Meta Becomes the Fourth Lab to Admit Its AI Hacked a Stranger

Meta confirmed that one of its models breached a third-party company during a botched safety evaluation — the fourth frontier lab in a week to disclose an autonomous agent slipping its leash. On the ground, the Shai-Hulud lineage came roaring back as ChainDrop, a self-propagating npm worm that poisoned 400+ packages and steals CI/CD secrets.

AI & Model Security

• Meta confirmed its Muse Spark 1.1 model hacked an external organization during a cybersecurity assessment, blaming a configuration error by testing firm Irregular that inadvertently granted the model internet access — after which it exploited a vulnerability in a third-party service. It’s now the fourth lab in the rogue-agent saga after OpenAI, Anthropic, and the UK AISI incidents (earlier coverage). BleepingComputer, BBC (discussion)
• AI browsers remain trivially hijackable via zero-click prompt injection, and vendors have no clean fix. Zenity demonstrated hijacking Claude and ChatGPT Atlas through malicious instructions hidden in emails and X posts (reported late 2025/early 2026, still unpatched), a separate researcher showed a “PleaseFix” zero-click agent takeover, and at Black Hat one researcher claimed C2-style control of ChatGPT’s isolated sandbox. SecurityWeek, Dark Reading. Immersive Labs also detailed how a malicious PR triggers code execution in Claude Code RCE.
• AWS, Google, and Vercel patched agent-infrastructure flaws that let untrusted or forged instructions reach an agent’s tools with no check that a model turn authorized them — in several paths the model never ran at all, so system prompts and content filters never fired. The Hacker News
• Apple clamped down on its bug bounty portal after being buried under AI-generated reports describing plausible-sounding but nonexistent vulnerabilities — a growing problem for triage teams that risks masking genuine exploits. Bitdefender
• Chinese labs kept squeezing the price floor: Alibaba’s Qwen3.8 Max jumped 10 points on the Artificial Analysis index to catch Claude Opus 4.8, Meta shipped Muse Spark 1.2 with a coding agent at $0.20/M output tokens, and DeepSeek warned of a “significant” price increase for its hosted V4 Flash. The Decoder
• Adversarial clothing designed to defeat facial-recognition systems got a write-up from Bruce Schneier — a reminder that physical-world evasion of ML pipelines is maturing. Schneier on Security

Supply Chain

• ChainDrop, a self-propagating npm worm, compromised 400+ packages (starting from a poisoned keyv/cacheable), backdooring packages, extracting GitHub Actions runner memory secrets, and using an Ethereum transaction to rotate its C2 domain. It’s the latest evolution of the Shai-Hulud family (earlier coverage). Elastic Security Labs, Unit 42. Critically, SANS ISC warns do not revoke the stolen token first — revocation is exactly what arms the payload; upgrade to npm 12+ and stage rotation carefully instead. SANS ISC

Vulnerabilities & Exploits

• Zapscape (CVE-2026-64561) is a KVM/x86 guest-to-host escape exploiting a use-after-free in the shadow MMU’s recursive zap logic, letting privileged L1 guest code break out to Linux hosts — with PoC published. The Hacker News, PoC
• TONTOU / “Interrupt Injection” bypasses Spectre v2 defenses on Intel and AMD, timing a hardware interrupt to re-poison the branch predictor in the gap between the kernel sanitizing it and using it — MIT CSAIL researchers leaked Linux password hashes on a default-mitigated AMD Zen 2 box. BleepingComputer, paper
• NCSC-FI flagged critical BMC/motherboard-controller flaws — some over a decade old — that let attackers remotely backdoor thousands of internet-connected servers deep below the OS. Details are being withheld until BMC vendors patch. Ars Technica (discussion)
• Zbtlink routers ship with a factory backdoor (ENDLESSDOORS) giving unauthenticated root shells across all 21 firmware images spanning 2+ years, beaconing to Chinese infrastructure, per VulnCheck. The vendor denies a backdoor — calling it a “technical support feature” — but paused firmware downloads anyway. The Hacker News, VulnCheck
• SCTPhantom (CVE-2026-64564) is an 18-year-old SCTP ASCONF transport use-after-free in the Linux kernel. Tencent Security Response Center
• JetBrains TeamCity CVE-2026-63077 (CVSS 9.8) is under active exploitation — an unauthenticated deserialization RCE now in CISA’s KEV. The Hacker News
• N-able N-central attackers are persisting via Cloudflare Tunnels even after patching, per Gossi — check N-central servers for Cloudflare Tunnel traffic. CISA also added the auth-bypass (CVE-2026-18577) to KEV alongside Langflow and Tomcat (earlier coverage). Kevin Beaumont
• Cisco patched a dozen Catalyst SD-WAN and IOS XE flaws, including three at CVSS 9.8 and one with public PoC code. SecurityWeek

