BioShocking Attack Turns AI Browsers Into Credential Thieves
June 30, 2026
LayerX’s BioShocking research shows AI browsers including ChatGPT Atlas, Perplexity Comet, and the Claude extension can be tricked into stealing
Application Security
BioShocking Attack Turns AI Browsers Into Credential Thieves
LayerX's BioShocking research shows AI browsers including ChatGPT Atlas, Perplexity Comet, and the Claude extension can be tricked into stealing credentials.
Three Daktronics Controller Flaws Allow Remote Highway Sign Hijack
CISA disclosed three Daktronics LED controller vulnerabilities that give remote attackers root access to highway signs, billboards, and roadside message boards.
Gitea CVE-2026-58053 Container Escape Vulnerability Published Following Exploitarium Leak
An anonymous researcher's 130-plus zero-day dump included Gitea CVE-2026-20896, a Docker default misconfiguration that grants admin access with one HTTP header.
India IDRBT .bank.in Registry Leaked 5,576 Employee Records
India's IDRBT domain registry for the RBI-mandated .bank.in namespace exposed 5,576 bank employees' credentials through 33-plus unauthenticated API endpoints.
Microsoft Removes 119 StegoAd Extensions from Edge Add-ons Store
Microsoft removed 119 malicious Edge extensions in the StegoAd takedown, exposing a steganography campaign hiding malware in image and font files since 2021.
Public PoC Drops for Critical libssh2 Flaw CVE-2026-55200
A public PoC exploit for CVE-2026-55200, a CVSS 9.2 out-of-bounds write in libssh2, is live with no fixed tagged release available for curl, Git, and ...
Hijacked npm and Go Packages Exploit VS Code MCP to Deploy Infostealer
Hijacked npm and Go packages exploit VS Code's MCP tasks to bypass npm lifecycle hook protections and deploy a cross-platform Python infostealer.
Mozilla 0DIN Shows AI Coding Agents Can Be Tricked via DNS TXT
Mozilla's 0DIN researchers show a clean GitHub repo can trick AI coding tools into running malware via DNS TXT records, bypassing security scanners entirely.
Athena Coalition Finds 20,000+ Flaws in 500 Open-Source Projects
The Athena coalition of about 24 companies including Docker, Cisco, and Cloudflare used AI to find 20,000+ vulnerabilities across 500 open-source projects.
Klue OAuth Breach Hits Huntress, Recorded Future via Salesforce
Threat actor Icarus exploited Klue's Salesforce OAuth integration to breach CRM data at cybersecurity firms including Huntress and Recorded Future in a June 2026 supply ...
Three Daktronics Controller Flaws Allow Remote Highway Sign Hijack
June 30, 2026
CISA disclosed three Daktronics LED controller vulnerabilities that give remote attackers root access to highway signs, billboards, and roadside message
Gitea CVE-2026-58053 Container Escape Vulnerability Published Following Exploitarium Leak
June 30, 2026
An anonymous researcher’s 130-plus zero-day dump included Gitea CVE-2026-20896, a Docker default misconfiguration that grants admin access with one HTTP
India IDRBT .bank.in Registry Leaked 5,576 Employee Records
June 30, 2026
India’s IDRBT domain registry for the RBI-mandated .bank.in namespace exposed 5,576 bank employees’ credentials through 33-plus unauthenticated API endpoints.
Microsoft Removes 119 StegoAd Extensions from Edge Add-ons Store
June 29, 2026
Microsoft removed 119 malicious Edge extensions in the StegoAd takedown, exposing a steganography campaign hiding malware in image and font
Public PoC Drops for Critical libssh2 Flaw CVE-2026-55200
June 29, 2026
A public PoC exploit for CVE-2026-55200, a CVSS 9.2 out-of-bounds write in libssh2, is live with no fixed tagged release
Hijacked npm and Go Packages Exploit VS Code MCP to Deploy Infostealer
June 29, 2026
Hijacked npm and Go packages exploit VS Code’s MCP tasks to bypass npm lifecycle hook protections and deploy a cross-platform
Mozilla 0DIN Shows AI Coding Agents Can Be Tricked via DNS TXT
June 29, 2026
Mozilla’s 0DIN researchers show a clean GitHub repo can trick AI coding tools into running malware via DNS TXT records,
Athena Coalition Finds 20,000+ Flaws in 500 Open-Source Projects
June 29, 2026
The Athena coalition of about 24 companies including Docker, Cisco, and Cloudflare used AI to find 20,000+ vulnerabilities across 500
Klue OAuth Breach Hits Huntress, Recorded Future via Salesforce
June 24, 2026
Threat actor Icarus exploited Klue’s Salesforce OAuth integration to breach CRM data at cybersecurity firms including Huntress and Recorded Future
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.