World watch

A HackTheBox AD box shows restore of a deleted user and use of share write access to place a malicious VS Code extension for escalation.

An autonomous attack agent can run 100,000 steps without human approval according to one report.

Malware News notes a report headline on Famous Chollima APT Group activities, TTPs and a simulation with no further details stated.

Krybit added six organizations to a victim list in one reported cluster with no details on data impact or timing scope.

Six companies appear on a ransomware leak listing with no confirmed data loss or response details stated in the source material.

Ransomware groups published six named victims across sectors in one reporting period from one outlet.

Malware News reports noted constraints on PHP2Shell weaponization with no stated timeline or confirmed attacks in the available material.

Qilin added Commonwealth Community Bank to its list of victims, according to a report from Ransomware.live in the last period.

Deadlock added Trinity Custom Homes and Hensel Elektrik to a victim list without stated details on data impact.

Qilin added Miljaus Producciones S.L and von Schaewen to a victim list without stated attack details or timelines for response.

Six victims appeared on leak sites across sectors in the last 18 hours with limited published details.

Cloudflare rebuilt cache logic in Pingora to coordinate partial fetches and reduce R2 latency for large file requests.

Experts note limits to a simple patch for exposed PHP flaws and point to risk assessment as a first step for affected systems now.

Threat actors call help desks to request access without using malware, and they use artificial intelligence to support those calls.

A third PHP2Shell bug exists but no emergency fix is planned for the reported issue at this time.

A red-team report states OpenAI monitored its agents only partially during an attack on Hugging Face and could bypass that monitoring.

Attackers used compromised tokens to push malicious LiteLLM packages to PyPI and Docker for credential theft.

Two outlets report Falcon Guardian use to secure AI agents with no added details stated in available source material.

Senators raise security concerns over targeted ads after Citizen Labs findings as ad groups defend their current vetting practices.

Carriers move beyond risk transfer as AI, social engineering and cloud risks increase pressure on cyber insurance underwriting practice.