Latest threat reports & articles

arxiv_cs_cr · tlp:amber · 6/19/2026, 4:00:00 AM

GNSS Spoofing Threat for V2X communications arXiv:2606.20215v1 Announce Type: new Abstract: Global Navigation Satellite Systems (GNSS) constitute a core technology for delivering crucial positioning, navigation, and timing (PNT) services in the Vehicle-to-Everything (V2X) domain, where they are indispensable for generating Cooperative Awareness Messages (CAM) that uphold network reliability and vehicular safety. Yet, GNSS signals are acutely exposed to spoofing, an advanced …

arxiv_cs_cr · tlp:amber · 6/19/2026, 4:00:00 AM

A-COMPASS: Formal Foundations for Anonymity Analysis in Microdata arXiv:2606.20492v1 Announce Type: new Abstract: In the information age, one of the leading problems is how to ensure individual's privacy. Depending on the context in which privacy is considered, various data privacy models have emerged. However, the domain of formal verification of these models is still not sufficiently explored even when it comes to the most basic models. An attempt to verify privacy require…

arxiv_cs_cr · tlp:amber · 6/19/2026, 4:00:00 AM

FloatDoor: Platform-Triggered Backdoors in LLMs arXiv:2606.19535v1 Announce Type: new Abstract: Large language models (LLMs) are increasingly deployed in sensitive settings such as software engineering, where their outputs directly shape downstream artifacts. Recent work has shown that an identical model can produce measurably different outputs depending on the deployment platform, a consequence of non-associative floating-point arithmetic and divergent kernel implementation…

arxiv_cs_cr · tlp:amber · 6/19/2026, 4:00:00 AM

Secure Coding Drift in LLM-Assisted Post-Quantum Cryptography Development: A Gamified Fix arXiv:2606.19474v1 Announce Type: new Abstract: The transition to Post Quantum Cryptography (PQC) introduces considerable implementation complexity, requiring strict adherence to constant-time execution, side channel resistance, and precise parametrisation. Simultaneously, large language models (LLMs) are heavily embedded in software development workflows, including cryptographic engine…

arxiv_cs_cr · tlp:amber · 6/19/2026, 4:00:00 AM

A Measurement Study of Cryptographic Misuse in Embodied AI Mobile Applications arXiv:2606.19983v1 Announce Type: new Abstract: Embodied AI (EAI) mobile applications are evolving from auxiliary user interfaces into active control-path components, directly linking mobile-side cryptographic security to cyber-physical trust. Despite this shift, existing security research predominantly focuses on embodied AI devices and cloud infrastructures, leaving the mobile control layer larg…

arxiv_cs_cr · tlp:amber · 6/19/2026, 4:00:00 AM

Quantization as a Malicious Task: Removing Quantization-Conditioned Backdoors via Task Arithmetic arXiv:2606.20254v1 Announce Type: new Abstract: Model quantization is widely adopted to reduce memory usage and inference cost when deploying deep neural networks on resource-constrained devices. However, recent studies have revealed a new security threat known as Quantization-Conditioned Backdoors (QCBs), where a model behaves normally in full precision but activates malicious …

arxiv_cs_cr · tlp:amber · 6/19/2026, 4:00:00 AM

Image Encryption Algorithm Based on Convolutional Neural Networks and Dynamic S-Box Generation arXiv:2606.20444v1 Announce Type: new Abstract: The paper proposes a dynamic approach to image encryption, combining the use of Convolutional Neural Networks (CNNs) and classical cryptography to improve the security and flexibility of image encryption. The main concept is to create adaptive Substitution boxes (S-boxes) based on characteristics that are learned by a trained CNN. The…

arxiv_cs_cr · tlp:amber · 6/19/2026, 4:00:00 AM

PUFFERDOS: Efficient and Effective Attack String Generation for Regular Expression Denial of Service Vulnerabilities arXiv:2606.19654v1 Announce Type: new Abstract: ReDoS attacks constitute a critical class of resource-exhaustion vulnerabilities. In such attacks, adversaries exploit the pathological worst-case execution behavior of regular expression (regex) engines to induce highly asymmetric computational workloads, ultimately exhausting system resources and degrading serv…

arxiv_cs_cr · tlp:amber · 6/19/2026, 4:00:00 AM

Sovereign Execution Brokers: Enforcing Certificate-Bound Authority in Agentic Control Planes arXiv:2606.20520v1 Announce Type: new Abstract: Autonomous agents are increasingly connected to cloud, deployment, and data-control workflows, but production mutation authority should not reside inside non-deterministic reasoning processes. Existing access-control mechanisms authorize identities, while assurance layers certify proposed actions; neither alone provides a mandatory enfo…

