Cybersecurity Newsfeed - 12/05/26

Cybersecurity Newsfeed

📅 12/05/26

🛡️ Vulnerabilities

• Google Researchers Identify AI-Assisted Zero-Day: A zero-day exploit for a popular web administration tool was developed with the help of AI. The flaw allows for remote code execution, granting attackers full control. This confirms that threat actors are successfully using LLMs to accelerate sophisticated exploit development. More info

• UK Companies House WebFiling Flaw: A security flaw in the WebFiling service exposed sensitive personal details of company directors. While now addressed, the exposure facilitates potential identity theft and corporate fraud. More info

  More info

🎯 Adversaries

• TeamPCP Compromises Checkmarx Jenkins Instance: Threat actors leveraged a misconfigured Jenkins server to gain unauthorized access to the app-sec firm’s internal infrastructure. Checkmarx confirmed the incident, noting that customer data and source code remained isolated and unaffected. More info

• Shadow Earth Focuses on Long-Term Espionage: Trend Micro analyzed this sophisticated group using custom modular malware and “living off the land” tactics to target manufacturing and technology sectors for intellectual property theft. More info

• TrickMo Malware Adopts TON Blockchain: The Android banking trojan now uses the decentralized TON blockchain for C2 communications, making it highly resilient against traditional takedowns and network filtering. More info

  More info

• North Korean “Laptop Farm” Helpers Sentenced: Two U.S. men were sentenced for helping North Korean hackers secure remote work at American firms using stolen identities, facilitating network infiltration and revenue generation for the regime. More info

• Cookie Thieves Target Developers: A campaign using session-hijacking malware is targeting developers to bypass MFA and steal trade secrets and source code from private repositories. More info

📈 Trends

• GenAI Phishing on Vercel: Hackers are exploiting Vercel’s infrastructure to host AI-driven phishing sites. These sites use AI to generate personalized content, bypassing traditional URL filters through the platform’s high reputation. More info

• LLMs and Text-in-Text Steganography: New research highlighted by Bruce Schneier shows how secret messages can be hidden within LLM-generated text by manipulating word choice, posing a challenge for DLP systems. More info

• SANS Reports Rise in ICS Scanning: The Internet Storm Center noted an uptick in malicious traffic targeting industrial control systems and legacy web applications, urging better log monitoring for reconnaissance. More info

• Critique of AI “Bug-Hunting Mythos”: curl creator Daniel Stenberg criticized Anthropic’s claims regarding AI vulnerability discovery, calling it a marketing stunt that lacks the practical depth for complex maintenance. More info

• Shift Toward “Assume Breach” Mindset: A BleepingComputer webinar emphasizes that prevention alone is insufficient, urging organizations to prioritize rapid detection and containment over perimeter defense. More info

💥 Breaches & Leaks

• SailPoint GitHub Repository Breach: Identity security firm SailPoint disclosed that attackers used stolen credentials to access its GitHub repositories. The company confirmed that development assets were accessed, but core products and customer data remain secure. More info

  More info

📚 Others

• Lyrie AI Joins Anthropic’s Cyber Verification Program: Lyrie AI will participate in the inaugural cohort to help establish rigorous security standards and guardrails for AI models to prevent misuse in offensive operations. More info

---

⬅ Back to Archive