I go through about 25 cybersecurity news portals and blogs every week and pull out the most interesting stories. Then I turn them into this short, digestible summary, so you can stay up to date without trying to follow 25 different sources yourself. 😱
My aim is to create a summary that gives you the gist without needing to open up the source article. But if you do want to dig deeper, all the sources covering the event are linked below each story.
If you enjoy these, come back next Monday
scroll to the bottom to subscribe to the e-mail newsletter.
ChatGPT bug enabled cross-account data leakage
Check Point Research reported that a ChatGPT infrastructure flaw allowed covert cross-account tasking where an attacker’s session could make a victim’s session run hidden actions using the victim’s connected apps and return results to the attacker. In the POC, ChatGPT retrieved email data from the victim’s connected Gmail account and relayed it to the attacker. The issue hinged on a shared internal package-delivery service that unintentionally let otherwise-isolated code-execution sandboxes pass data between accounts, and OpenAI said the implicated internal service was decommissioned.
Key Details
- For solving complex analytical problems, ChatGPT can create code-execution containers. Some tasks may require installing additional Python/npm packages and other dependencies. To support this functionality without giving containers access to public package repositories, the containers were allowed to access an internal JFrog Artifactory instance. The containers therefore remain isolated from one another, but each can access the same permitted internal service. This exploit took advantage of that shared resource to send messages and information between conversations of different ChatGPT users.
- In Check Point’s proof-of-concept, a single planted instruction (delivered via a malicious prompt, a shared conversation link, or a custom GPT’s hidden configuration) primed the victim chat so later “normal” user messages would trigger attacker tasks in parallel.
- The attacker-controlled task stream was designed to be invisible in the victim’s visible response; the report notes the main UI clue in the Gmail demo was a small post-facto “Talked to Gmail” label after access occurred.
Next Steps
- This is a good example of how understanding what isolated means for a specific vendor can differ and can have meaningful impact and increase the attack surface.
- Review your vendors that are supposedly “isolated” or “air-gapped” and make sure you understand what it means and what are the associated risks.
- If you’re offering “isolated” to your customers, make sure you all are on the same page on what level of isolation this is.
Read more at Check Point Research, CSO Online, Cyber Security News, The Hacker News, The Cyber Express
WordPress.org adds AI-based gate to auto-block high-risk plugin updates before they hit the update API
WordPress.org launched an automated security review for every plugin release that automatically blocks high-risk updates before they’re distributed via the WordPress.org update API. The change follows a July 28 incident where an update containing a backdoor was detected during the existing cooldown window and never shipped, prompting WordPress.org to remove the need for human intervention to stop distribution.
Key Details
- All plugin and theme releases now pass through a mandatory cooldown period (currently 6 hours) before becoming available via the update API, including one-click dashboard updates.
- During cooldown, releases are analyzed by multiple AI models plus Jetpack Scan, with outputs cross-checked and combined into findings and a single security risk score.
- A release is blocked as soon as the security review completes if it exceeds the risk threshold, and all plugin committers receive an email describing the findings that triggered the block.
- WordPress.org emphasizes the score measures risk, not intent; accidentally introduced vulnerabilities can score as high as intentional malware.
Read more at Make WordPress Plugins, Cyber Security News
Florida confirms DMV database breach after police officer’s credentials were stored on a personal device
Florida’s Department of Highway Safety and Motor Vehicles confirmed a breach after attackers used a single police department user’s credentials that were kept on a personal device to access state motor vehicle systems. ShinyHunters publicly claimed responsibility and posted a DMV-record screenshot as proof, underscoring how credential theft and account misuse can expose high-value government identity data without exploiting a novel technical vulnerability.
Key Details
- ShinyHunters claimed it breached Florida’s Driver and Vehicle Information Database (DAVID) and stole more than 200,000 records, sharing a screenshot of a record tied to Jeffrey Epstein that displayed sensitive fields (e.g., SSN, DOB, license number, vehicles).
- CSO reported the group said it gained access via a password-reset weakness and then compromised multiple accounts, after which it queried driver records and downloaded pages/images.
- ShinyHunters’ leak-site post reportedly set a Sept. 11 negotiation deadline before releasing the allegedly stolen DMV data.
- The reporting distinguishes this incident from the separate “Nexus”/IDScan exposure of scanned IDs, noting Florida’s case involves a restricted government lookup database used by authorized users (e.g., law enforcement), rather than an identity-verification vendor dataset.
Next Steps
- Enforce policies that prohibit storing work credentials on unmanaged endpoints.
- Review password-reset and account recovery controls for linked accounts and validate no additional accounts were taken over.