arxiv_cs_cr · tlp:amber · 6/19/2026, 4:00:00 AM

Multi-View Decompilation for LLM-Based Malware Classification arXiv:2606.20436v1 Announce Type: new Abstract: Malware analysts often inspect compiled binaries through decompiled pseudo-C, when source code is unavailable. Recent work suggests that large language models (LLMs) can assist this process by classifying decompiled code as benign or malicious, but existing pipelines typically rely on a single decompiler view. We argue that this assumption is fragile: decompilers are…

microsoft_mstic · tlp:amber · 6/19/2026, 12:17:54 AM

AutoJack: How a single page can RCE the host running your AI agent AutoJack is a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a remote code execution vector on the host machine. By abusing trust in localhost, missing authentication, and unsafe parameter handling, attackers can trigger arbitrary process execution through AutoGen Studio’s MCP WebSocket. The research highlights a broader pattern - when agents can browse untrusted…

ars_security · tlp:amber · 6/18/2026, 11:28:52 PM

Microsoft discovers new lightweight backdoor that steals cryptocurrency Crypto Clipper spreads over USB and communicates over Tor. Microsoft says it has detected new self-propagating malware that spreads through USB drives in search of cryptocurrency credentials, which it then sends to attacker-controlled servers. The company named the worm Crypto Clipper because it monitors the contents of device clipboards for patterns consistent with wallet addresses or seed phrases. Whe…

ars_security · tlp:amber · 6/18/2026, 7:41:35 PM

Apple patches high-severity eavesdropping vulnerability in Beats Studio Buds The vulnerability, disclosed 12 months ago, affects multiple manufacturers. Apple has updated its Beats Studio Buds wireless earbuds to patch a high-severity vulnerability that could be exploited by nearby hackers to eavesdrop on users. The vulnerability, CVE-2025-20701 , allowed improper authentication in the firmware running on the Bluetooth-related chips, enabling people within signal range to i…

microsoft_mstic · tlp:amber · 6/18/2026, 7:36:08 PM

New Forrester study shows customers who unified with Microsoft Security benefited from 124% ROI New Forrester Total Economic Impact™ study shows Microsoft Security consolidation delivers ROI, lowers risk, and prepares organizations to secure AI. The post New Forrester study shows customers who unified with Microsoft Security benefited from 124% ROI appeared first on Microsoft Security Blog . Across many industries, organizations are unifying security and putting AI agents t…

huggingface_blog · tlp:amber · 6/18/2026, 6:13:13 PM

MosaicLeaks: Can your research agent keep a secret? MosaicLeaks: Can your research agent keep a secret? Hugging Face Models Datasets Spaces Buckets new Docs Enterprise Pricing Website Tasks HuggingChat Collections Languages Organizations Community Blog Posts Daily Papers Learn Discord Forum GitHub Solutions Team & Enterprise Hugging Face PRO Enterprise Support Inference Providers Inference Endpoints Storage Buckets Log In Sign Up Back to Articles a]:hidden"> MosaicLeaks:…

talos · tlp:amber · 6/18/2026, 6:00:24 PM

Close Encounters of the Human Kind In the latest Threat Source, Hazel channels her inner Spielberg to explore why humans are delightfully irrational, reminding us that while security best practices are simple in theory, they’re a lot harder to pull off when you’re busy dealing with real life. Welcome to this week’s Threat Source newsletter.  I love a Spielberg summer. His ability to imbue a sense of wonder, awe, curiosity, and connection means he&#x201…

krebs_on_security · tlp:amber · 6/18/2026, 5:37:58 PM

‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic linked to advertising fraud, account takeovers, and mass data-scraping efforts. This week, researchers from multiple security firms concluded that the Popa botnet is linked to NetNut, a "residential proxy" provider operated by the publicly-traded Israeli firm Alarum Technologies Ltd [NASD…

lwn_kernel · tlp:amber · 6/18/2026, 4:00:37 PM

The Software Freedom Conservancy's LLM-backed generative AI recommendations The Software Freedom Conservancy (SFC) has announced the release of its recommendations for using LLM-backed generative AI systems for FOSS contributions . The recommendations were created by the SFC and volunteers from the free-software community. The recommendations reflect the extremely difficult dilemmas that these systems pose for FOSS contributors. SFC and its volunteers understand that FOSS de…

lwn_kernel · tlp:amber · 6/18/2026, 1:47:49 PM

[$] The first half of the 7.2 merge window The 7.2 merge window started with the 7.1 kernel release on June 14. As of this writing, just over 7,000 non-merge changesets have been pulled into the mainline for the next kernel release. Many of the core subsystems have been pulled at this point, meaning that most of the changes that can be expected in 7.2 have now come into focus.

