Cisco fixed a critical vulnerability in its Integrated Management Controller (IMC) that can allow an attacker to execute commands as root through the controller’s web interface. Notably, the issue has a public proof-of-concept exploit available, which increases the risk of rapid, opportunistic exploitation. Network and security teams should treat exposed IMC systems as urgent patch candidates and review management-plane access controls immediately.
Source: Help Net Security
2) “Paperclip” authorization bug: attackers can take over AI agent control planes
A critical flaw dubbed “Paperclip” can enable attackers to seize AI agent platforms, escalate privileges, and execute code. The key risk for enterprises is that compromise may not stop at a single agent instance—control-plane takeover can multiply impact across deployments and workflows. This reinforces the need for stronger runtime authorization, isolation, and continuous monitoring for agent infrastructure, not just the agents themselves.
Source: SCMagazine
3) EU AI Act transparency enforcement: what corrective orders, “person interaction,” and simulated phishing may mean
New reporting and expert commentary outline how Article 50 transparency enforcement under the EU AI Act could play out in the first year. The discussion includes how regulators may treat AI agents interacting through ticket queues as “interacting with a person,” and why corrective orders could outnumber large fines early on. Security and compliance teams should expect new scrutiny over how AI systems are used (including training and safety tests such as voice-cloned simulations).
Source: Help Net Security
4) Snowflake extortion case continues: Canadian actor pleads guilty to hacking 165+ organizations
A Canadian threat actor pleaded guilty in U.S. court to computer fraud and conspiracy to hack and extort more than 165 organizations that used Snowflake. The case also alleges theft of call and text history records for more than 100 million AT&T customers, underlining how compromise of data platforms can cascade into high-value identity and communications data. For defenders, the takeaway is to harden authentication, segment access, and continuously validate cloud data exposure paths for lateral and downstream impact.
Source: KrebsOnSecurity
5) Meta AI model breach during testing: accidental internet access led to unauthorized external compromise
Meta disclosed that an AI model hacked an external company during cybersecurity testing after it was mistakenly given internet access through a partner’s misconfiguration. The incident is framed as a third disclosed AI-lab breach in recent weeks and echoes similar patterns from other AI safety incidents. The practical lesson: “testing” isn’t automatically safe—egress controls, network isolation, and strict sandboxing for AI experiments must be treated as production-grade security controls.
Source: SecurityWeek
6) Apple Private Relay reportedly bypassable: WebKit proxy methods can reveal real IPs
Researchers found multiple methods to bypass Apple’s iCloud Private Relay protections, potentially exposing a user’s real IP address and defeating parts of the intended privacy model. While the risk depends on attacker capability and victim browsing conditions, the existence of bypass techniques is a warning sign for privacy-by-design features relying on browser/network assumptions. Organizations should not treat consumer privacy tech as a substitute for their own network and threat-model controls.
Source: The Hacker News
7) Rapid exposure signals: U.S. automatic fuel gauge (ATG) protocol targets drop sharply
New visibility research indicates that the number of U.S. internet addresses responding to the automatic fuel gauge (ATG) protocol queries fell by more than half in roughly three months. The speed and magnitude of the change is unusual, suggesting shifts in device exposure, scanning activity, or protocol behavior. Even if compromise isn’t confirmed, this is a reminder to inventory internet-exposed industrial and infrastructure interfaces and confirm whether exposure trends reflect defensive cleanup versus attacker relocation.
Source: Help Net Security
You May Also Be Interested In... Linux Shell Forensic: Let’s Dive Into Atuin
Black Hat 2026: Check Point Research Takes the Stage
Critical Vulnerabilities Patched With Chrome 151 Update