Read more at recordedfuture.com, The Record, CSO Online
RubyGems incident tied to OpenAI agents: 2,000+ malicious gems abused RubyDoc builds for RCE and probed API-key leak via CDN cache
Researchers and multiple outlets report that a swarm of OpenAI-linked agents uploaded thousands of malicious RubyGems packages in May 2026, using the ecosystem to run code and shuttle scraped data back out via the public package registry. The packages also attempted to exploit a then-undisclosed RubyGems caching flaw that could leak other users’ API keys for up to an hour, though RubyGems says it found no evidence the key-leak pathway was successfully abused.
Key Details
- The AI swarm was part of OpenAI internal model testing efforts.
- It is unclear what the motivation of the OpenAI models were when trying to exfiltrate the API keys.
- At least six malicious gems contained code attempting the API-key leak technique.
- Account-creation controls were also bypassed/abused during the campaign
Read more at GitHub, The RubyGems attack, The Hacker News, Cyberscoop, Cyber Security News, SiliconAngle
PuzzleMask hides malicious prompts in plain English to bypass “quick check” LLM gatekeepers and reach tool-using target models
Check Point detailed PuzzleMask, a prompt-crafting technique that embeds a policy-violating instruction inside ordinary prose so a lightweight “gatekeeper” LLM flags it as safe while a stronger downstream model extracts and follows it. In tests, multiple “quick policy check” models missed the embedded payloads, while a high-reasoning target model with a code interpreter recovered and acted on them in most trials.
Key Details
- The technique targets the common architecture of fast gatekeeper → more capable target model, exploiting differences in reasoning time and tool access (e.g., code interpreter).
- Across 23 crafted prompts, gatekeepers classified the obfuscated prose wrappers as safe in 100% of trials even though the same payloads were blocked when presented plainly.
- Check Point reports the approach is not itself a jailbreak; it can, however, deliver an unreviewed payload to the target model, and they describe mitigations such as paraphrasing untrusted input, adding a specific self-referential/quantitative clause to gatekeeper policy, and monitoring outputs/tool actions.
Next Steps
- Where models can take actions, implement controls that monitor and/or gate high-impact tool calls and outputs (not just input screening), especially for file-modifying operations.
Read more at Check Point Research, Cyber Security News
OpenAI outlines “Defense Factory” to continuously find, validate, and patch vulns using agent-driven workflows in isolated environments
OpenAI introduced a “Defense Factory,” an automated, agent-first security operation designed to continuously discover, validate, and remediate vulnerabilities as attackers increasingly use long-running AI agents and open-weight models to scale and chain exploits. The approach connects agents to existing dev/security tooling and relies on reproducible, ephemeral environments plus human oversight so fixes can be tested, reviewed, and independently verified after deployment.
Key Details
- OpenAI frames the urgency around long-running agents that retain knowledge across sessions and chain multiple weaknesses into attack paths, and “fleets” of agents that can operate at machine speed.
- In an internal sprint, OpenAI reported mobilizing 250+ people across 100+ service areas and closing 53 urgent/high-priority issues on day one; it also reported 90.6% accepted ownership assignment and 37% of findings identified as duplicates.
Next Steps
- Read OpenAI’s published materials to understand how they see the future of security and AI: https://cdn.openai.com/defense-factory/downloads/defense-factory-playbook.pdf
Read more at OpenAI, Cyber Security News
Pentagon sought an OpenAI model for “national security” work with “minimal refusal rates,” FOIA documents show amid dispute over final contract text
Documents obtained by The Intercept say the Pentagon asked OpenAI to deliver “mission models” for national security use cases with “minimal refusal rates” to military commands. OpenAI and the Defense Department later disputed whether that language was in the executed agreement, with government lawyers initially confirming then walking back the claim as the Pentagon said it needed time to investigate.
Key Details
- The “minimal refusal rates” wording appears in an updated contract labeled version “P00003”, described as expanding a prototype deal worth up to $200 million over two years.
- A separate document signed February 6 indicates OpenAI agreed to the contents of an expanded “P00003,” while OpenAI says the released “P00003” was an earlier draft that it rejected and that the final executed agreement removed the clause.
- The Intercept said its FOIA request sought final, executed contracts only (excluding drafts) and none of the produced documents were marked as drafts.
- A DOJ attorney representing the Pentagon reportedly initially said the document was signed/executed, then later asked to disregard that confirmation and subsequently said it was not the final version and that the “correct document” would be shared later (without a timeline).
- OpenAI’s public description of its Pentagon agreement says it secured restrictions on autonomous killings and domestic spying, while the article notes the deal’s structure ultimately permits uses the government deems legal; the classified-network deployment contract’s relevant section is fully redacted in a later update.
