I go through about 25 cybersecurity news portals and blogs every week and pull out the most interesting stories. Then I turn them into this short, digestible summary, so you can stay up to date without trying to follow 25 different sources yourself. 😱

My aim is to create a summary that gives you the gist without needing to open up the source article. But if you do want to dig deeper, all the sources covering the event are linked below each story.

If you enjoy these, come back next Monday

scroll to the bottom to subscribe to the e-mail newsletter.

TrojPix exfiltrates data from air-gapped PCs by creating a crude radio antenna from the attached HDMI cable

Researchers found a way to steal data from air-gapped computers (machines deliberately kept off any network for security), using a trick called TrojPix. Malware already sitting on the machine flickers on-screen pixels in a specific pattern. Because video cables carry fast-changing electrical signals, they naturally leak a little radio energy, like turning the HDMI cable into a crude, unintentional radio antenna. Someone outside with a radio receiver can pick up that leakage and decode it back into stolen data. Researchers’ test show, the data can be “picked up” as far as 208 meters away, and at speeds fast enough to move large files quickly, all without anything looking different on the screen.

Key Details

  • The channel exploits TMDS signaling used by HDMI-class video interfaces, turning ordinary copper video cables into unintended antennas via controlled pixel changes.
  • TrojPix runs in user mode without admin rights or hardware modifications; it reads display parameters and transmits via a visually camouflaged “attack video.”
  • The researchers showed two modes: Fake Screen-Off Mode (dark display while transmitting, stopping on mouse movement) and Foreground Embedding Mode (embedding data into normal on-screen content).
  • Across nine monitor brands and fifteen video cables, the reported bit-correct rate was ~99%, reaching 100% with forward error correction; performance also held up through a 30‑cm concrete wall in testing.
  • Receiver-side validation used commercial radio gear (USRP X310 SDR with a directional antenna and low-noise amplifier) to capture and decode the emissions.

Read more at Cyber Security News, The Hacker News

Sainsbury’s expands live facial recognition to up to 200 UK stores, citing shoplifting deterrence

Sainsbury’s said it will expand live facial recognition across its supermarkets to up to 200 stores by the end of 2026 as part of efforts to deter shoplifting. Privacy campaigners say the rollout is a major escalation in retail surveillance and point to cases where shoppers have had to contest being flagged or confronted due to misidentification.

Key Details

  • Sainsbury’s said more than 55 stores already use the system, after trials starting in September 2025 and a wider deployment across London earlier in 2026.
  • The supermarket claims 90% of people identified by the system did not return to the store.
  • The technology is provided by Facewatch, which also supplies other UK retailers including Budgens, Costcutter, Southern Co-op, Spar, B&M, and Sports Direct.
  • Big Brother Watch says it is receiving more reports from shoppers trying to clear their names after facial recognition mistakes and urged customers to shop elsewhere.
  • A cited example involved a shopper being wrongly ejected from Sainsbury’s Elephant and Castle store after staff responded to an alert for a different person on the watchlist; Sainsbury’s said it apologized and would further train staff, describing it as a staff-response issue rather than a technology fault.

Read more at The Register

OpenAI org invitations abused for “poisoned tenant” data-harvesting via legitimate [email protected] emails

Attackers are using OpenAI’s organization invitation workflow to trick targeted employees into joining attacker-controlled ChatGPT tenants, where future prompts, uploads, and API activity could be exposed to the attacker. The invites arrive as authentic OpenAI notification emails (passing standard email checks), and acceptance can be effectively one-click, making the technique hard to catch with traditional phishing defenses.

Key Details

  • The invitation messages originated from OpenAI’s legitimate notification system ([email protected]) and appeared identical to normal collaboration invites.
  • OpenAI’s email included a subtle warning that the inviter’s domain (e.g., gmail.com) did not match the recipient’s corporate domain, but the rest of the email looked routine.
  • Push Security’s investigation found that accepting the invite was instant with no additional authentication step, even from a separate browser session not already logged into ChatGPT.
  • Inside the fake organization, the attacker impersonated a company executive and granted invited users “Owner” privileges, and a credit card was attached to billing to reduce friction and look legitimate.
  • Push Security notes the “poisoned tenant” payoff is long-term harvesting of sensitive work done in the tenant (prompts, uploaded data, and potentially activity via integrations), rather than immediate credential theft.

