cybersecurityThursday, July 16, 2026
Today's cybersecurity news is dominated by the weaponization of AI agents: a jailbroken Gemini spun up a C2 server for a Russian fraudster in six minutes. Meanwhile, attackers are compromising update systems and hijacking government websites, showing how quickly old attack methods are getting AI upgrades.
The most striking story of the day shows how easily a jailbroken AI agent can become a full-fledged cybercrime tool.
A jailbroken Gemini agent did 90% of the work in a credential- and crypto-stealing attack, including spinning up a C2 server in six minutes. The human operator just managed the botnet migration and code writing, the AI did the rest.
Traceforce, a YC S26 startup, launched company-wide security monitoring for AI apps like ChatGPT and Claude. It discovers which apps are used and how they connect to data via MCPs, and released an open-source dynamic analysis tool.
CISOs are building a practical playbook to govern agentic AI as enterprises move from experimentation to deploying self-directed systems. It's a sign that security teams are trying to get ahead of the AI agent wave.
Two campaigns demonstrate how attackers are compromising trusted update channels and government infrastructure.
The HelloNet APT campaign compromised Russia's ViPNet update system to deliver previously unknown malware to large Russian organizations. It's a supply-chain attack on a security product itself.
Over 20 Brazilian .gov.br sites were hijacked to deliver malware via police-themed fake documents. The attackers used compromised email accounts that passed SPF, DKIM, and DMARC checks, making the campaign look legitimate.
Everyone else just set a datekaysec.spinsphere.xyz
Canary Tokens for Prompt Injection Detectionwww.hendryadrian.com
Cyber Dimension of India-Pakistan Rivalrystratheia.com
Next.js Enhances Security with Monthly Update Programcyberwebspider.com
AI Agents Vulnerable to New Data Injection Attackscyberwebspider.comIt lasted for over 237 days and 10,449 messages, and she's not alone: U.S. losses to romance scams hit $1.3 billion last year.
CVE-2026-47084: CWE-863 Incorrect Authorization in cyrusimap Cyrus IMAPradar.offseq.com
CVE-2026-47084 is a medium severity vulnerability in Cyrus IMAP through version 3.12.2 where the LOCALDELETE command bypasses access control list (ACL) checks. This allows an authenticated non-admin user to execute the admin-only LOCALDELETE IMAP command and delete mailboxes with
Chinese Customs Authorities Target Empty Shell Cross-Border E-Commerce Firms in Compliance Crackdownwww.chinatechnews.com
In an effort to clean up trade networks and tighten administrative oversight over fraudulent or non-compliant trade brokers, Chinese customs... Chinese Customs Authorities Target Empty Shell Cross-Border E-Commerce Firms in Compliance Crackdown comes via ChinaTechNews.com .
Cyber Attack on Romania Land Registry: Exposed Data for Salewww.news4hackers.com
Romania’s National Agency for Cadastre and Land Registration faced a cyberattack, causing the e-Terra platform... The post Cyber Attack on Romania Land Registry: Exposed Data for Sale appeared first on .
LegacyHive: A New Windows Zero-Dayxploitwire.com
A persistent security researcher has unveiled a local privilege escalation bug for Windows 11, raising questions about severity.
Is your data safe? The most high-profile leaks of 2025-2026 explainedpasswork.pro
16 billion leaked credentials. A €2.2–2.5 billion shutdown at JLR. One stale service account exposed data across four major firms. Here's what the biggest data breaches of 2025–2026 reveal about credential risk, and the six controls that would have stopped most of them.
The Biggest Data Breaches of 2026 So Far, Ranked by Impactwww.techrepublic.com
The biggest data breaches of 2026 so far, ranked by impact, with details on exposed data, affected users, and what readers should do next. The post The Biggest Data Breaches of 2026 So Far, Ranked by Impact appeared first on TechRepublic .
Russian trio indicted for allegedly running bulletproof hosting providers that spurred cybercrimecyberscoop.com
Officials accused three Russian nationals, Media Land and ML.Cloud of supporting cyberattacks spanning 21 U.S. states and other countries, resulting in losses surpassing $62 million. The post Russian trio indicted for allegedly running bulletproof hosting providers that spurred c
space exploration roundup
medical research roundup
geopolitics roundup
inspiration roundup
ethics roundup
economics roundup
