Breaking News – Cyber Threats (last 6h)
Generated: 2026-08-04 08:00 PDT
- Varonis Agent IBAC keeps AI agents within their intended boundaries
BleepingComputer • 2026-08-04 07:00 • www.bleepingcomputer.com
AI agents need broad access to be useful, but traditional access controls cannot determine whether an action aligns with a user’s intent. Varonis explains how Agent IBAC detects intent drift and enforces real-time guardrails to keep agents within their intended boundaries. […]
https://www.bleepingcomputer.com/news/security/varonis-agent-ibac-keeps-ai-agents-within-their-intended-boundaries/ - Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
The Hacker News • 2026-08-04 06:30 • thehackernews.com
A credential-stealing npm worm that first appeared in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026.SafeDep verified 353 poisoned versions across 79 package names in the npm registry. Its monitoring put the wider footprint at 442 versions across 353 names, while Aikido later reported at least 868 packages
https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html - Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access
The Hacker News • 2026-08-04 06:11 • thehackernews.com
Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Remote Monitoring and Management (RMM) programs like ConnectWise ScreenConnect.The campaign has been codenamed SMOKE#SCREEN by Securonix Threat
https://thehackernews.com/2026/08/fake-adobe-and-zoom-updates-install.html - Botnet Hunting for Vulnerabilities in Diagnostic Tools, (Tue, Aug 4th)
SANS ISC Diary (full) • 2026-08-04 05:46 • isc.sans.eduThis morning, I noticed specific sources “hunting” for vulnerabilities in URLs that I haven't noticed before. All of these URLs appear to be associated with diagnostic tools:
- How legitimate cloud platforms enable phishers to bypass MFA
Securelist • 2026-08-04 05:00 • securelist.com
We cover a cloud-based AitM attack scenario leveraging service workers and Ultraviolet, and provide detailed phishing hosting statistics across platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS.
https://securelist.com/cloud-platforms-in-phishing/120832/ - When Vibe Hacking Turns AI into the Junior Hacker Every Adversary Always Wanted
The Hacker News • 2026-08-04 04:30 • thehackernews.com
The cybersecurity industry has spent decades assuming that offensive capability scales with technical expertise.That assumption is starting to break.
Security teams have long estimated risk by ranking attacker sophistication. Nation-state actors sat at one end. Organized criminal groups followed. Inexperienced attackers, dismissed as “script kiddies,” sat at the other end, running public
https://thehackernews.com/2026/08/when-vibe-hacking-turns-ai-into-junior.html - Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent
The Hacker News • 2026-08-04 04:16 • thehackernews.com
Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security showed that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent.The researchers said the public agent could be prompt-injected into posting /adk-issue-fix as adk-bot. They identified the bot as a collaborator, so that comment satisfied
https://thehackernews.com/2026/08/google-deletes-3-adk-ai-workflows-after.html - New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root
The Hacker News • 2026-08-04 03:36 • thehackernews.com
cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database’s root context, crossing the privilege boundary between a cPanel account and the server’s administrative database identity. It shipped in a targeted security release that closes two other routes past account boundaries.The database bug is tracked as CVE-2026-58048 (CVSS 4.0 score: 9.4) and affects
https://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.html - Some Claude Chats Are Searchable on Google
Schneier on Security • 2026-08-04 03:13 • www.schneier.comAnd it’s personal information (alternate link):
The exposed data includes an AI-powered therapy app that someone appears to have vibe-coded, notes on meetings, and a dashboard someone made apparently to analyze medical billing data. Exposed chats reportedly include private cryptocurrency wallet keys and personal information like peoples’ addresses.
What seems to be the issue is a user setting abou…
https://www.schneier.com/blog/archives/2026/08/some-claude-chats-are-searchable-on-google.html - DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT
The Hacker News • 2026-08-04 02:03 • thehackernews.com
A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims’ browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager.“The first stage drops a steganographic PNG image into the browser’s cache, retrieves its hidden content, and executes the second
https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html - Fake IRS letters target cryptocurrency holders
Graham Cluley • 2026-08-04 02:02 • www.bitdefender.com
Do you hold cryptocurrency? Have you received a letter telling you that you must register with a so-called “Digital Asset Compliance Portal”?If so, it’s time to hit the brakes, because it sounds like someone is trying to scam you.
Read more in my article on the Hot for Security blog.
https://www.bitdefender.com/en-us/blog/hotforsecurity/fake-irs-letters-cryptocurrency
Sources: BleepingComputer, The Hacker News, KrebsOnSecurity, SANS ISC, CISA.
