Security News Wire — Baz Security News

Quote of the dayFriday 31 July

“Complexity is the worst enemy of security.”

— Bruce Schneier

LeadPhishing & Social Engineering

6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026

Device code phishing - the abuse of the OAuth 2.0 device authorization grant to steal access tokens - has evolved from a niche red-team technique to an industrial-scale threat in under six months. Designed for input-constrained devices like smart TVs, printers, and so on, the device authorization login flow has been adopted by a wide range of apps and use-cases that it wasn't originally

The Hacker News·45 min ago·Phishing & Social Engineering·High

Read dispatch →

CVE watch

Vulnerabilities cited in current dispatches

CVE-2026-63077Critical
Critical Code Execution Vulnerability Patched in TeamCity
SecurityWeek

Full monthly CVE roll-up →

The Wire

Chronological · latest dispatches

AWS Blames North Korean Group for Axios and Other npm Supply Chain Attacks

AWS has linked North Korea to the axios campaign to other attacks on npm libraries

Infosecurity Magazine·2 hr ago·Application & Supply Chain Security·High

Anthropic’s Claude breached three companies during security tests

Anthropic has disclosed that its AI model Claude gained unauthorized access to the systems of three different organizations during cybersecurity evaluations. The disclosure follows OpenAI’s July 21 announcement that some of its models had escaped an isolated testing environment by exploiting a previously unknown vulnerability and reached the systems of Hugging Face, the open-source machine learning platform. “After reviewing 141,006 evaluation runs where Claude could have obtained internet access, we identified three incidents in which … More → The post Anthropic’s Claude breached three companies during security tests appeared first on Help Net Security .

Help Net Security·2 hr ago·Application & Supply Chain Security·High

After OpenAI Disclosure, Anthropic Finds Its Own Models Hacked 3 Organizations

A security company’s systems were hacked after it installed a malicious Python package deployed by Claude. The post After OpenAI Disclosure, Anthropic Finds Its Own Models Hacked 3 Organizations appeared first on SecurityWeek .

SecurityWeek·3 hr ago·Application & Supply Chain Security·High

zipdump.py: Metadata Encoding, (Fri, Jul 31st)

I was asked for help with a problem similar to the following. Here is a ZIP file, analyzed with zipdump.py : The filename you see, is in Simplified Chinese: zipdump.py relies on the zipfile or pyzipper Python modules to parse the given ZIP file, and have the metadata (filenames and comments) decoded correctly. If this ZIP file would be corrupt or malformed, so that it can not be parsed by these Python modules, then you can still try to use zipdump -f option to locate individual ZIP records: As I don't know which encoding has been used for the metadata (filenames and comments), I display the filename as a Python byte string and not as a string. If the filename is simple ASCII, it will be readable (like the extension .vir here), but if it is utf-8, for example Simplified Chinese, then you'll

SANS ISC·3 hr ago·Research & Analysis·Notable

Breaking

Critical Flaw Led to Azure Cosmos DB Pwnage

Named CosmosEscape, the vulnerability exposed the primary key for Cosmos DB accounts, granting full read and write access. The post Critical Flaw Led to Azure Cosmos DB Pwnage appeared first on SecurityWeek .

SecurityWeek·3 hr ago·Vulnerabilities & CVEs·Critical

Anthropic Reveals Claude Escaped Testing, Breaching Three Companies

Anthropic has revealed that Claude AI models broke free of sandbox to compromise third-party organizations

Infosecurity Magazine·4 hr ago·Vulnerabilities & CVEs·High

Traefik Labs introduces Distro Zero secure runtime for API and AI gateways

Traefik Labs has introduced the Distro Zero image, a hardened, vendor-supported secure runtime delivered as Traefik Hub in proxy mode. It gives platform and security teams a container whose entire executable content is a single memory-safe binary, with validated cryptography built inside it and every advanced capability, from API gateway to AI and MCP gateway to full API management, unlocked by license on that same binary. No binary swap, no migration, no re-validation as needs … More → The post Traefik Labs introduces Distro Zero secure runtime for API and AI gateways appeared first on Help Net Security .

Help Net Security·4 hr ago·Application & Supply Chain Security·Notable

Horizon3.ai expands NodeZero with automated web application attack path testing

Horizon3.ai has expanded its NodeZero platform with AI-powered web application pentesting. The platform can now autonomously test web applications and identify attack paths that chain application vulnerabilities, credential theft, lateral movement, cloud access, and data exposure. Web applications have never been more exposed or more critical to secure. The rapid deployment of “vibe-coded” applications built with generative AI has introduced a wave of systems riddled with exploitable flaws. At the same time, threat actors are … More → The post Horizon3.ai expands NodeZero with automated web application attack path testing appeared first on Help Net Security .

