tl;dv AI Notetaker Flaw Exposes Government, Corporate Calls
August 5, 2026
A Google Firebase misconfiguration in the tl;dv AI meeting tool lets users query others’ meeting data and potentially join calls,
Application Security
tl;dv AI Notetaker Flaw Exposes Government, Corporate Calls
A Google Firebase misconfiguration in the tl;dv AI meeting tool lets users query others' meeting data and potentially join calls, exposing sensitive briefings.
Malicious npm Packages Deliver RAT to Alibaba Developer Tools
Socket found 18 malicious npm packages impersonating Alibaba developer tools that deliver a cross-platform RAT with remote control and data-theft capabilities.
Poisoned Xanadu mrmustard Package Steals SSH Keys and AWS Credentials
Threat actors poisoned Xanadu's mrmustard 0.7.4 on PyPI with an info-stealer that exfiltrates SSH keys and AWS credentials from research and HPC systems.
FaceHugger Flaws in Hugging Face Diffusers Bypass trust_remote_code
FaceHugger flaws in Hugging Face Diffusers bypass trust_remote_code and let malicious model repositories execute arbitrary code when models are loaded.
Hackers Poison Adform Script to Rewrite Crypto Wallet Addresses
Attackers tampered with Adform's trackpoint script, rewriting crypto wallet addresses across customer pages to divert payments to attacker-controlled wallets.
Wiz CosmosEscape Chain Exposed Azure Cosmos DB Tenant Keys
Wiz researchers showed an Azure Cosmos DB Gremlin sandbox escape could expose a platform-wide signing key that unlocks any tenant account's primary keys.
AnySign4PC Zero-Day Watering Holes Hit 72 South Korean Organizations
A state-sponsored campaign used hacked South Korean websites to exploit an AnySign4PC zero-day and infect visitors with SIGNBT and COPPERHEDGE backdoors.
Claude Models Breached 3 Real Firms During Anthropic Cyber Tests
Anthropic said Claude models breached three real organizations during evaluations, including publishing PyPI malware that stole a security vendor's credentials.
Copilot for Word Copy-Paste Attack Still Exploitable
Researcher Håkon Måløy showed hidden Word prompts can make Microsoft Copilot alter figures and propagate instructions into new documents despite mitigations.
Amazon Ties Debug, Chalk npm Hijacks to North Korean Group
Amazon attributed debug and chalk npm hijack to North Korea's Sapphire Sleet, elevating a supply chain attack previously seen as financially motivated.
Malicious npm Packages Deliver RAT to Alibaba Developer Tools
August 4, 2026
Socket found 18 malicious npm packages impersonating Alibaba developer tools that deliver a cross-platform RAT with remote control and data-theft
Poisoned Xanadu mrmustard Package Steals SSH Keys and AWS Credentials
August 4, 2026
Threat actors poisoned Xanadu’s mrmustard 0.7.4 on PyPI with an info-stealer that exfiltrates SSH keys and AWS credentials from research
FaceHugger Flaws in Hugging Face Diffusers Bypass trust_remote_code
August 3, 2026
FaceHugger flaws in Hugging Face Diffusers bypass trust_remote_code and let malicious model repositories execute arbitrary code when models are loaded.
Hackers Poison Adform Script to Rewrite Crypto Wallet Addresses
August 3, 2026
Attackers tampered with Adform’s trackpoint script, rewriting crypto wallet addresses across customer pages to divert payments to attacker-controlled wallets.
Wiz CosmosEscape Chain Exposed Azure Cosmos DB Tenant Keys
July 31, 2026
Wiz researchers showed an Azure Cosmos DB Gremlin sandbox escape could expose a platform-wide signing key that unlocks any tenant
AnySign4PC Zero-Day Watering Holes Hit 72 South Korean Organizations
July 31, 2026
A state-sponsored campaign used hacked South Korean websites to exploit an AnySign4PC zero-day and infect visitors with SIGNBT and COPPERHEDGE
Claude Models Breached 3 Real Firms During Anthropic Cyber Tests
July 31, 2026
Anthropic said Claude models breached three real organizations during evaluations, including publishing PyPI malware that stole a security vendor’s credentials.
Copilot for Word Copy-Paste Attack Still Exploitable
July 31, 2026
Researcher Håkon Måløy showed hidden Word prompts can make Microsoft Copilot alter figures and propagate instructions into new documents despite
Amazon Ties Debug, Chalk npm Hijacks to North Korean Group
July 30, 2026
Amazon attributed debug and chalk npm hijack to North Korea’s Sapphire Sleet, elevating a supply chain attack previously seen as
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.