EPIC FAILS in Application Development Security practice processes, training, implementation, and incident response
AI Healthtech firm Xolis suffers data breach impacting 1.4 million people
Xsolis is a U.S.-based healthcare firm that develops AI-powered software used by more than 600 hospitals and health insurers for utilization management, medical necessity reviews, patient status determinations, discharge planning, and reimbursement decisions.
On January 22, 2026, Xsolis became aware of unauthorized activity impacting a limited portion of the Xsolis environment resulting from a targeted phishing attack on January 20, 2026. “We immediately contained the activity and launched an investigation with the assistance of external cybersecurity experts.”
The investigation found that the attackers had accessed certain files within the Xsolis environment containing customer information, including: Names, Addresses, Dates of birth, Health insurance information, Social Security numbers, Medical treatment information.
Security shops among the 'hundreds' of Klue hack victims
The list of Klue customers whose Salesforce data was stolen in the latest supply-chain heist keeps growing.
Several security and software vendors Huntress, Recorded Future, Tanium, Jamf, Gong, HackerOne, Kudelski Security, Snyk, Insurity, and Sprout Social have revealed that the data thieves also accessed their CRM (customer relationship management) data via the Klue integration with Salesforce.
Klue has since disconnected all of its integrations with Salesforce, Gong, HubSpot, SharePoint, and Google Drive. It also hired CrowdStrike to assist in the investigation and security response.
Defesa Civil Nacional confirmed that its dispatch platform, often used to inform the public about severe weather events, was taken offline in the early hours of Saturday, June 20, after Brazilians reported the alert, which read: "Alerta extremo - Defesa Civil:misantropi4." "Misantropia" is Portuguese for misanthropy, hatred of humankind.
Meta pauses an AI training program that tracks employees' keystrokes after an internal leak
Meta has paused a controversial employee‑tracking program after an internal security review found that highly granular keystroke and screen‑capture data from staff laptops was far more widely accessible inside the company than intended.
The program was part of Meta’s Model Capability Initiative (MCI), which collected mouse movements, click locations, keystrokes, and screen content from employees’ work laptops to help train internal AI systems.
Collecting highly sensitive employee activity data is one thing. Keeping it properly secured is another.
29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests
CVE-2026-47729: A heap over-read in the Squid web proxy can leak another user's cleartext HTTP request, including any credentials or session tokens it carries, to anyone already allowed to send traffic through the same proxy.
The bug traces to a 1997 FTP-parsing change and is still live in Squid's default configuration.
Following user outcry, AMD reinstates memory encryption in consumer CPUs
Last week, AMD stripped the protection, known as TSME, from consumer Ryzen processors. Short for Transparent Secure Memory Encryption, TSME encrypts the entire contents stored in memory, making the data useless to adversaries performing cold boot attacks and similar intrusions requiring physical access.
Critics called on AMD to reverse the move, and now AMD says it plans to do just that in a firmware update scheduled for release next month.
Amazon Q flaw let booby-trapped Git repos execute code, swipe cloud creds
MCP lets AI assistants launch local processes to carry out tasks. In Amazon Q's case, those processes inherited the developer's environment, giving them access to AWS credentials, API keys, authentication tokens, SSH agent sockets, and other secrets already loaded into the session.
A high-severity flaw in Amazon's AI coding assistant for Visual Studio Code meant that opening the wrong Git repository could allow an attacker to execute code on a developer's machine and potentially hand them the keys to the dev's cloud environment.
The extension would automatically load a repository's .amazonq/mcp.json file and execute the commands it contained when a developer opened the project and activated Amazon Q.
The bug is less an Amazon problem than an industry one. More and more AI coding assistants are adopting MCP to connect models to local tools and services, allowing them to execute commands on developers' machines.
Similar workspace configuration flaws have recently surfaced in other AI coding tools. It suggests attackers have found a new place to lurk: the hidden files that developers rarely think twice about trusting.
HACKING
Hackers Compromised 10,000+ GitHub Repositories to Inject Malicious Script
Ahe researcher noticed a cloned version of their own repository appearing in search engine results. While the project name, description, and commit history appeared identical, a newly added commit introduced a malicious link in the README file pointing to a downloadable ZIP archive.
