Threat Library

Microsoft disclosed and patched a zero-day vulnerability in Microsoft Defender, dubbed 'RoguePlanet', following the June 2026 Patch Tuesday cycle. The vulnerability was actively exploited or publicly known prior to patch release, prompting an out-of-band advisory. Organizations relying on Defender for endpoint protection should prioritize patching to prevent detection evasion or compromise of protected hosts.

Hitachi Energy PROMOD V versions 1.0.10 and prior rely on insecure HTTP communication instead of HTTPS due to a lack of TLS support in the third-party Digipede grid server component. This flaw could allow an attacker with network access to intercept or manipulate data in transit, potentially leading to credential theft, session hijacking, or unauthorized access to industrial engineering workstations.

Composio SDK versions before 0.2.32-beta.283 fail to validate file paths in a file-upload tool, allowing an attacker who controls untrusted input (e.g., via prompt injection) to redirect the agent into reading and uploading sensitive local files such as SSH private keys to attacker-controlled storage. This is a realistic and impactful supply-chain/tool-layer vulnerability, not a speculative or low-severity issue.

Researchers demonstrate a structural flaw in the Model Context Protocol: the metadata a human approves in a tool-installation dialog is not guaranteed to match the bytes actually sent to the model. Using invisible Unicode TAG-block characters embedded in tool descriptions, an attacker can smuggle hidden instructions that a human reviewer never sees but that reach the LLM verbatim on every turn, and this was confirmed across three independent MCP server implementations. This is a research proof-of-concept, not an observed active exploit, but it identifies a reproducible, protocol-level weakness rather than a one-off bug.

A phishing campaign dubbed DEBULL abuses Microsoft's legitimate device-code authentication flow to hijack Microsoft 365 accounts, using collaboration-themed lures rather than fake login pages. Because the attack leverages the real Microsoft login experience and obtains valid OAuth tokens, it bypasses many traditional phishing detections and can persist beyond password resets. The campaign was active between late June and early July 2026, as reported by ZeroBEC.

Varonis researchers discovered a critical flaw in Google Dialogflow CX that allowed an attacker with edit access to one Code Block-enabled conversational agent to hijack other Code Block-enabled agents within the same Google Cloud project. Exploitation could expose live conversation data, steal user-shared information, and enable injection of attacker-controlled bot responses, including deceptive prompts to re-enter passwords. Google has since remediated the issue, but the flaw highlights significant multi-tenancy isolation risks in managed conversational AI platforms.

RedWing is a newly identified Android malware-as-a-service operation, rented out via Telegram for roughly $300/month, that allows low-skill attackers to take full control of victim devices, steal banking credentials, and intercept one-time passcodes (OTPs). Discovered by Zimperium's zLabs, it is believed to be a new variant of the Oblivion malware family, lowering the barrier of entry for widespread mobile banking fraud.

A hidden authentication backdoor has been discovered in multiple versions of Tenda router firmware, allowing attackers to gain unauthorized administrative access to the device's web management panel. This could enable full device takeover, traffic interception, and use of the router as a pivot point into internal networks.

Chinese state-linked threat actor UAT-7810 is deploying new malware dubbed LONGLEASH to expand an Operational Relay Box (ORB) network, primarily by compromising unpatched internet-facing Ruckus routers. The ORB network is used to anonymize and relay malicious traffic, complicating attribution and enabling downstream intrusion campaigns.

Accenture confirmed a security breach after a threat actor claimed to have stolen approximately 35 GB of source code and other internal data, subsequently offering it for sale on underground forums. As a major IT services and consulting provider, exposure of Accenture's internal source code and data poses downstream risk to its extensive client base across multiple industries.

Labcenter Proteus 9 (build 9.1_SP4_Build_42914), an electronic design automation tool used across critical infrastructure sectors, contains three high-severity memory corruption vulnerabilities including an out-of-bounds write, a stack-based buffer overflow, and a use-after-free. Successful exploitation requires local access and user interaction (e.g., opening a crafted file) but could lead to arbitrary code execution or information disclosure. No known public exploitation has been reported, and the vendor has released version 9.2 SPO to address the issues.