Next Steps

  • Make sure everyone knows which AI providers are allowed and used in the organisation and spread awareness of this novel type of an attack.

Read more at ⭐️ Push Security, Cyber Security News

Self-extracting “agent skills” evade static malware scanners for Claude Code and OpenAI Codex while keeping payloads intact

Researchers showed that malicious add-on “skills” for AI coding agents can be systematically modified to bypass static skill scanners without breaking the malware’s behavior. The work demonstrates that skills—which run with the same privileges as the agent—can be a practical delivery vehicle for credential and data theft when marketplaces and pre-install scanners are the primary gatekeepers.

Key Details

  • The study evaluated eight widely used skill scanners against 1,613 real malicious skills collected from the ClawHub marketplace.
  • The evasion toolkit (“SkillCloak”) uses structural obfuscation to rewrite suspicious strings/commands into semantically equivalent forms that dodge pattern-based detection.
  • A more effective method, self-extracting skill packing, hides the payload in locations scanners typically skip (e.g., ignored directories) and reconstructs it only at runtime.
  • In testing, packing defeated every scanner more than 90% of the time (and often >99%), while structural obfuscation exceeded 80% bypass on most scanners.
  • The researchers’ defensive prototype (“SkillDetonate”) runs skills in a sandbox and monitors OS-level behavior (file/network/data movement), catching the majority of malicious skills including cloaked variants.

Next Steps

  • If your devs use agent skills, disable or tightly gate auto-install/auto-run of unvetted skills and require review/approval before use (treat them like third-party code packages).
  • For internal marketplaces/CI checks, add a detonation step (sandbox execution + behavior monitoring) rather than relying solely on static scanning for skill packages.
  • Where possible, run AI coding agents with constrained access (limit reachable folders, secrets stores, and connected accounts) so a malicious skill has less to steal.

Read more at Original Science Paper, The Hacker News, Cybersecurity News, Wired background piece

Misconfigured Gemini Live integrations can be jailbroken to do whatever a user wants

A flaw in some browser-based Gemini Live integrations lets any self-registered user redefine their own session’s rules — changing the model/system prompt and enabling tools like code execution. All it takes is intercepting your own token-mint response (e.g., via a proxy tool or browser network inspector) and connecting directly to the WebSocket with a custom setup frame; because the backend never told Google’s servers what that user was allowed to do, this lets users run up the app owner’s bill via unrestricted usage. Google’s own example server code omits the needed constraint field by default.

Key Details

  • In Gemini Live browser integrations all setup-frame fields are optional, so anything not locked by the backend (notably model, system instruction, and tools) remains client-controlled for the session.
  • Google’s reference repo (google-gemini/gemini-live-api-examples) ships a server.py that mints tokens with uses/expire fields but omits live_connect_constraints, causing unconstrained tokens by default if copied as-is.

Next Steps

  • If you used Google’s example server, audit and patch server.py-derived token creation to add constraints before issuing any new browser-facing ephemeral tokens.

Read more at ⭐️ Alvin Ferdinasyah, Cyber Security News

Opera GX fixed a zero-click bug that let websites auto-install “GX Mods” and leak data via browser-wide CSS

Researchers found that a malicious website could silently auto-install an Opera GX “GX Mod” (.crx) with no user approval, then use the mod’s universal CSS injection capability to infer and exfiltrate data from pages the victim visits. In a proof-of-concept, CSS-based XS-Leak techniques reconstructed a logged-in user’s Gmail address from a single visit by triggering attacker-controlled network requests when selectors matched page content.