Similar behavior was later observed across multiple repositories with different names and contributors, with no direct fork relationships, suggesting a coordinated campaign rather than isolated incidents.
For developers, the incident underscores the importance of verifying external downloads, even when sourced from seemingly legitimate repositories.
[rG: Always use enterprise centrally administrated binary repository management to ensure trusted dependencies with vulnerability detection (SCA) alerting.]
Miasma campaign poisons 20-plus npm packages, hunts for developer secrets
The attack targets Leo Platform and RStreams packages, harvesting creds and going after more maintainers. The malware also tries to republish any packages the victim is allowed to maintain, sidestepping npm's two-factor authentication and giving itself another route to spread.
What the Miasma campaign reveals about the new supply chain threat model and the underground market for developer credentials
Attackers backdoored ShapedPlugin Pro updates, deploying malware that steals credentials, 2FA secrets, and grants full site access
ShapedPlugin is a WordPress software company that develops premium and free plugins for WordPress and WooCommerce websites. Attackers compromised the vendor’s build and distribution pipeline, injecting backdoor code into Pro plugin releases distributed through official licensed update channels.
A loader file called LicenseLoader.php downloads a payload from an attacker-controlled server, installs it as a fake plugin, reports the victim domain back to the attacker, and then deletes itself.
The dropped payload disguises itself as WooCommerce-related plugins, using names like “woocommerce-subscription” in the singular form, one letter away from the legitimate plugin name.
The payload, once installed, hides itself from the WordPress admin plugin list, registers a REST API backdoor that accepts arbitrary file writes, bundles Tiny File Manager and Adminer for direct GUI access to files and databases, and installs a webshell that accepts commands via URL parameters. There’s also a hardcoded login bypass: a single MD5 hash lets the attacker authenticate as any administrator without knowing their password. That’s not a subtle intrusion; that’s a full set of keys.
The malware steals credentials in a more sophisticated way than typical threats. It targets exfiltration of two-factor authentication secrets. The malware specifically searches for TOTP seeds from multiple 2FA plugins. Attackers send the stolen passwords and 2FA to generate[.]2faplugin[.]org, a domain that blends in with legitimate two-factor traffic. If an attacker has your password and your TOTP seed, changing your password after discovery doesn’t help.
Clean GitHub repo tricks AI coding agents into running malware
An agentic coding tool (e.g. Claude Code) tasked with cloning and setting up a seemingly benign GitHub repository could execute a malicious payload that remains invisible to security scanners, AI agents, and human reviewers.
The new attack method relies on three components, which separately represent no threat and raise no suspicion:
1. A clean-looking GitHub repository with standard setup instructions, such as installing dependencies and initializing the project (e.g., pip3 install -r requirements.txt, python3 -m axiom init)
2. the Python package is intentionally designed to refuse execution until it has been initialized; it generates an error instructing the user to execute python3 -m axiom init. Claude Code treats this as a normal setup issue and automatically runs the suggested command while attempting to recover from the error
3. Executing python3 -m axiom init calls a shell script that retrieves the configuration value stored in a DNS TXT record controlled by the attacker, and is executed as a command.
If successful, the attacker would obtain a shell running with the developer’s privileges, giving them access to environment variables, API keys, local configuration files, and the opportunity to establish persistence.
Claude Code never decided to open a shell. It decided to fix an error.
To prevent such exploitation, AI agents should disclose the full execution chain of setup commands, including scripts and code fetched dynamically at runtime.
New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis
A OS implant and information stealer has been found to embed a prompt injection payload designed to trick a malware analyst's artificial intelligence (AI) tools into aborting or refusing an analysis of the artifact.
Its most notable feature is an embedded cascade of fabricated system-failure messages, designed to make an LLM-assisted triage agent doubt its own session. It attacks the agent's perception, rather than the sandbox it runs in.
Interesting Paper Exploring Prompt Injection
It turns out LLMs learn to recognize the style of text in different role/instruction blocks, and not just the tags.
Role tags were a formatting trick that became the security architecture and the cognitive scaffolding of modern LLMs. This architecture doesn’t survive into the model’s actual representations, and role confusion is linked to prompt injection.
Unless LLMs achieve genuine role perception, injection defense will remain a perpetual whack-a-mole game. And the continuous nature of role boundaries opens the threat of injections designed to subtly shift LLM states through seemingly innocuous text, legally and at scale.
