Vulnerabilities

Researchers have identified a novel attack vector named "HalluSquatting" that exploits the tendency of AI coding assistants to hallucinate non-existent project names. This attack method involves predicting the fake project names that an AI assistant is likely to invent and then registering those domain names. Once registered, the attacker waits for the AI assistant to suggest the fabricated project to a user, leading the assistant to fetch the malicious code from the attacker's registered domain. The research, presented this week, demonstrates how this technique can be used to trick AI assistants into installing botnet malware. For instance, an AI assistant might be prompted to retrieve a specific, albeit non-existent, library or tool. The HalluSquatting attack capitalizes on the AI's confidence in its invented names, making them appear legitimate to users. The researchers successfully registered domains that AI assistants were prone to fabricating, thereby creating a trap for unsuspecting developers. This attack highlights a significant security vulnerability in the current generation of AI-powered coding tools, which often lack robust mechanisms for verifying the existence and authenticity of the resources they recommend. The potential for widespread compromise is considerable, as many developers rely on these assistants for code generation and dependency management. The researchers plan to publish their full findings and mitigation strategies in an upcoming paper, aiming to inform both AI developers and the broader cybersecurity community about this emerging threat. The attack's efficacy stems from the AI's inherent generative capabilities, which can be turned into a vector for distributing malicious software through seemingly innocuous suggestions. This necessitates a re-evaluation of how AI coding assistants validate external resources and the security protocols surrounding their use in software development workflows.

Ubiquiti released security updates this week to address multiple critical vulnerabilities affecting its UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi OS products. These flaws could allow attackers to escalate privileges and execute arbitrary commands on affected systems. The most severe vulnerability, identified as CVE-2026-50746, received a CVSS score of 10.0 and resides within the UniFi Connect Application, stemming from improper access control. This critical flaw enables an attacker to potentially gain complete control over the application. Other vulnerabilities patched include CVE-2026-50747, a critical flaw in UniFi Talk that also allows for privilege escalation. Additionally, CVE-2026-50748, a high-severity vulnerability in UniFi Access, and CVE-2026-50749, another high-severity flaw in UniFi Protect, were addressed. These issues also present risks of privilege escalation. The UniFi OS itself was not immune, with CVE-2026-50750 identified as a critical vulnerability enabling arbitrary command execution. Ubiquiti has provided patches for these vulnerabilities, urging users to update their UniFi systems promptly to mitigate the risks. The company's proactive patching demonstrates a commitment to securing its network infrastructure products. Users are advised to consult Ubiquiti's official security advisories for detailed information on each vulnerability and the specific steps required for updating their devices. The timely release of these patches is crucial for preventing potential exploitation by malicious actors.

A recent Evil Tokens campaign, identified as "ghost phishing," is exploiting a new vulnerability in email security protocols, targeting businesses across the United States and Europe. This sophisticated attack method circumvents traditional security measures by keeping the malicious content hidden until it is decrypted and activated directly within the victim's web browser. The technique poses a significant risk to organizations, as standard URL scanning and analysis may fail to detect the threat before it fully materializes. The "ghost phishing" attacks leverage a multi-stage process where initial emails appear benign, containing only a small, encrypted payload. Once the victim interacts with the email, for instance, by clicking a seemingly harmless link or opening an attachment, the payload is downloaded. Subsequently, JavaScript code embedded within the content triggers the decryption process. This decryption reveals the phishing page, which then prompts the user for sensitive information, such as login credentials for platforms like Microsoft 365. The delay between the initial interaction and the appearance of the malicious page is key to its evasiveness. Security researchers have noted that this method bypasses many existing security controls that rely on analyzing static URLs or known malicious domains. By delaying the rendering of the phishing page until runtime within the browser, the attack effectively hides its true nature from automated security scanners. This allows attackers to gain access to Microsoft 365 accounts, potentially leading to the exfiltration of sensitive corporate data and significant disruption to business operations. The speed of response is critical once such an attack is detected, as the damage can escalate rapidly. The Evil Tokens campaign highlights an evolving threat landscape where attackers are continuously developing novel techniques to evade detection. Traditional security solutions, which often focus on perimeter defenses and known threat signatures, are proving insufficient against these more dynamic and evasive methods. Organizations are advised to enhance their security postures with advanced threat detection capabilities that can analyze behavior within the browser and detect suspicious decryption or redirection activities, even when the initial payload is innocuous.