Key Details

  • Fixed in Opera GX 130.0.5847.89 (no CVE); Opera said it found no evidence of exploitation in the wild.
  • Attack hinges on GX Mods installing automatically when a .crx is fetched, enabling a drive-by install (e.g., via a hidden iframe) and leaving only a notification bar with a “Remove” button.
  • Mods can’t run JavaScript or request permissions, but their CSS applies to all sites, turning the feature into “universal CSS injection” rather than same-page CSS injection.
  • The PoC used ~150,000 CSS rules to test 3-character “trigrams” and reconstruct the target string from overlapping matches; a 4-character approach reportedly required millions of rules and was too large to process reliably.
  • Researchers also described a crash/DoS condition when triggering .crx installation in private browsing mode, causing the browser to crash and terminate sessions.

Next Steps

  • Verify Opera GX is updated to 130.0.5847.89 or later

Read more at Cyber Security News, The Hacker News, zhero-web-sec

UK NCSC outlines ‘Cyber Shield’ blueprint for agentic AI that can find—and eventually fix—vulnerabilities across government and critical infrastructure

The UK’s National Cyber Security Centre (NCSC) and DSIT published a blueprint for Cyber Shield, a national-scale cyber defence concept that would use paired “red” and “blue” agentic AI to probe for weaknesses and defend systems in real time across government and critical national infrastructure. The plan is framed as a response to AI-enabled attackers compressing recon and vulnerability discovery from weeks to minutes, with Cyber Shield intended to scale defensive actions to “machine speed.”

Key Details

  • Cyber Shield is described as a “national scale, sovereign defense capability” intended to operate collaboratively across organisational boundaries while remaining under the control of system owners.
  • The model envisions paired ‘red’ and ‘blue’ AI agents: “red” agents identify weaknesses, while “blue” agents defend and (over time) move toward automated remediation.
  • NCSC says Cyber Shield requires six core functions, ranging from automated network scanning (partially available today) to fully autonomous vulnerability fixing (not currently available).
  • The rollout approach is “test, iterate, scale”, starting with network defenders in government and critical UK sectors, with an intent to later transition capabilities into commercially scalable solutions.
  • NCSC explicitly invites academia, critical infrastructure operators, frontier AI labs, and the cyber defence sector to engage and help develop the blueprint; no program timeline was provided.

Read more at ⭐️ NCSC, The Record

CISA reportedly uses Anthropic’s Mythos AI model to scan federal code repositories for vulnerabilities

CISA’s Attack Surface Evaluation team is reportedly using Anthropic’s Mythos model to audit federal government code repositories for security flaws at scale. Early results reportedly found numerous issues, reflecting a shift toward AI-assisted validation for proactive vulnerability discovery.

Key Details

  • Reuters reported the effort focuses on scanning internal software systems for exploitable flaws that could be used by foreign intelligence services or cybercriminal groups.
  • The initiative is being run by CISA’s Attack Surface Evaluation team, which conducts penetration testing and security assessments across federal infrastructure.
  • Sources said the AI-assisted audits have already uncovered a significant number of vulnerabilities, but specifics on impacted systems and severity were not disclosed.
  • Reuters said it remains unclear how extensive the scanning is or how much government code has been analyzed to date.

Read more at Cyber Security News, Reuters

GitLost prompt injection lets unauthenticated GitHub Issues trigger AI workflows to leak private repo data

Researchers showed that a single GitHub Issue in a public org repo can prompt-inject GitHub Agentic Workflows into exfiltrating content from private repositories, without compromising any account or exploiting a traditional software bug. The weakness comes from agentic workflows mixing untrusted, attacker-supplied text (issue content) with system instructions while the AI agent holds cross-repository read permissions.

Key Details

  • The vulnerable pattern was an agentic workflow that triggers on issues being assigned, reads the issue title/body, and posts an automated comment while running with read access to other org repositories (including private ones).
  • Noma’s proof-of-concept used plain-English instructions embedded in the issue body to get the agent to fetch and disclose repository data via a public comment.
  • The PoC demonstrated leakage of private repository content (e.g., README data) alongside public repo content, visible to anyone who could view the issue thread.
  • Noma reported that certain phrasing (e.g., adding “Additionally”) helped bypass existing guardrails meant to prevent this type of disclosure.
  • GitHub told Noma it updated documentation related to creating the workflow configuration that enabled the issue, and Noma said the problematic guidance was no longer present when they last checked.

