in the US and 68% are in the higher-education sector.
For the 2nd time in weeks, Microsoft packages laced with credential stealer
73 packages run self-replicating stealer as soon as they’re opened by an AI agent. Rather than noting they are malicious—and that developers who used AI agents to work with them should assume their systems are compromised.
The Microsoft GitHub account compromised in the May attack is the same one used late last week. The explanation for this double compromise isn’t currently known. It may mean that Microsoft failed to fully change credentials for the account. It might also be the result of an unknown package run on a Microsoft developer machine that stole the new credentials. Microsoft isn’t providing details at the moment.
Record-Breaking Microsoft Patch Tuesday for June 2026
AI is making Patch Tuesday (kinda) fun again
We have no idea how many of these June bugs were uncovered using AI tools. Unlike last month’s patching event, when Redmond disclosed its agentic bug-hunting system found 16 of the 137 vulnerabilities.
It is extraordinary that Microsoft can produce so many patches in a single month, but it does raise concerns. How many were found via AI? And: How many patches were generated using AI to assist in coding or testing? What quality issues may exist in these patches? And likely most importantly, is this the new normal?
Should sysadmins adjust their processes for prioritization and patch deployment based on this new volume of updates? Unfortunately, Microsoft is not providing those answers right now.
[rG: It must be kept in mind that vulnerabilities and patches are fundamentally an indication of sloppy coding and failed QA, and that exposed vulnerabilities are preventable through conscientious application of known software development and coding security best practices.
Organizations need to begin financially penalizing developers, and their management, for releasing preventable poor quality production releases.
AI’s ability to efficiently find quality misses is just shining new light on an endemic problem that has been increasing over the past couple decades as orgs cannibalized QA to fund cloud migrations. Remote hosting wasn’t the issue, but the practice of relying on production A/B testing, using end-users as guineapigs, as a replacement to pre-prod testing.
The problem is that it is 100x more expensive to fix production bugs/vulnerabilities than simply preventing them in the first place.
Organizations wanting to limit operational disruptions caused by vendor solution compromises need to track vulnerability and update histories to determine which are the most trustworthy.
Market disrupters don’t need to be significantly more innovative, but just suck less.]
Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication
The PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.
An attacker could weaponize this weakness to define a new function that uses lo_export - a function used to extract a BLOB from the database and save it as a file on the file system - to write attacker-controlled content to a file, following which the function gets executed during the restoration process.
High-severity vulnerability in Linux caused by a single faulty character
The presence of a single mis-issued exclamation point in code implementing nf_tables introduced a use-after-free, a class of vulnerability that corrupts memory by placing malicious code at memory addresses that haven’t been properly freed of their previous contents. nf_tables is a subsystem of the Linux kernel that provides packet filtering capabilities. It’s used to manage firewall rules and replaces older subsystems such as iptables, ip6tables, arptables, and ebtables.
CVE-2026-53111 is one of at least three potent elevation-of-privilege vulnerabilities to hit Linux in recent weeks. The vulnerabilities are serious, because, when chained to a separate exploit, they can be used to evade security defenses baked into the OS.
Vibe Citing: PMG's AI report becomes an accidental demo of AI hallucinations
Consulting firms have spent years warning clients about AI hallucinations. KPMG has provided a live demonstration
Only 5 of the report's 45 citations matched their sources, raising questions about how the study was assembled. The rest ranged from mangled and misleading to partially fabricated or too vague to verify.
Last year, Deloitte ended up refunding the Australian government after AI-generated content slipped into a taxpayer-funded report.
HACKING
Securing CI/CD in an agentic world: Claude Code Github action case
While Claude Code Action supported environment scrubbing for subprocess execution paths such as Bash, the Read tool was not subject to the same sandboxing model. It was eventually authorized to access /proc/self/environ, reading the workflow’s ANTHROPIC_API_KEY and potentially other credentials available to the runner.
We began this research after observing prompt injection attempts in public repositories using AI-assisted GitHub workflows across multiple vendors, where attacker-controlled issue or PR content is processed by the AI agent and could influence its tool use.
The ‘Miasma’ worm source code briefly leaked on GitHub
The malware has previously been linked to high-profile attacks against Red Hat npm packages and, more recently, 73 Microsoft repositories on GitHub. The framework harvests credentials from cloud providers, CI/CD systems, password managers, Kubernetes, and secret stores, and abuses them to compromise npm, PyPI, and RubyGems packages, as well as GitHub repositories, Actions workflows, and JFrog Artifactory instances. It can also move laterally through SSH and AWS Systems Manager (SSM), and poison configurations of AI coding tools such as Claude, Gemini, Cursor, Copilot, Kiro, and Cline.
APPSEC, DEVSECOPS, DEV
NIST Mathematical Proof Supports Transition to a Continuous-Monitor-and-Update Security Model for AI Systems
The finding applies the logic of Kurt Gödel’s incompleteness theorems to artificial intelligence systems. NIST says the proof helps explain why organizations developing or deploying AI need to move away from a fixed “one and done” security model.
Organizations using AI need continuous red-teaming, updates, and resilience planning rather than fixed safeguards.
GitHub announces npm security changes to tackle supply-chain attacks
The main theme of the announcement is that code execution and non-registry dependency sources that currently trigger automatically during npm install will now require explicit approval instead of being trusted by default. Starting in version 12:
1. npm install will not run preinstall, install, or postinstall scripts from dependencies unless they have been explicitly approved. This also applies to native module builds triggered through node-gyp, and prepare scripts from Git, local file, and linked dependencies.