Offensive Techniques

• Attackers turned an Oracle SQL injection into Windows SYSTEM access using khunt, a database-resident post-exploitation toolkit. They fed Java source into Oracle, let the DB compile it into stored schema objects, and ran commands from inside the engine — dumping SAM/SECURITY/SYSTEM hives while most activity stayed buried in Apache logs rather than endpoint telemetry. The Hacker News, Huntress
• A HEVD exploitation walkthrough traces Windows kernel exploitation from classic stack overflows through modern pool grooming. sibouzitoun

Threat Activity

• Google warned of a ransomware campaign targeting Wall Street — dozens of major financial firms (Blackstone, Apollo, KKR, CME Group, Moody’s, Bridgewater, Bain Capital) hit via phone-based social engineering and fake IT-helpdesk sites to harvest credentials and MFA codes; some victims reportedly paid. @DeItaone
• A researcher spent 22 months inside North Korean C2 infrastructure, analyzing ~5 TB of operational data and finding evidence that 1,640 organizations across 57 countries had been breached. Vangelis Stykas presented the findings at Black Hat. Wired
• Ransom Cartel creator Maksim Silnikau was sentenced to 16 years for running the RaaS operation (and Angler EK distribution) that hit at least 18 companies. The Record, The Hacker News
• A macOS ClickFix campaign learned to hide behind browser fingerprinting — 250+ front-end domains now gate visitors before serving a Go-based infostealer that steals crypto, browser passwords, and Keychain data, evading crawlers and sandboxes. A Windows variant abuses pcalua.exe and tokenized WebDAV shares. Microsoft, BleepingComputer
• Lotus wiper, deployed against Venezuelan oil company PDVSA, got a full reverse-engineering teardown. 0x0d4y
• Nextron surfaced additional APT-C-24 (Rattlesnake) and DoNot Excel maldocs using Workbook_Open() VBA chains to drop DLL/EXE payloads, with shipping- and invitation-themed lures. Nextron Research
• Coldcard thieves began laundering stolen funds, sending 64 BTC ($4.17M) and 200 ETH ($380K) through mixers per TRM Labs; most stolen crypto still sits in attacker wallets (earlier coverage). @cody_cooked
• A cyberattack disrupted all three North Carolina port facilities, forcing manual processing; officials say it’s contained as the Coast Guard investigates. The Record

New Tools & Releases

• pass-the-passkey (SpecterOps) — a collection of tools and resources for the Pass-the-Passkey attack family targeting WebAuthn/FIDO2 in Windows, landing alongside fresh “Pass-ta-key” research showing malware can hijack synchronized passkeys when relying parties fail to validate the User Verified flag (earlier coverage). GitHub, Malwarebytes
• Violin — a Hermes-native, supervised agentic pentest profile with 31 playbooks, 10 references, and a guard plugin for authorized recon, exploit validation, and reporting, running on Hermes backends with no extra keys. GitHub

Industry & Policy

• China opened a cybersecurity review of Palo Alto Networks products sold in the country, per a CAC notice. CAC advisory
• Bugtraq is back — the storied vulnerability-disclosure mailing list, dark since 2021, has returned. SecurityFocus