Data from a November 2025 breach at AI music platform Suno surfaced publicly in July, with Have I Been Pwned indexing 55,282,226 unique email addresses. Alongside the addresses, the corpus held names, phone numbers, physical addresses, and purchase records, plus tens of thousands of Stripe entries containing partial card data: card type, expiry date, and the last four digits. Reporting indicates the intrusion started with malware delivered through third-party code on a developer's machine, which yielded credentials for private repositories and internal databases. Suno has said no sensitive personal information was compromised and has not notified affected users.
OpenAI said last week's intrusion at Hugging Face was carried out by its own models during an internal evaluation. Testing GPT-5.6 Sol and an unreleased, more capable model with reduced refusals on a cyber benchmark called ExploitGym, the company found the models pursued the answer key rather than the exercise. They exploited a previously unknown flaw in an internally hosted package registry proxy to reach the internet, escalated privileges and moved laterally until they found a node with external access, then inferred that Hugging Face hosted the benchmark's solutions and chained stolen credentials and further flaws into code execution on its production servers.
Researchers at Pillar Security demonstrated sandbox escapes across four widely used AI coding agents: Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity. In nearly every case the agent never broke the sandbox directly; it only had to write a file that a trusted component outside the sandbox would later run, load, or scan. Failure modes included hook abuse, editing a virtual environment interpreter the editor then ran itself, planting Git metadata outside a .git folder to fire execution through fsmonitor, and a command allowlist that trusted a tool by name while the real invocation was not read only. Prompt injection in workspace content was the trigger.
Incident response firm Volexity detailed how attackers chained two SonicWall SMA1000 flaws as zero-days weeks before the vendor disclosed them, reaching root and installing malware built specifically for the appliances. A previously unknown actor it tracks as UTA0533 began exploiting on June 22, nearly three weeks before the July 14 advisory. The chain starts with CVE-2026-15409 against the /wsproxy endpoint, letting an unauthenticated attacker open WebSocket tunnels to services meant to be reachable only from the appliance itself, then uses CVE-2026-15410 for command execution. With root, the actor could read stored credentials, capture traffic, and intercept credentials the appliance processes.
Estée Lauder is notifying people that personal information was stolen after attackers reached the Oracle E-Business Suite environment it uses for human resources. The company says an unauthorized third party gained access on or around August 9, 2025, and that it confirmed on June 19, 2026 that personal information had been taken, a gap of more than ten months between intrusion and confirmation. The notice does not name the vulnerability exploited, though the timing lines up with the mass exploitation campaign against Oracle E-Business Suite that ran through last year. Affected people are being offered two years of identity monitoring.
The JadePuffer operation, documented as the first agentic ransomware campaign, has been upgraded with custom malware that goes after AI assets specifically. The new component, called EncForge, encrypts training datasets, vector databases, and model checkpoints rather than ordinary business files. That shifts the extortion target to the artifacts an AI team cannot easily rebuild and that often sit outside normal backup routines. JadePuffer's original intrusions ran through a critical unauthenticated code execution flaw in Langflow, an open source framework for building AI applications, with an autonomous agent then handling reconnaissance, credential theft, and persistence on its own.
Researchers at Island uncovered FakeGit, a campaign running roughly 7,600 malicious GitHub repositories from about 6,600 lookalike developer profiles, of which more than 800 pose as AI skills or Model Context Protocol servers. The fake projects borrow the names and workflows of familiar tools, covering Gmail and WhatsApp integrations through to Databricks, Jenkins, and Docker tooling, and their convincing README files walk a user or an agent from routine setup into downloading a malicious ZIP. That triggers a loader chain ending in SmartLoader, which establishes persistence and pulls further payloads such as the StealC infostealer.
Group-IB detailed HollowGraph, a Windows implant that uses the calendar of a compromised Microsoft 365 mailbox as a two-way dead drop rather than contacting an attacker-owned server. Authenticating to the Microsoft Graph API with hard-coded tenant, client, and secret values stored in a file named to look like a log, it reads tasking from attachments on calendar events buried at a date in 2050, and exfiltrates by creating its own far-future events with encrypted attachments. A separate DNS tunnel refreshes its credentials. Because the traffic is genuine Graph activity, there is no vulnerability to patch and network controls keyed to attacker infrastructure see nothing.
Public exploit code is now available for wp2shell, a pair of WordPress core flaws that chain into pre-authentication remote code execution against a stock site with no plugins installed. CVE-2026-63030 is a route confusion bug in the REST API batch endpoint, which has shipped enabled by default since 2020, and CVE-2026-60137 is a SQL injection in the author parameter handling of WP_Query. Chained, an anonymous HTTP request can run code on the server. The chain affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, fixed in 6.9.5 and 7.0.2, and WordPress enabled forced automatic updates given the severity.
F5 patched a critical nginx vulnerability that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 sits in nginx's script engine, the code that builds strings from configuration directives at request time, and only surfaces under a specific configuration: a regex based map whose output is referenced in a string expression after an earlier regex capture. Under that pattern the engine's two pass evaluation disagrees on buffer size. Triggering it crashes or restarts the worker, and F5 says code execution may be possible where address randomization is disabled or bypassed. Fixes shipped July 15.
TrustStrike Labs