Researchers uncovered a script on Pastebin masquerading as a routine Windows update. In reality, it was an infostealer designed to hijack Telegram for Windows session data, and allow hackers to take over accounts with neither a password nor verification code.
As soon as it runs, it gathers basic system information: username, hostname, and public IP address. It then checks if Telegram Desktop is installed. If it is, the script forces the app to close so it can unlock Telegram files for editing. From there, the rest is simple: the script zips up the entire contents of the tdata folder into a temporary directory, forwards the archive straight to the attackers, and wipes the file from the computer to hide its tracks.
APPSEC, DEVSECOPS, DEV
New CISA Guide Helps Agencies Adopt SASE For Zero Trust
The US cybersecurity and Infrastructure Security Agency (CISA) has published new guidance to help federal agencies replace their legacy internet gateways with Secure Access Service Edge (SASE) technology as part of the shift to zero trust.
The guidance explains how agencies can use SASE to move from the perimeter-based Trusted Internet Connections (TIC) 2.0 model to the more flexible TIC 3.0, which CISA built around zero trust principles.
AI Decline? Confidence in Autonomous Penetration Testing Falls
The number of organizations willing to rely on AI-powered penetration testing for their security needs fell to 9% in 2026, down from 29% a year earlier. The vast majority of companies preferred a hybrid, human-in-the-loop approach or relegating only non-critical tasks to automation.
Challenges in the near and medium term is still a major question mark for security practitioners. Vulnerabilities are being reported at a 46% higher rate than forecasted from last year's data.
Meanwhile, security practitioners are focused on increasing the number of security assessments, with 77% committed to regular security assessments and pen testing.
While that will require more automation, AI systems and large language models (LLMs) have shown weaknesses. AI systems are still missing high- and critical-severity issues. 78% of companies have had automated systems miss significant vulnerabilities (known as false negatives).
7,000 Langflow servers are under attack. LangGraph and LangChain have the same holes
Your AI agent did exactly what it was designed to do. The framework underneath it just handed an attacker a shell on the box that holds your OpenAI key, your database credentials, and your CRM tokens.
Three of the most widely deployed AI agent frameworks each turned a known, ordinary bug class into a way through.
Check Point Research chained a SQL injection in LangGraph’s SQLite checkpointer to full remote code execution.
Tenable and VulnCheck tracked a path traversal in Langflow’s file upload endpoint to active, in-the-wild RCE.
Cyera documented a path traversal in LangChain-core’s prompt loader that reads your secrets off disk. Two paths to a shell, one to your keys.
They are the same bug, wearing three frameworks. These frameworks became production infrastructure faster than anyone secured them. They store agent state, take file uploads, load prompt configs, and hold the credentials to databases, CRMs, and internal APIs. The edge tools watch traffic. The endpoint tools watch processes. Neither was built to treat an imported framework as a boundary worth guarding, and that blind spot is exactly where all three chains live, widening every week as these frameworks ship to production.
The WAF never sees a msgpack decoder running three layers down. The EDR watches the agent server make the same process calls it makes a thousand times a day and waves it through.
The six-question checklist: Six trust boundaries, one per row, each with the question, the proof point, the command, the fix, and the board line. Run it tonight.
Why Your Agentic AI Program May Fail At Week 12
In weeks 1 through 3, supervisors review the agent's outputs carefully. They expand the reasoning trace in most cases. They flag minor issues. They feel productive engagement.
By weeks 4 through 6, they're still reviewing, but faster. The minor issues have started to repeat, and supervisors are trusting the agent on the obvious decisions.
By weeks 7 through 10, they're skimming. They open each case but spend less than 15 seconds on it. The override rate, which started at maybe 8%, has dropped under 2%, and the institution reads this as the agent improving. It isn't. The supervisors are catching less.
By weeks 12 through 16, they're clicking through. They're paid to supervise, but functionally they're watching a monitor that no longer demands their attention. They'll tell you the agent is reliable. They have no real way to know whether that's true. This is the moment when the agent does something that, six months earlier, a supervisor would have caught - and nobody catches it.
The institutions that avoid this pattern share a discipline that has little to do with the technology. They measure supervisor behavior with the same rigor they measure agent behavior. They rotate supervision assignments before fatigue sets in. And they close the override loop visibly - every override feeds into a documented review cycle, with policy changes communicated back to the supervising team.