lwn_kernel · tlp:amber · 6/18/2026, 1:28:00 PM

Mastodon 4.6 released Version 4.6 of the Mastodon fediverse platform has been released. The headliner of this release is Collections, a way to create and share curated collections of profiles. Part of Mastodon's work ethos is our commitment to trust and safety, so we've put a lot of thought and care into the design of this feature to avoid some of the pitfalls and abuse people have experienced with similar features on other platforms, while focusing on its primary goal: Help…

lwn_kernel · tlp:amber · 6/18/2026, 1:25:34 PM

[$] Single-hop block replication with RMR and BRMR How can cloud providers efficiently supply durable virtual block devices? Remote Direct Memory Access (RDMA) provides a way for servers in a cluster to share chunks of memory, but there still needs to be a protocol that operates on top of RDMA to provide the guarantees expected of a block device. The kernel's RDMA transport library (RTRS) provides a way to send messages via RDMA. I presented about two new components built on…

lwn_kernel · tlp:amber · 6/18/2026, 1:16:11 PM

Security updates for Thursday Security updates have been issued by AlmaLinux (dracut, podman, postfix, rsync, xorg-x11-server, and xorg-x11-server-Xwayland), Debian (atril, firefox-esr, and nginx), Mageia (libcap, perl, and python-pillow), Oracle (firefox, gstreamer-plugins-base and gstreamer-plugins-good, httpd:2.4, kernel, libpng12, libpng15, libxml2, libxslt, opencryptoki, openssl, postfix, rsync, webkit2gtk3, xorg-x11-server, and xorg-x11-server-Xwayland), Slackware (bin…

cisa_alerts · tlp:amber · 6/18/2026, 12:00:00 PM

Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products View CSAF Summary Schneider Electric is aware of vulnerabilities in its PowerChute™ Serial Shutdown product. The [PowerChute Serial Shutdown](https://www.se.com/ww/en/product-range/137943580-powerchute-serial-shutdown/#products) product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktop, servers and workstations. Failure to apply the remediatio…

cisa_alerts · tlp:amber · 6/18/2026, 12:00:00 PM

CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure CISA is aware of global reports that malicious cyber actors have targeted internet-accessible Fortinet devices across government and private sector organizations using compromised credentials. This activity, referred to as FortiBleed, involves the exposure of leaked credentials associated with approximately 74,000 Fortinet devices, including firewalls and virtual private network (VPN) gateways.  …

cisa_alerts · tlp:amber · 6/18/2026, 12:00:00 PM

AzeoTech DAQFactory View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to upload malicious .ctl files that may lead to arbitrary code execution. The following versions of AzeoTech DAQFactory are affected: DAQFactory <=21.1 (CVE-2026-12390) CVSS Vendor Equipment Vulnerabilities v3 7.8 AzeoTech AzeoTech DAQFactory Access of Resource Using Incompatible Type ('Type Confusion') Background Critical Infrastructure Sectors: Critical Manufactur…

cisa_alerts · tlp:amber · 6/18/2026, 12:00:00 PM

Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive health-related information and prevent legitimate users from establishing a connection with the device. The following versions of Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT are affected: Blood Glucose Monitoring System (Model No. APG-01 BT) 0x0110_v1.1.0 (CVE-2026-50034, CVE-2026-52866) CVSS Ve…

cisa_alerts · tlp:amber · 6/18/2026, 12:00:00 PM

Schneider Electric EasyLogic T150 and Saitel DP View CSAF Summary Successful exploitation this vulnerability could allow an attacker to gain unauthorized access to sensitive files The following versions of Schneider Electric EasyLogic T150 and Saitel DP are affected: Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller Firmware installed on Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller (Al…

cisa_alerts · tlp:amber · 6/18/2026, 12:00:00 PM

AVer PTC cameras View CSAF Summary Successful exploitation of this vulnerability could allow arbitrary code execution. The following versions of AVer PTC cameras are affected: PTC500S vers:all/* (CVE-2026-40624) PTC115 vers:all/* (CVE-2026-40624) PTC500+ vers:all/* (CVE-2026-40624) PTC115+ vers:all/* (CVE-2026-40624) CVSS Vendor Equipment Vulnerabilities v3 9.8 AVer AVer PTC cameras Files or Directories Accessible to External Parties Background Critical Infrastructure Sector…

