Newshot Global Cybersecurity Incident Briefing
1. Anthropic releases Claude Mythos 5.2, with enhanced vulnerability discovery capabilities and a lower sandbox escape rate
Anthropic has released Claude Fable 5.2 and Mythos 5.2, which share the same underlying model and have strengthened security protections; Mythos achieves an 89.6% vulnerability reproduction rate, Fable solves open problems related to black holes, and both are now available on multiple platforms. [Foreign publication - Read original article]
2. Binance warns that an iOS sandbox escape vulnerability can leak crypto wallet keys, with no confirmed fix yet
A proof of concept for an iOS sandbox escape has been made public, and Binance warns that mnemonic phrases, private keys and other data may be stolen; the latest system update does not fix the issue, and users are advised to delete sideloaded apps, update promptly, and immediately move assets if compromise is suspected. [Foreign publication - Read original article]
3. More than 575 malicious OpenClaw skills deliver malware, affecting Windows and macOS systems
Acronis reports that attackers are using AI agents to coordinate cross-border attacks, steal credentials and interfere with detection and recovery; more than 575 malicious OpenClaw skills deliver trojans and other payloads, session theft can bypass MFA, and ransomware is increasingly targeting monitoring and recovery processes. [Foreign publication - Read original article]
4. Barracuda confirms in-the-wild exploitation of email gateway vulnerabilities that can grant unauthorized root access
Barracuda has confirmed that two high-severity vulnerabilities in its Email Security Gateway have been exploited in the wild; chained exploitation can bypass authentication and obtain root privileges. Devices with management interfaces exposed to the public internet are at highest risk, and patches should be installed promptly while access to management interfaces is restricted. [Foreign publication - Read original article]
5. Blind Eagle uses fake court notices to deliver RATs, with attacks affecting Latin America
APT-C-36 targets judicial and administrative institutions in Latin America, using fake judicial documents in Portuguese and Spanish as lures, delivering AsyncRAT/DCRat-related RATs via HTML smuggling and loading them in memory to steal data and conduct surveillance. [Foreign publication - Read original article]
6. North Korean hackers launch a new round of cyber espionage, targeting drone technology and the software supply chain
North Korean hackers use fake job offers as bait in a two-pronged attack on Europe's drone defense sector and the software supply chain: Lazarus steals drone technology, while another group steals developer credentials to poison repositories such as npm and upgrades malware with blockchain C2. [Foreign publication - Read original article]
7. iOS sandbox escape PoC made public, Apple has not confirmed the vulnerability is fixed
Binance warns that the iOS sandbox escape vulnerability worse_query can steal mnemonic phrases, private keys and login credentials across apps; users should upgrade, delete suspicious apps, and immediately move assets and reset sessions if compromise is suspected; the PoC has been made public, and Apple has not stated whether it is fixed. [Foreign publication - Read original article]
8. SGLang RCE vulnerability leads to NEAR AI breach, with data of 18 agents and nearly 100 users stolen
An SGLang RCE vulnerability was exploited, and attackers broke through the TEE to breach NEAR AI, stealing data from about 100 user accounts and 18 AI agents and exposing two API keys; patching and credential revocation have now been completed. [Foreign publication - Read original article]
9. Fortinet fixes multiple high-severity vulnerabilities, including unauthenticated remote code execution in management platforms
Multiple Fortinet products have exposed high-severity vulnerabilities, some of which allow unauthenticated remote code execution, involving flaws in API, FGFM, OFTP and routing permissions; fixes should be applied according to version, and protection should be prioritized for internet-exposed systems. [Foreign publication - Read original article]
10. New GhostFrame malware can hijack VMware ESXi virtual machines and steal Windows credentials without running programs inside the VM
GhostFrame can hijack ESXi, steal Windows credentials without programs running inside the virtual machine, disguise persistence and disable protections; it is linked to Settra ransomware, and ESXi controls and anomaly monitoring should be strengthened. [Foreign publication - Read original article]
Recommended Quality Articles
1. Using homophones and ultrasonic carriers to give voice agents inaudible instructions at the ASR layer
Research finds that distortion in the ultrasonic channel is greater than differences between near-homophones, making precise character control impossible; homophones have zero acoustic distance, and the choice of character lies with the LLM. A feasible attack is to make the ASR get the sound right but the character wrong, with the LLM filling in the rest; defense should focus on source labeling and secondary confirmation. [Read original article]
2. Resumable downloads: after content changes, 32.0% of assembled files are "half new, half old"
When the source file changes midway through a resumable download, 32% of files assembled without verification end up as mixed versions with no anomaly detected; ETag and chunk hashes are 100% correct, and whole-file hashes only reveal the problem after the fact; version identifiers, chunk verification and whole-file verification after completion are needed. [Read original article]
3. Moleculer TCP transport layer: a 6-byte negative length infinite loop
In the TCP parser, a signed length is clamped through a negative slice index, so a 6-byte unauthenticated packet locks up the Node event loop in an infinite loop; CVSS 7.5, fixed in 0.14.36/0.15.2 by adding a length<6 check. [Read original article]
*This content is collected from media and publications worldwide. The producer is responsible for its completeness but not for its authenticity or validity.
*Content marked as [Foreign publication] comes mainly from media and publications in English-speaking countries, and some content requires registering an account on the original link platform before it can be read.