If you're running an agentic AI program and the supervisor experience hasn't been instrumented, stop. Instrument it. It will save you months, and it might save the program.
VENDORS & PLATFORMS
Cloudflare teams up with big browsers to help websites tell welcome from unwelcome visitors
Cloudflare, along with Google Chrome, Microsoft Edge, and Mozilla Firefox, have committed to develop Private Access Control Tokens (PACTs), a way for websites to generate a digital token that asserts a given browsing session is being run by a human or bot with legitimate intent, as opposed to network requests from people or software deemed abusive or improper.
PACTs will let websites "with strong knowledge of 'personhood'" issue anonymous tokens that browser users and designated bots can present at other websites, so that fewer identity checks are necessary.
Microsoft adds another year to Windows 10 extended update program
Akrites is a coordinated effort to help secure critical open source software before newly discovered vulnerabilities can be exploited. The project launches with backing from a long list of heavy hitters, including Amazon Web Services, Anthropic, Cisco, Google, IBM, Microsoft, NVIDIA, OpenAI, Red Hat, JPMorganChase, Citi, Sonatype, Vodafone, Zscaler, and several others.
IBM surges after unveiling new sub-1 nm chip technology
The new 7 angstrom chip packs nearly 100B transistors onto a chip the size of a fingernail, nearly twice the density of IBM's 2 nm chip, unveiled in 2021. The new sub-1 nm chips are 70% more efficient, or 50% more powerful, than the 2 nm node chips. If 7 angstrom chips were used to train today’s massive, frontier model LLMs, we could drastically cut training time from around three months to a couple weeks.
US government allows Anthropic limited release of AI model that sparked cybersecurity concerns
The US government has allowed Anthropic to release its powerful Mythos AI model to select companies and organizations, revising license requirements after ordering an export block earlier this month in the wake of national security fears.
“We received notice from the US government that Mythos 5, our strongest cybersecurity model, can be redeployed to a small group of cyber defenders and infrastructure providers. We are working to provision the approved set of providers and restore their access to Mythos 5 as quickly as possible. We are pleased to see this progress and continue to work with the government to expand access to Mythos 5 and make Fable 5 available for general use again
Trump Administration Asks OpenAI to Stagger Release of New Model Over Security Concerns
The Trump administration has reportedly asked OpenAI to stagger the release of GPT-5.6 over security concerns. The model will initially be offered to a small group of partners, with the government approving access customer by customer during this preview period.
OpenAI: Yoo-hoo, look over here, we do that security stuff too!
OpenAI announced a flurry of cybersecurity-related AI news on Monday, releasing an improved version of GPT‑5.5‑Cyber, its most advanced vulnerability-finding model, along with an expanded partner program for cybersecurity vendors, an update to its Codex Security scanner, and an initiative to “Patch the Planet” – or at least 30 high-profile open source projects.
OpenAI evaluated the update and 5.5 preview using a few different benchmarks:
CyberGym, which test how well AI systems can reproduce known vulnerabilities;
ExploitGym, which determines how well models can turn known vulnerabilities into working exploits that achieve unauthorized code execution; and
SEC-bench Pro, which measures AI systems’ long-horizon vulnerability discovery and proof-of-concept generation capabilities.
Chinese cybersecurity company Qihoo 360 claims it’s built a better-than-Mythos bug finder
CEO Zhou Hongyi described Mythos as equivalent to a cyber nuclear weapon because the USA’s ban on foreign nationals accessing the model gives America a tool with which to find flaws in software upon which other nations rely.
Mythos follows a typical large-scale model approach: the strongest model, the strongest computing power, and the strongest chips – a strategy of sheer brute force. However, this path has an implicit prerequisite: your model capabilities must be sufficiently strong.
Qihoo 360 has developed a multi-agent swarm which automatically build sandbox environments, automatically generate exploit code, and conduct real-world testing. The result is that every vulnerability is ‘confirmed’ rather than just suspected. After completing a task, the swarm also summarizes and reviews its performance, becoming smarter with each use. This is something a single large model can hardly do.
US authorities have sanctioned Qihoo 360 on grounds that it probably supplies China’s military.
