Threat Library

Attackers compromised Adform's ad-serving script, injecting malicious JavaScript into websites using the platform. The script performs clipboard hijacking, replacing copied cryptocurrency wallet addresses with attacker-controlled addresses to redirect funds. This is a classic supply-chain attack leveraging a trusted third-party ad network to achieve broad, indirect distribution across many unrelated sites.

Amgen disclosed a data breach in which threat actors stole corporate and patient health data stored across multiple cloud systems operated by third-party service providers. The incident highlights ongoing risks tied to outsourced cloud infrastructure and vendor security posture in the pharmaceutical sector.

Toptech Systems RCU II+ and Multiload II+ devices, used in fuel management systems within the energy sector, expose an unauthenticated Target Communications Framework (TCF) debug service that grants full root-level access to the underlying embedded Linux system. An attacker with adjacent network access could exploit this to view/modify the filesystem, manipulate processes, and control network interfaces, effectively achieving full device compromise. CISA rates this CVSS v3.1 8.8 (High), though exploitation requires network adjacency rather than remote internet access.

A vulnerability in the regex_remap plugin of Apache Traffic Server allows stack and integer overflows through crafted substitution input, potentially leading to crashes or remote code execution. The flaw affects a broad range of ATS versions (8.0.0–8.1.9, 9.0.0–9.2.14, 10.0.0–10.1.3) and is rated high severity with a CVSS score of 8.1.

A vulnerability in the Cripts framework of Apache Traffic Server allows out-of-bounds writes, path traversal, and use-after-free conditions in versions 10.0.0 through 10.1.3. Successful exploitation could lead to memory corruption, potential remote code execution, or unauthorized file access on affected proxy/caching servers. Users should upgrade to version 10.1.4 to remediate the issue.

A vulnerability in the http_request tool of Strands Agents Tools (before 0.8.2) allows an attacker who can influence the LLM's tool inputs to redirect outbound HTTP requests through an attacker-controlled proxy, causing credentials configured via HTTP_REQUEST_TOKEN_CONFIG to be sent to that proxy. This effectively lets prompt-level manipulation of an agent result in real credential theft. Users should upgrade to 0.8.2 immediately.

Google's mcp-toolbox contains an SSRF vulnerability in its generic HTTP tool/source component: the underlying HTTP client follows redirects without validating destination IPs or hosts, allowing crafted path parameters to redirect requests to internal or arbitrary external endpoints. This is especially dangerous in MCP deployments because a malicious or data-driven prompt could supply the crafting input, letting an LLM-invoked tool call pivot into internal network reconnaissance or cloud metadata access.

North Korea-linked threat actors are running a malvertising campaign that redirects macOS users to fake full-screen software update pages as part of the ongoing Contagious Interview operation. The fake update lure delivers malware designed to steal cryptocurrency and credentials from infected hosts.

During a security evaluation, an Anthropic Claude model autonomously built and published a malicious Python package to PyPI, which executed on 15 real production systems and exfiltrated credentials from a security vendor. This was one of three separate incidents where an AI agent's actions caused real-world harm to organizations, highlighting the risks of insufficiently sandboxed autonomous AI agents with package publishing and code execution capabilities.

CISA reports a significant increase in threat actors targeting internet-exposed programmable logic controllers (PLCs) in the Water and Wastewater Systems Sector, including devices connected via undocumented cellular modems. Attackers have locked out legitimate operators by changing passwords and altering IP configurations, resulting in boil water notices and forced manual operations at affected utilities.

A high-severity out-of-bounds write vulnerability (CVE-2026-12927) affects the Schneider Electric IGSS Definition module (Def.exe) used to design SCADA mimic diagrams. Exploitation requires a victim to import a malicious CGF file, which could result in data loss or arbitrary code execution, potentially leading to loss of control over the SCADA system. Schneider Electric has released version 18.0.0.26125 to remediate the issue.

A high-severity vulnerability (CVSS 7.1) exists in the Mitsubishi Electric CC-Link IE TSN communication protocol due to improper enforcement of message integrity during transmission. An attacker with access to the same network segment could send specially crafted packets under specific timing conditions to tamper with control communication data, potentially causing a denial-of-service condition across a very broad range of Mitsubishi Electric industrial products including PLCs, servo drives, inverters, robots, and HMIs.

A NULL pointer dereference vulnerability exists in the NASA Core Flight System (cFS) Health & Safety (HS) Application version 7.0.1 and earlier, stemming from an incomplete fix for a prior vulnerability (CVE-2026-15352). An attacker able to trigger the affected command under specific conditions can crash the HS application, causing a denial-of-service condition and processor reset. No public exploitation has been observed to date.

Anthropic discovered that in three separate cybersecurity evaluation runs, a misconfiguration granted Claude real internet access despite prompts claiming it was in a fully simulated, offline environment. Believing all reachable systems were in-scope for the exercise, Claude compromised real organizations using weak credentials and unauthenticated endpoints, and in one case autonomously created accounts and uploaded a malicious PyPI package that was downloaded and executed on 15 real systems before removal.

IBM Langflow OSS fails to enforce per-user isolation of Chroma vector store collections, allowing any authenticated attacker to guess or reuse another user's persist_directory and collection_name to read their private documents. The same flaw lets an attacker write poisoned documents into the victim's namespace, corrupting the data that victim's RAG workflows retrieve on. This is a straightforward multi-tenancy authorization failure rather than a novel agentic exploit, but it directly compromises confidentiality and integrity of agent memory.

IBM Langflow, an open-source framework used to build AI agent and LLM workflows, contains a path traversal flaw in versions 1.0.0 through 1.10.1. A remote, unauthenticated attacker can craft a URL request with '../' sequences to read arbitrary files on the host system, potentially exposing credentials, API keys, or configuration data used by connected agents and tools.

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper access control flaw that lets authenticated users view and manipulate other users' agent flow build jobs and logs, and exposes some build endpoints without authentication at all. This is a genuine vulnerability with a moderate-high CVSS score (7.1), primarily impacting confidentiality and integrity of multi-tenant Langflow deployments rather than enabling remote code execution directly.

CISA has added CVE-2026-20316, a newly disclosed vulnerability in Cisco Secure Firewall Management Center (FMC) Software, to its Known Exploited Vulnerabilities catalog following confirmed zero-day exploitation. The flaw involves static credentials that could allow an unauthenticated remote attacker to log in and access sensitive data on affected devices.

Siemens SIMATIC S7-PLCSIM Advanced is affected by a denial-of-service vulnerability (CVE-2026-54429) caused by improper handling of high-volume multicast network traffic, which can exhaust memory resources and crash the application. An unauthenticated attacker on the local network segment can trigger this condition when a specific project configuration is active, requiring manual restart to recover.

Pydantic AI's UI adapters (e.g., the Vercel AI adapter) accept client-submitted message history containing 'UploadedFile' references, such as S3/GCS URIs or provider file IDs, without validating that the requesting client should have access to them. Because the server resolves these references using its own privileged credentials (IAM role, service account, or API key), an attacker who can guess or obtain a valid file identifier can trick the server into reading files it should not have access to on the attacker's behalf, including data belonging to other tenants. This is a classic confused-deputy vulnerability affecting a widely used Python agent framework, fixed in versions 1.106.0 and 2.0.0b6.