Help Net Security·4 hr ago·Application & Supply Chain Security·Notable

AttackIQ targets CTEM execution with AVA Agentic OS

AttackIQ has announced AVA Agentic OS, an agentic operating system designed to operationalize Continuous Threat Exposure Management. CTEM has emerged as the strategic framework for managing cyber risk, yet many organizations continue to struggle to operationalize CTEM across fragmented security technologies, disconnected workflows, and manual processes. Security teams have invested heavily in tools that identify risk, but they lack an intelligent operational layer that continuously transforms intelligence into action. AVA Agentic OS fills that gap … More → The post AttackIQ targets CTEM execution with AVA Agentic OS appeared first on Help Net Security .

Help Net Security·4 hr ago·Research & Analysis·Notable

CareCloud Data Breach Impacts Over 350,000

In March 2026, hackers stole personal, financial, and medical information from the company’s AWS environment. The post CareCloud Data Breach Impacts Over 350,000 appeared first on SecurityWeek .

SecurityWeek·4 hr ago·Data Breaches·High

Resecurity expands threat intelligence integration ecosystem with IBM QRadar

Resecurity has announced the availability of native integration with IBM QRadar SIEM, a widely used Security Information and Event Management (SIEM) platform used by the leading Fortune 100 corporations worldwide. The plugin is available for activation via IBM Application Exchange. The integration leverages open standards STIX and TAXII (including version 2.1) to ingest, normalize, and correlate indicators of compromise (IOCs) providing flexible configuration of data ingestion and processing workflows. Security teams can configure log sources … More → The post Resecurity expands threat intelligence integration ecosystem with IBM QRadar appeared first on Help Net Security .

Help Net Security·5 hr ago·Threat Intelligence & APTs·Notable

Breaking

Critical Code Execution Vulnerability Patched in TeamCity

Tracked as CVE-2026-63077, the security defect can be exploited without authentication via the agent polling protocol. The post Critical Code Execution Vulnerability Patched in TeamCity appeared first on SecurityWeek .

SecurityWeek·5 hr ago·Vulnerabilities & CVEs·Critical·CVE-2026-63077

Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations

Anthropic on Thursday became the latest artificial intelligence (AI) company to reveal that three of its models, including Claude Opus 4.7, Mythos 5, and an unnamed research model, had breached three unnamed organizations during cybersecurity testing without its knowledge. The AI firm said the earliest incidents date back to April 2026, adding it made the discoveries after launching a "

The Hacker News·5 hr ago·AI & Emerging Tech Security·High

Aviation cyber risk sits on the ground, the blindness sits in the air

In this interview with Help Net Security, Eliran Almong, CEO of Cyviation, explains why airline cyber losses happen on the ground while the aircraft stays unmonitored. He walks through GNSS jamming that leaves no trace in a SIEM, and a PX4 Autopilot flaw his team disclosed where drone command channels accept unsigned messages. He argues the Electronic Flight Bag matters less than the data loading chain behind it, makes the case for digital twins, and … More → The post Aviation cyber risk sits on the ground, the blindness sits in the air appeared first on Help Net Security .

Help Net Security·7 hr ago·Vulnerabilities & CVEs·Notable

[QILIN] – Ransomware Victim: Hawaii Family Dental

Verification alert Listings attributed to QILIN have been reported as including unverified or fabricated victim claims. Treat this post as unconfirmed until corroborated with independent evidence. See further information here: BankInfoSecurity NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the QILIN On

RedPacket Ransomware·7 hr ago·Ransomware·Notable

Companies push AI, sysadmins keep it on a short leash

In 2024, sysadmins expected AI to automate patch management optimization, vulnerability prioritization, infrastructure monitoring, and incident response within two years. Action1’s 2026 Survey Report: AI Impact on Sysadmins found that those expectations proved overly optimistic. The largest shortfalls appeared in high-impact operational and security functions, where AI needs to understand business context, system dependencies, risk, and the consequences of an incorrect action. Areas with the widest expectation-reality gaps (Source: Action1) Sysadmins view patch management and … More → The post Companies push AI, sysadmins keep it on a short leash appeared first on Help Net Security .

Help Net Security·7 hr ago·AI & Emerging Tech Security·Notable