2. npm install will no longer fetch dependencies from Git repositories, whether direct or transitive, unless explicitly permitted. GitHub says this removes a code execution path where a Git dependency's .npmrc file could alter which Git executable is used, even when install scripts are disabled.
3. Dependencies installed from remote URLs, such as HTTPS tarballs, will no longer be resolved unless explicitly permitted. This applies to both direct and transitive dependencies.
VENDORS & PLATFORMS
VibeOS - Fully Hallucinated Operating System: YouTube
[rG: Don’t skip the comments J]
Apple Goes Agentic: Welcome To The New Siri
Nearly all of this is agentic with a human in the loop, not autonomous.
· Passwords auto-upgrade: Siri navigates websites, signs in, and changes weak/compromised passwords for you.
· Safari Notify Me: you ask it to watch a page; it monitors over time and alerts you to restocks, price drops, etc.
· Describe a Shortcut: you describe a goal, Siri assembles the workflow steps on your behalf.
· Triggered Shortcuts automations: event-driven actions like setting tomorrow's alarm from your calendar, or porch lights on when food delivery arrives.
· Siri app actions: take action across apps: draft an email, edit and share a photo set, add a recipe to Notes.
· Siri mode in Camera: point and act: split a bill via Apple Cash, add calendar events from a poster.
· Mail suggestions: can take action with third-party apps.
· Describe an Extension: generates a working Safari extension from a sentence.
· Calendar describe-an-event: creates/modifies events from a natural-language description (IDs contacts, locations, title).
· Write with Siri: generates a draft from scratch and revises on command.
· Image Playground: modifies images from a described edit.
GitHub Security validation for third-party coding agents
Security validation for third-party coding agents is now generally available. GitHub supports third-party coding agents (including Claude and OpenAI Codex) that work directly within your repositories to implement features, fix bugs, and improve test coverage. Now, code generated by these agents receives the same automatic security validation already available for GitHub Copilot cloud agent.
Microsoft Defender: Securing code, agents, and models across the development lifecycle
The new Microsoft Security multi-model agentic scanning harness (codename MDASH) is available in an expanded preview for eligible organizations and now includes integration with Microsoft Defender. This new agentic security system orchestrates a pipeline of more than 100 specialized AI agents using an ensemble of models to discover, validate, and prove exploitability across codebases written in popular programming languages.
While codename MDASH identifies and validates what’s truly exploitable, the integration between Microsoft Defender and GitHub Code Security (part of the former GitHub Advanced Security suite), now generally available, brings runtime context into development and security workflows.
RAMPART: Inside Microsoft’s latest open-source AI vulnerability tooling
An open-source tool that red teams and other cybersecurity pros can use to test AI agents’ vulnerabilities.
Google announces Gemini 3.5 Live Translate for instant voice-to-voice translation
Voice translations preserve speaker’s tone, pacing, pitch—with SynthID watermarks for security.
Google DeepMind releases DiffusionGemma, a model that runs local AI 4x faster
Google says this makes it faster and more efficient when running on local hardware like an Nvidia DGX or a humble gaming GPU.
LEGAL & REGULATORY
Nobody needs AI to search the Internet, German court says in ruling against Google
The preliminary ruling came in a case flagged by The Decoder, where two publishers found that Google’s AI Overviews incorrectly linked them to scams and other sketchy business practices. After smearing publishers by making affirmative statements like “Yes, it is known for dubious business practices and is often perceived as a scam,” Google failed to correct the misleading output, even after the publishers sent a cease-and-desist letter earlier this year.
In the past, AI firms have hoped that disclaimers warning about misinformation would protect them from lawsuits over untrustworthy outputs. Should other courts agree that tech firms are liable for any defamatory outputs emerging from this experimental period of AI search chaos, the biggest AI leaders could find themselves soon buried in lawsuits.
Chinese cybercrime operation that used AI to scam ‘hundreds of thousands of victims’ sued by Google
Google announced a lawsuit against an alleged Chinese cybercrime network called Outsider Enterprise, which uses AI in its campaigns to send scam text messages impersonating Google and other brands to steal passwords and credit card numbers. The group deployed 9,000 fake websites, one million fraudulent web domains, and 2.5 million texts sent to Android users in a two-week period.
ACLU Sues After Facial Recognition Falsely Identifies Florida Man as a Child Abductor
Police arrested a man in Florida for attempted child abduction in a town he had never visited, and the only evidence linking him to the crime was an AI facial recognition hit. Facial recognition software concluded with 93% confidence that the suspect was Robert Dillon.
The responding officer viewed security camera footage of the suspect but didn't take a copy; instead, he took pictures of the screen with his cell phone. In the photos, the suspect image is low resolution, and the suspect's face is partially shadowed and off-axis. When an investigator queried the facial recognition system, it was with the officer's grainy secondhand cell phone photos.
But there were other leads that police could have followed. For example, when he approached the girl, the suspect was picking up food that had been ordered ahead; this implies he had an online account, with contact information and a form of payment attached.
EU's Tech Sovereignty Package Includes 9+ Pages on Open Source, Says Open Source Initiative
The Commission has responded by committing to ensure Open Source companies are considered for funding under the European Competitiveness Fund (ECF). It also plans to create "Open Source business accelerators" that will offer mentorship, training, legal and licensing consulting, and business development support, including marketing. Additionally, the Commission will work to raise industry awareness of Open Source solutions by leveraging the EU's existing business support networks.
And Now For Something Completely Different …
Why the years seem to speed up as we age, and how focusing on one thing might make time feel slower again
It’s not just about year being a smaller fraction of the whole than the one before it: It’s about familiarity. And familiarity has a couple of levers.