cisa_alerts · tlp:amber · 6/18/2026, 12:00:00 PM

Mitsubishi Electric Co.'s MELSEC iQ-F Series FX5-ENET/IP Ethernet Module View CSAF Summary Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service (DoS) condition in the affected product by continuously sending a large number of communication packets to the Ethernet port of the product in a short period of time, increasing the processing load of the product, preventing the internal anomaly-detection processing from being perfo…

cisa_alerts · tlp:amber · 6/18/2026, 12:00:00 PM

Rockwell Automation FactoryTalk Historian Site Edition View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to obtain a valid authentication token, perform a denial of service, or crash the system. The following versions of Rockwell Automation FactoryTalk Historian Site Edition are affected: FactoryTalk Historian SE 11 (CVE-2025-13036) FactoryTalk Historian SE <=11.00 (CVE-2025-44019) FactoryTalk Historian SE <=11.00 (CVE-2025-3653…

cisa_alerts · tlp:amber · 6/18/2026, 12:00:00 PM

Mitsubishi Electric MELSEC iQ-F Series View CSAF Summary Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service (DoS) condition in the affected product by rapidly establishing a large number of TCP connections to it, resulting in an inconsistency in the product's internal connection management process and triggering improper memory access. The following versions of Mitsubishi Electric MELSEC iQ-F Series are affected: MELSEC i…

cisa_alerts · tlp:amber · 6/18/2026, 12:00:00 PM

CISA Adds One Known Exploited Vulnerability to Catalog CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-20253 Splunk Enterprise Missing Authentication for Critical Function Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Secur…

chainalysis · tlp:amber · 6/18/2026, 11:58:38 AM

Brazil’s Maturing Market Meets Maturing Threats: How Global Crypto Crime Trends Are Landing in Latin America’s Largest Market Brazil is Latin America’s largest crypto market, and one of the world’s most dynamic. Between July 2024 and June 2025,… The post Brazil’s Maturing Market Meets Maturing Threats: How Global Crypto Crime Trends Are Landing in Latin America’s Largest Market appeared first on Chainalysis . Brazil's Crypto Crime Challenge: How…

chainalysis · tlp:amber · 6/18/2026, 11:57:25 AM

Mercado brasileiro amadurece e enfrenta ameaças cada vez mais sofisticadas: como as tendências globais do crime com cripto estão chegando ao maior mercado da América Latina O Brasil é o maior mercado de criptomoedas da América Latina e um dos mais dinâmicos do mundo. Entre julho… The post Mercado brasileiro amadurece e enfrenta ameaças cada vez mais sofisticadas: como as tendências globais do crime com cripto estão chegando ao maior mercado da América Latina appeared f…

talos · tlp:amber · 6/18/2026, 10:00:05 AM

Scripting the disassembler: Local agentic reverse engineering through vbdec’s live COM object model Cisco Talos detailed a new approach to reverse engineering that pairs local AI agents with traditional analysis tools like the VB6 disassembler vbdec. Instead of awkwardly bolting AI onto the software, vbdec exposes its parsed data through a live COM interface. Analysis tools do not need AI built in to support agentic workflows; they simply need to expose their data through a…

eset · tlp:amber · 6/18/2026, 9:46:32 AM

Killing me gently: Inside Gentlemen’s EDR killer framework ESET Research shares the results of a months-long investigation into the suite of EDR killers maintained by the RaaS gang Gentlemen Killing me gently: Inside Gentlemen’s EDR killer framework Award-winning news, views, and insight from the ESET security community English Español Deutsch Português Français TIPS & ADVICE BUSINESS SECURITY ESET RESEARCH About ESET Research Blogposts Podcasts White papers Threat repo…

snyk_blog · tlp:amber · 6/18/2026, 4:00:00 AM

The full Snyk AI Security Platform, free for open source maintainers Open source maintainers are drowning in real vulnerability reports and need help prioritizing, fixing, and shipping remediation faster. Snyk’s Secure Developer Program gives qualifying projects free access to the Snyk AI Security Platform. The full Snyk AI Security Platform, free for open source maintainers | Snyk You need to enable JavaScript to run this app. Skip to main content Platform Platform Snyk AI…

arxiv_cs_cr · tlp:amber · 6/18/2026, 4:00:00 AM

Understanding and Mitigating Prompt Leaking Attacks in Real-World LLM-Based Applications arXiv:2606.18673v1 Announce Type: new Abstract: Large language model (LLM)-based applications rely on system prompts to encode core logic and developer-defined constraints, making these prompts important intellectual property. However, system prompts are vulnerable to prompt leaking attacks. Although prior work has shown such attacks in controlled settings, their prevalence, causes, and …