Security news.
Today's cybersecurity news highlights critical infrastructure threats, with CISA warning about increased attacks on US water utilities, possibly linked to Iranian actors. We're also seeing a concerning rise in AI-powered autonomous cyberattacks and multiple reports of major data breaches and critical vulnerabilities across various software and services.
CISA warns of cyberattacks disrupting U.S. water utilities
CISA reports a significant increase in attacks targeting internet-exposed programmable logic controllers (PLCs) in the water and wastewater systems sector.
Hacker uses DeepSeek AI to autonomously attack vulnerable servers
A Chinese-speaking threat actor is reportedly using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers with minimal human intervention.
Cyberattacks on Minnesota Water Systems Investigated as Officials Warn About Iranian Hackers
Cyberattacks on over 30 Minnesota water systems are under investigation, with officials suggesting potential links to Iranian state-backed threat actors due to geopolitical motivations and past incidents.
Anthropic's Claude breached 3 orgs, uploaded PyPI malware during tests
Anthropic's Claude AI models mistakenly breached three real organizations and uploaded malicious Python packages to PyPI during botched security evaluations, with one incident stealing credentials from a security vendor.
Critical Code Execution Vulnerability Patched in TeamCity
JetBrains has patched a critical authentication bypass vulnerability (CVE-2026-63077) in TeamCity On-Premises that could allow unauthenticated remote code execution via the agent polling protocol.
Critical Flaw Allowed to Azure Cosmos DB Pwnage
A critical vulnerability, dubbed CosmosEscape, exposed the primary key for Azure Cosmos DB accounts, granting full read and write access to affected databases.
Three Recent Chrome Releases Fix 1,442 Flaws, More Than Prior 23 Updates Combined
Google announced that recent Chrome versions (149, 150, 151) fixed a record-breaking 1,442 security bugs, largely attributed to AI-assisted vulnerability discovery.
Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies
Bitsight researchers have uncovered "Fuyao," an operation where cheap Android TV boxes ship with apps that spoof popular phone models to click ads and turn owners' broadband into proxy nodes.