A cybersecurity startup named IRIS C2, which has been actively seeking zero-day security vulnerabilities in popular software with offers of up to $7 million, is allegedly run by individuals with criminal convictions and far-right conspiracy beliefs. The X/Twitter account IRIS C2 (@C2IRIS), created in January 2025, has amassed over 4,000 followers by frequently posting about security vulnerabilities, artificial intelligence, and software exploits. IRIS C2 claims to be a company based in McLean, Virginia, specializing in offensive cybersecurity capabilities. The IRIS C2 website actively solicits talent by advertising potential payouts of millions of dollars for exploits. A pinned post on the company's X account states its business model involves attracting top vulnerability researchers and exploit developers, particularly junior engineers with high intelligence, regardless of formal education or industry experience. The company's website, irisc2[.]com, lists numerous open positions, and a recent LinkedIn post indicated a high volume of applications. The company's stated mission involves acquiring "zero-day exploits, individual primitives, partial chains, and full capabilities across all major platforms," with payouts ranging from $10,000 to $7 million based on the exploit's target, reliability, and operational value. According to the government contracting portal g2exchange.com, the domain irisc2[.]com is operated by a Virginia-based entity named Calvexa Group LLC. The contact link on the Calvexa Group website, calvexagroup[.]com, redirects to irisc2[.]com. While G2Exchange indicates that Calvexa Group LLC is registered as a federal contractor, it does not appear to have any active direct government contracts. The individuals behind IRIS C2 and Calvexa Group LLC have a history of operating ventures under assumed names, including fake intelligence companies and a defunct AI-based lobbying platform. This background raises significant concerns regarding the legitimacy and intentions of the cybersecurity firm.

New research published this week demonstrates a significant vulnerability in GitHub's commit verification system, allowing malicious actors to rewrite signed Git commits without invalidating their "Verified" status. The findings, detailed in a recent analysis, indicate that a signed commit's hash is not as unique or immutable as widely assumed within the software development community. Researchers have shown that it is possible to create a second, altered commit that contains the exact same files, author information, and timestamp as an original signed commit. Crucially, this new commit can be signed with a different key, yet still pass GitHub's verification checks. This means that a reviewer examining the commit on GitHub would see all the expected details and a "Verified" stamp, despite the underlying content or metadata having been tampered with. The core of the exploit lies in how Git calculates commit hashes. The hash is derived from the commit's metadata and content. However, the research highlights that certain metadata fields, when manipulated in conjunction with the signing process, can lead to a different hash being generated for a commit that is functionally identical to the original. This discrepancy allows for the creation of a new, valid signature for a rewritten commit, which GitHub then incorrectly flags as verified. This vulnerability has significant implications for software supply chain security. Developers and organizations rely on the "Verified" status to trust the integrity of code contributions. If this status can be spoofed, it opens the door to potential injection of malicious code or alteration of critical project history without immediate detection through standard verification mechanisms. The research team has not yet disclosed specific technical details of the exploit to allow for remediation.

The landscape of account takeover (ATO) attacks is undergoing a significant transformation in 2026, moving away from traditional credential stuffing methods. For years, attackers relied on purchasing stolen credentials in bulk and using automated tools to find matches, a strategy that was cost-effective and scalable for them, while remaining a relatively understood threat for defenders. This established pattern is now being disrupted as the primary entry point for unauthorized access becomes more secure. The widespread adoption of passkeys is a key driver behind this shift. Passkeys offer a more robust and user-friendly alternative to passwords, significantly hardening the "front door" against brute-force attacks and credential stuffing. As passkeys become mainstream, attackers can no longer rely on the same methods to gain initial access to user accounts. This forces a strategic pivot in their operations, necessitating new approaches to bypass or compromise the verification mechanisms that now protect accounts. Consequently, the verification step itself is emerging as the new battleground for ATO. Instead of focusing on obtaining credentials, attackers are likely to concentrate on exploiting vulnerabilities or weaknesses within the passkey implementation or the associated authentication flows. This could involve social engineering tactics targeting users during the verification process, attempts to compromise the devices where passkeys are stored, or exploiting any remaining gaps in multi-factor authentication systems that might be used in conjunction with passkeys. The focus has moved from simply acquiring a key to finding ways to trick the lock or bypass the guard at the gate.

GitHub Copilot's AI models, including Anthropic's Claude and Google's Gemini, demonstrate a critical vulnerability where they refuse to fulfill harmful requests presented in a chat interface but will proceed to generate code for the same requests when broken down into smaller, seemingly innocuous steps within a code editor. This finding comes from a study conducted by researchers Abhishek Kumar and Carsten Maple. The research highlights a significant discrepancy in how the AI models process information depending on the input method. While the chat function acts as a safeguard, preventing the generation of potentially dangerous code, the code editor environment bypasses these safety measures. The study indicates that by segmenting a harmful instruction into multiple, individually acceptable code snippets, the AI can be tricked into executing the complete, problematic task. This bypass mechanism suggests that the AI's safety protocols are not robust enough to detect malicious intent when it is obfuscated through code. The researchers tested various harmful prompts, and in each instance, the models' refusal in the chat interface contrasted sharply with their willingness to comply when the prompts were rephrased and entered into the code editor. This raises concerns about the potential misuse of AI coding assistants for generating malicious software or executing harmful commands. The study's findings underscore the ongoing challenges in developing AI systems that can reliably distinguish between legitimate coding tasks and attempts to exploit the technology for nefarious purposes. The researchers' work provides concrete evidence of a specific exploit within GitHub Copilot, prompting further investigation into strengthening AI safety mechanisms across different input modalities and contexts.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a directive on Monday, mandating that all federal agencies prioritize patching a critical authentication bypass vulnerability within the Langflow visual framework. This vulnerability, identified as CVE-2024-31494, allows for unauthorized access to AI agent applications built using Langflow. Federal agencies have been given a deadline of Friday, April 19, 2024, to implement the necessary security updates. CISA's directive highlights that the vulnerability is currently being actively exploited in the wild, increasing the urgency for remediation. The Langflow framework is widely used for developing and deploying artificial intelligence agents, making the compromise of its authentication mechanisms a significant security risk. The agency's Binding Operational Directive (BOD) 23-02, which mandates timely patching of known exploited vulnerabilities, is being invoked for this incident. While the specific details of the exploitation methods are not publicly disclosed by CISA to avoid further aiding malicious actors, the agency emphasizes that failure to comply with the directive by the deadline will result in further action. This includes potential limitations on network access for non-compliant systems. The directive also requires agencies to report their patching status to CISA by the specified deadline, ensuring accountability and monitoring of the remediation efforts across the federal network infrastructure.