Hitachi Energy e-mesh EMS versions 4.1.6, 4.4.2, and 4.7.0 contain a heap-based buffer overflow vulnerability in the bundled NGINX ngx_http_rewrite_module (CVE-2026-42945), affecting NGINX v1.30.0 and below. Successful exploitation could crash the NGINX worker process (denial of service) and, under certain conditions where ASLR is disabled or bypassed, allow arbitrary code execution on the affected energy management system.

CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2026-55255, an authorization bypass in Langflow, a popular framework for building AI/LLM agent workflows. This is relevant to AI agent security because Langflow is used to construct agentic pipelines, and an authorization bypass could let attackers manipulate or hijack agent flows, credentials, or connected tools. The other two CVEs (JoomShaper and Joomlack) are unrelated CMS plugin vulnerabilities with no agentic relevance.

Researchers identify a new class of indirect prompt injection called Agent Data Injection (ADI), where attackers disguise malicious payloads as trusted metadata or tool-call context rather than as explicit instructions, causing agents to take unintended actions. This bypasses existing instruction-injection defenses and was demonstrated against real web agents (Claude in Chrome, Antigravity, Nanobrowser) and coding agents (Claude Code, Codex, Gemini CLI), leading to arbitrary clicks, remote code execution, and supply-chain risks. This is a credible, well-documented research finding with proof-of-concept impact against widely used production agents.

Canadian authorities arrested a 23-year-old Ottawa man alleged to be 'Dort,' the operator of Kimwolf, a fast-spreading IoT botnet responsible for large-scale DDoS attacks over the past six months. The suspect also allegedly conducted doxing and swatting campaigns against a journalist and a security researcher, and now faces criminal charges in both the U.S. and Canada. While the operator's arrest may disrupt operations, the underlying botnet infrastructure and malware may persist or be repurposed by other actors.

Attackers discovered and shared a method on Telegram to manipulate Meta's AI-powered support assistant into resetting passwords for high-profile Instagram accounts without proper identity verification. This led to the compromise and defacement of accounts belonging to the Obama White House and a senior U.S. Space Force official with pro-Iranian propaganda. The incident highlights how conversational AI agents deployed for customer support can be socially engineered into bypassing security controls.

A threat cluster linked to Iran's Ministry of Intelligence and Security (MOIS) has been observed using a previously undocumented modular command-and-control framework called Cavern (Cav3rn) to target Israeli IT providers and government organizations. Check Point Research attributes the activity to a state-sponsored espionage campaign aimed at establishing persistent access within high-value networks. The framework's modular design suggests ongoing development and long-term operational use by the threat actor.

Threat actors are impersonating corporate IT support staff over Microsoft Teams voice calls to socially engineer employees into installing the EtherRAT remote access trojan. Once installed, the malware grants attackers initial access to corporate networks, potentially enabling lateral movement, credential theft, and further compromise. This campaign leverages trust in internal communication tools rather than exploiting a software vulnerability.

A high-severity race condition vulnerability (CVE-2025-31115) in the XZ Utils liblzma multithreaded decoder affects multiple B&R Industrial Automation GmbH HMI/panel products, potentially causing crashes or memory corruption. The flaw stems from improper handling of invalid input in the lzma_stream_decoder_mt function, and has been patched in XZ Utils 5.8.1 with corresponding firmware updates from B&R.

The OpenAI Codex desktop app for macOS automatically fetched remote images referenced in Markdown model output, which an attacker could exploit via indirect prompt injection to leak sensitive session data (API keys, source code, tool outputs) to an attacker-controlled server. No user click was required, making exfiltration silent and automatic. This is a genuine, credible vulnerability with clear exploitation mechanics, though no in-the-wild exploitation has been observed.