Next Steps

  • Audit GitHub Agentic Workflows for cross-repo permissions and remove org-wide/private-repo read access unless it is strictly required for the workflow’s job.
  • Do not let agents treat issue/PR text as executable instructions: isolate untrusted user content from system prompts and avoid workflows that automatically act on or repost data derived from attacker-reachable text.

Read more at ⭐️ Noma Labs, Dark Reading, Cyber Security News, SiliconANGLE, Hackread, CSO Online, SecurityWeek, The Hacker News, CSO Online

Unpatched Microsoft Edge UAF (CVE-2026-57992) enables remote code execution via crafted webpage and autofill-trigger gestures

Microsoft disclosed CVE-2026-57992 in Chromium-based Edge, where a use-after-free memory bug can be exploited to achieve remote code execution if a victim visits a specially crafted webpage. Exploitation requires user interaction (two sequential tap gestures that trigger autofill), and no patch or public PoC was available at the time of publication.

Key Details

  • The issue is tracked as CVE-2026-57992 with a CVSS score of 7.5 (High).
  • The attack is network-based and relies on social engineering to lure a user to an attacker-controlled site.
  • Successful exploitation requires the victim to perform two tap gestures that activate Edge’s autofill, which triggers the memory corruption chain.
  • If exploited, the attacker can execute arbitrary code in the context of the browser process, which could be used as an entry point for follow-on activity.

Next Steps

  • Enable Enhanced Security Mode in Microsoft Edge where feasible as a compensating control until a patch is available.

Read more at Cyber Security News

Node.js debates making lower-severity security reports public to reduce private triage overload amid AI-generated submission surge

A Node.js Technical Steering Committee proposal would route most lower-severity security reports through a public workflow, keeping private embargo handling for only higher-severity cases that clearly need coordinated disclosure. The change is being discussed as maintainers report a sustained increase in similar, AI-assisted HackerOne submissions that they say overwhelms current intake and escalation paths.

Key Details

  • In an April Collaborator Summit session, maintainers cited 65 HackerOne reports in the most recent month (versus 252 submissions over the last two years) and said pausing bounty payouts did not meaningfully reduce submissions.
  • Maintainers say prior intake changes (higher-signal requirements, tightened scope via threat modeling, automated closure of low-quality reports, and escalation via the OpenJS CNA) have not stopped overload, and that closed reports are now reappearing via escalation channels.
  • The rationale argues that widely available LLM-driven fuzzing/scanning makes many findings easy to reproduce on demand, weakening the value of keeping them confidential during a typical disclosure window.
  • Some maintainers warn the proposal may shift work from private triage to public PR/issue review, since the same limited set of collaborators still must validate, review, and coordinate releases.

Read more at Socket

CISA rotates all admin credentials after contractor exposed AWS GovCloud keys and IaC code in a public GitHub repo

CISA disclosed that a contractor copied internal build/deployment code and AWS GovCloud credentials into a personal public GitHub repository, prompting an incident response that removed the repo, reset access, and performed forensic review. Investigators found the leaked credentials were not used outside CISA environments and no customer or mission data was exposed.

Key Details

  • The exposed materials included Infrastructure-as-Code and build/deployment code plus admin and build credentials uploaded to a contractor’s personal GitHub account (not CISA’s official GitHub presence).
  • CISA tightened repository governance by tuning allow/deny lists and limiting users’ ability to upload to public code repositories, and plans to use EDR capabilities to help monitor/manage public-repo uploads.
  • CISA said unclear inbound reporting paths slowed initial escalation, and it is consolidating and publicizing clearer reporting channels, including use of security.txt.

Next Steps

  • Implement automated secrets scanning for public repositories and enforce controls that prevent sensitive uploads (e.g., policies/EDR controls on developer endpoints).