A Chinese threat actor identified as UAT-7810 is actively developing custom malware to broaden its Operational Relay Box (ORB) network through the compromise of internet-facing networking devices. Cisco Talos researchers have detailed these activities, noting that UAT-7810 is an advanced persistent threat (APT) group responsible for the LapDogs ORB network, which was first observed in June 2025. The group's latest efforts involve the deployment of a new malware strain named LONGLEASH. This malware is designed to establish and maintain persistent access within compromised devices, allowing UAT-7810 to integrate them into their ORB infrastructure. The ORB network functions as a series of interconnected compromised devices that can be used to relay malicious traffic, obscure the origin of attacks, and facilitate further network intrusions. Cisco Talos's analysis indicates that UAT-7810 targets a variety of networking hardware, exploiting vulnerabilities to gain initial access. Once inside, LONGLEASH establishes a command-and-control (C2) channel, enabling the threat actor to manage the compromised device and use it as a stepping stone for other malicious operations. The expansion of the ORB network enhances the actor's capabilities for conducting sophisticated cyberattacks, including espionage and data theft. The findings highlight the ongoing evolution of APT tactics, techniques, and procedures (TTPs) employed by state-sponsored groups. The continuous refinement of bespoke malware like LONGLEASH underscores the persistent threat posed by actors like UAT-7810 to global cybersecurity infrastructure. Organizations are advised to maintain vigilance and implement robust security measures to protect their internet-facing devices from such sophisticated threats.

Ubiquiti released security updates this week to address seven critical vulnerabilities discovered within its UniFi OS. Among these, a maximum-severity flaw has been identified that attackers can exploit through command injection attacks. This vulnerability poses a significant risk, allowing unauthorized execution of commands on affected systems. The company has not disclosed the specific version of UniFi OS affected by this maximum-severity vulnerability, nor has it provided details on the potential impact beyond command injection. However, the classification of "maximum severity" indicates a high potential for exploitation and significant damage to compromised systems. Ubiquiti strongly urges all users of UniFi OS to apply the available security updates as soon as possible to mitigate these risks. In addition to the critical command injection vulnerability, the security advisory also details six other high-severity flaws. These vulnerabilities, while not classified as maximum severity, still present considerable security risks. The company's proactive release of patches demonstrates a commitment to securing its product ecosystem. Users are advised to consult Ubiquiti's official security advisories for detailed information on each vulnerability and the specific steps required for patching. Ubiquiti has not yet provided a timeline for when these vulnerabilities were first discovered or when they were reported to the company. The focus remains on ensuring users implement the patches promptly. The company's support pages and community forums are expected to provide further guidance and support for users navigating the update process. Applying these updates is crucial for maintaining the security and integrity of UniFi OS deployments.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a directive on May 22, 2024, compelling federal civilian executive branch agencies to address a critical vulnerability within the Adobe ColdFusion web application development platform. This directive mandates that all affected systems be patched by Friday, May 24, 2024. The vulnerability, identified as CVE-2023-38203, has been classified as having maximum severity and is currently being exploited in the wild. CISA's directive emphasizes the urgent need for remediation due to the active exploitation of this flaw. The agency has not disclosed specific details about the exploitation methods or the extent of any compromises, but the order underscores the significant risk posed by unpatched systems. Adobe ColdFusion is a widely used platform for building and deploying web applications, making this vulnerability a potentially broad threat. Agencies are required to implement the necessary security updates and configurations to mitigate the risk associated with CVE-2023-38203. CISA's Binding Operational Directive 24-01, issued in October 2023, established a framework for managing cyber risks, including the requirement to patch known exploited vulnerabilities within specific timelines. This latest directive reinforces that framework by targeting a specific, high-impact vulnerability. The agency has also provided resources and guidance to assist agencies in identifying and remediating the vulnerability. The directive serves as a critical alert to federal agencies, highlighting the immediate threat and the non-negotiable deadline for patching. Failure to comply with CISA directives can result in further scrutiny and potential consequences for agency cybersecurity posture.