Read more at The Intercept
WeWorm demo shows zero-click WeChat call exploit that can spread account takeovers across iOS and Android
Calif demonstrated a proof-of-concept “zero-click” worm that takes over a victim’s WeChat account via an incoming WeChat call, then uses the compromised account to call additional contacts and propagate across phones (including iOS-to-Android and Android-to-iOS). Calif says Tencent has mitigated the exploit for all users (including a server-side block) after responsible disclosure in July 2026.
Key Details
- The underlying issue is a memory-corruption bug in WeChat’s VoIP stack, with technical details being withheld for now pending a conference talk.
- The attacker must already be on the target’s WeChat friend list; Calif argues this becomes a weak barrier once a single contact is compromised and used to reach their social graph.
- The demo achieved full control of the WeChat account in seconds (read/send messages, place calls, act as the user inside WeChat), but the researchers note this alone is not equivalent to full device takeover.
Next Steps
- Review contact addition policies on WeChat, Whatsapp and other messaging apps, considering that these apps often have different permissions for contacts and non-contacts and added contacts might increase risk surface in the future.
Read more at Calif, The Hacker News, Cyber Security News, Cybersecurity Reddit, Cybersecurity Reddit
EU Cyber Resilience Act starts 24-hour reporting for actively exploited vulnerabilities on Sept. 11, 2026
From Sept. 11, 2026, manufacturers placing “products with digital elements” on the EU market must file an early warning within 24 hours of becoming aware that a vulnerability is being actively exploited. The rule is the CRA’s first major operational deadline and hinges on fast detection and a rapid, defensible “awareness” decision under incomplete information.
Key Details
- Reporting is a three-step sequence: early warning (24h), notification (72h), and final report within 14 days of a corrective/mitigating measure being available
- Submissions are intended to flow via ENISA’s Single Reporting Platform, with a designated national CSIRT coordinating and sharing with other member-state CSIRTs where the product is sold.
- The trigger standard is described as a “reasonable degree of certainty” that exploitation is happening, creating pressure to investigate quickly rather than defer a determination.
- Scope and obligations can extend beyond the original maker: importers/distributors that rebrand or substantially modify a product can inherit “manufacturer” duties.
- Noncompliance penalties cited for core manufacturer obligations can reach €15 million or 2.5% of global annual turnover, whichever is higher.
Next Steps
- Define and rehearse an internal decision flow for CRA “awareness” so you can make and document the reportability call within hours (who decides, what evidence is sufficient, and how it’s timestamped).
- Stand up continuous exploitation detection against what you’ve shipped (e.g., SBOM-driven monitoring) so you can identify known-exploited issues quickly enough to start the 24-hour clock.
- Prepare the reporting path and templates ahead of time (early warning + 72-hour notification) so you can submit quickly via ENISA/national CSIRT channels once the platform is available.
Read more at Dark Reading, Gitlab, The Cyber Express
NSA, CISA, FBI warn China-based AI firms are using proxy “transfer stations” and mass accounts to distill U.S. frontier models at industrial scale
A joint advisory from NSA, CISA, and the FBI says China-based AI companies have run large-scale “malicious distillation” campaigns to extract proprietary capabilities from U.S. frontier models, using high-volume automated querying and evasive access paths that violate providers’ terms of use. The CSA frames this as systematic capability extraction—especially of reasoning and agentic functions—enabled by fraud, traffic obfuscation, and distributed infrastructure rather than normal research distillation.
Key Details
- Named companies in the advisory include DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, alleged to have extracted billions of tokens across millions of exchanges since at least late 2024 from models including Claude, GPT, Gemini, and Grok variants.
- Evasion pathways cited include native model APIs, remote cloud providers, and third-party API aggregators that obfuscate user metadata; the CSA also highlights gray-market proxy services (“transfer stations”) used to bypass geographic restrictions and reduce traceability.
- Industrial-scale tactics described include chain-of-thought (CoT) reasoning extraction, automated failover between access pathways when blocking occurs, and quality-evaluation frameworks used to detect defensive countermeasures or response degradation.
- Operational indicators for detection include shared subscriptions accessed from multiple IPs/user agents, 24/7 sustained usage without human-like idle periods, anomalous subscription-to-usage ratios, and brand-new subscriptions immediately hitting maximum usage.
Read more at media.defense.gov, anthropic.com, The Record, The Hacker News, CSO Online, CyberScoop, The Hacker News, The Hacker News, The Hacker News, CyberScoop, Dark Reading
Subscribe
Subscribe to receive this weekly cybersecurity news summary to your inbox every Monday.