Read more at CISA, CyberScoop, Cyber Security News

Study finds 281 free Android VPN apps with traffic leaks, cleartext transfers, and ad tracking—some allow tunnel hijacking via unencrypted configs

An academic study of 281 free VPN apps on Google Play found widespread failures that expose or leak user traffic and identifiers, including DNS and browser traffic escaping the VPN tunnel and data being sent in cleartext. The most severe cases involved apps fetching VPN configuration files without encryption, enabling an on-path attacker (e.g., public Wi‑Fi) to modify the config and redirect the VPN connection to an attacker-controlled server.

Key Details

  • 29 apps leaked traffic outside the VPN tunnel, including 24 that leaked DNS requests (revealing visited domains), 6 that leaked browser traffic, and 4 that used unencrypted tunnels that exposed visited domains in packets.
  • 61 apps transmitted cleartext data across 10,552 observed flows, including web content and VPN-related resources, making it readable/modifiable by an on-path network attacker.
  • Five apps downloaded VPN configuration files over unencrypted connections, which the researchers used to demonstrate tunnel hijacking on controlled devices by rewriting configs in transit.
  • 246 apps contacted advertising/tracking URLs and 76 sent Android Advertising IDs, alongside other device attributes (e.g., model/OS/language/screen/country/IP) that can support fingerprinting.
  • OpenVPN configuration hardening was weak in 107 of 108 apps that included OpenVPN configs, with issues such as weak cryptography/authentication, outdated directives, or missing settings intended to prevent server impersonation/control-channel attacks.

Next Steps

  • Before using any VPN , vet them thoroughly. Remember, when something like VPN is free, there usually is a catch.

Read more at The Hacker News, Cyber Security News

U.S. Army subdomains defaced via 404 error-page hijacking; sites taken offline during investigation

Two U.S. Army subdomains showed politically themed messages after attackers hijacked the sites’ 404 (page-not-found) error handling to display defacement content rather than altering normal pages. The Army said the affected pages were on a legacy third-party platform not connected to its enterprise network and were removed while incident response continues.

Key Details

  • Defacements were observed on oil.army.mil and ai2c.army.mil, with messages including “FREE KURDISTAN” and insults directed at President Donald Trump and Ambassador to Türkiye Tom Barrack.
  • An Army spokesperson said the pages were hosted on a legacy, non-authoritative third-party platform not connected to the Army’s enterprise network, and that teams “took immediate action” to secure them.
  • Researcher Ronald Lovelace reported the affected sites ran on WordPress and Microsoft cloud infrastructure; the duration and full scope (including other subdomains) was not confirmed in the report.

Next Steps

  • Review your asset discovery and sunsetting processes, make sure legacy systems don’t get left behind and therefore lack proper security controls.

Read more at CyberScoop, Reddit

The European Parliament voted to extend an interim rule that lets large platforms voluntarily scan private messages for child sexual abuse material (CSAM), restoring legal cover after the previous authorization expired in April. The extension passed via an “absolute majority” procedural mechanism (counting absent lawmakers), even though more present MEPs voted against it than for it, and negotiations continue separately on a broader, permanent “Chat Control 2.0” framework.

Key Details

  • The extension runs until 2028 (or until a permanent replacement is adopted), after the prior 2021-era authorization lapsed in April due to political deadlock.
  • An amendment to require warrants for scanning failed despite receiving more votes in favor than against, because it did not reach the required absolute-majority threshold.
  • End-to-end encrypted services are described as exempt under the interim approach (sources cite Signal/WhatsApp as examples), while non-E2EE direct messages and some email/social platforms are in scope.
  • Examples of affected services cited include Discord, Skype, Instagram, Snapchat, Xbox messaging, Gmail, and Apple iCloud mail/content scanning contexts.
  • “Chat Control 2.0” discussions remain contentious, with critics warning proposals could expand scanning obligations (potentially including encrypted communications in the most extreme versions) while law-enforcement leaders argue detection/reporting is vital to protect children.

Read more at The Record, CSO Online, WIRED

Subscribe

Subscribe to receive this weekly cybersecurity news summary to your inbox every Monday.