AWS Security Agent adds threat modeling, Kiro power and Claude Code plugin, and more
AWS Security Agent analyzes your design documents or application source code, understands the full context of your application architecture and identifies threats with recommended mitigations using the STRIDE framework.
You can run code reviews, generate threat models, and remediate findings directly from your IDE, CLI, or any AI-powered IDE through an open MCP integration, with results surfacing inline without any context switching.
You can continuously validate your security requirements across every design and code review with managed compliance packs: AWS Well Architected Framework, NIST CSF, PCI DSS, and AWS best practices, or import your own organizational requirements directly from internal documents or Confluence. Every finding maps back to your compliance posture, so teams stay audit-ready as they build.
Copilot code review: AGENTS.md support and UI improvements
Copilot code review now supports repository-level AGENTS.md files, and it’s easier to request a review from Copilot on draft pull requests with the Request button.
LEGAL & REGULATORY
DraftKings hacker 'Snoopy' sentenced to 18 months in prison
In December 2025, Nathan Austad of Minnesota, pleaded guilty to conspiracy to commit computer intrusion, admitting that he and co-conspirators compromised 60,000
DraftKings user accounts. During the attack, the hackers added payment methods under their control to 1,600 accounts and stole $600,000.
The hackers accessed customer accounts through credential stuffing attacks that exploited weak passwords or reused login credentials.
The DoJ's press release does not disclose the amount the hackers earned from selling access to the compromised accounts, but notes that Austad’s cryptocurrency accounts received approximately $465,000 in assets.
In addition to the 18-month prison sentence, Austad received 3 years of supervised release and was ordered to pay $463,684 in forfeiture and $1,327,061 in restitution.
Co-conspirators Joseph Garrison received an 18-month imprisonment sentence in January 2024, while Kamerin Stokes received a 30-month sentence in April 2026.
GSA Proposes New AI Rules for Government Contractors
The General Services Administration (GSA) is seeking public comment on a proposed acquisition regulation clause that would establish requirements for how Large Language Model Artificial Intelligence Systems (LLMs) handle government data when used under GSA contracts. The proposed clause could eventually be incorporated into GSA contract vehicles such as the Federal Supply Schedule program, Governmentwide Acquisition Contracts (GWACs), and OASIS+.
AI and Liability
Earlier this month, a German court ruled that Google is liable for its AI search summaries. Rejecting defenses like “users can check for themselves,” and that they generally know “that information generated with AI should not be blindly trusted,” the court held that the AI’s summaries are reflections of the company and “above all an expression of Google’s business activities.”
This is the latest skirmish in a decades-old battle over internet publishing.
Two years ago, Air Canada learned this lesson. Its AI chatbot promised a discount the company later rescinded, arguing in court that the airline wasn’t responsible for the promises the bot made because it was a “separate legal entity that is responsible for its own actions.” The court sided with the flyer, saying that the airline was just as responsible for what its chatbot says as what’s on its website. The potential precedent here is that corporations have a duty of care for the performance of the AI chatbots they employ.
Earlier this year, Google’s AI summary falsely identified the Canadian fiddler Ashley MacIsaac of being a sex offender. His lawsuit, filed in Ontario, is ongoing.
If the German ruling holds, it could be devastating for Google’s AI Overview feature. Tests from earlier this year found that it had mistakes about 10% percent of the time. That’s 16,000 erroneous summaries every second. And while most of those errors are benign, some of them will cause harm, be defamatory, or otherwise trigger liability.
Trump Order Sets 2030 Deadline for Federal Post-Quantum Crypto Migration
President Trump signed an executive order on June 22 setting hard deadlines for federal agencies to move high-value assets and high-impact systems to post-quantum cryptography. Key establishment must move by December 31, 2030; digital signatures by December 31, 2031. EO 14409 leaves national security systems on a separate track.
And Now For Something Completely Different …
For decades the heavy rocks that carve trails across a Death Valley lakebed were never seen moving, until cameras caught them
In Death Valley National Park, heavy rocks sit at the end of long grooves they have plowed across the mud. The trails run for tens of meters, some bending in sharp turns or doubling back, yet no one had ever watched a rock actually move. For more than sixty years the question of how they travel sat unanswered, the subject of guesses that ranged from hurricane-strength winds to floating sheets of ice.
