Organization

Security Affairs

1 mentions in 7 days · 11 in 30 days · 12 total · first seen Aug 12, 2026 · last 5d ago

Timeline12 articles

More Capable AI, Not Enough Guardrails

Former OpenAI and Anthropic researcher Jacob Coxon resigns, warning AI labs are racing toward superintelligence without mature safeguards.

Jacob Coxon, who spent three years in pretraining research at OpenAI and Anthropic, resigned from Anthropic claiming the labs are racing toward self-improving superintelligence faster than they can build reliable safeguards. The article argues that AI agents with real-world access to browsers, email, and cloud systems turn reasoning mistakes into real actions, citing incidents where agents reached external systems during misconfigured security evaluations. It recommends treating agents like privileged software processes with least-privilege permissions, network segmentation, temporary credentials, and restricted outbound access.

Security AffairsSep 10, 15:19 UTC · 5d agoAI safety & security

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 113

Routine Security Affairs malware newsletter index round 113 with no substantive article content beyond cookie consent.

This item is a Security Affairs newsletter roundup page (round 113). The captured text contains only cookie consent boilerplate and no article content.

Security AffairsSep 6, 08:29 UTC · 9d agoOther

Security Affairs newsletter Round 593 by Pierluigi Paganini

Security Affairs weekly newsletter round 593 linking to dozens of stories across breaches, ransomware, malware, APTs, and AI security news.

This is the weekly Security Affairs newsletter aggregation (round 593) with a list of headlines: Manchester Airports Group breach (8.8M people), Aurora ransomware targeting ESXi, active exploitation of PaperCut and SonicWall SMA 1000 zero-days, Chrome V8 zero-day patching, Pegasus spyware of Serbian activists, and DPRK APT activity against South Korea. It is an index page rather than a standalone story.

Security AffairsSep 6, 07:56 UTC · 9d agoOther

Security Affairs newsletter Round 592 by Pierluigi Paganini

Security Affairs newsletter Round 592 aggregates the week's top cybersecurity stories curated by editor Pierluigi Paganini.

Security Affairs published Round 592 of its newsletter curated by editor Pierluigi Paganini, aggregating recent cybersecurity news. The available page text contains only cookie-consent boilerplate and no specific incident details.

Security AffairsSep 5, 20:20 UTC · 10d agoIndustry

Extortion Group FulcrumSec Claims 86GB Manchester Airports Data Theft

Extortion group FulcrumSec claims stealing 86GB of Manchester Airports Group data, exposing 8.7 million customers' personal and booking details.

Manchester Airports Group disclosed a breach on August 27 affecting parking, lounge, Fast Track and WiFi registrations at Manchester, London Stansted and East Midlands airports, impacting 8.7 million customers, most exposed only email addresses. FulcrumSec claims it stole about 86GB via airport-specific Iterable API credentials exposed in client-side JavaScript, including a 21.5GB Manchester export with booking histories, marketing data and nearly 200,000 records on upcoming 2026 travel. BleepingComputer verified sample records against a real traveler's Fast Track history; MAG declined to address the group's specific claims. Researchers warn the combination of UK postcodes, vehicle registrations and booking details could enable convincing targeted phishing, and MAG says no payment card or banking data was exposed.

Security AffairsAug 30, 17:23 UTC · 16d agoData breach in the wild

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 112

Security Affairs publishes its 112th malware newsletter roundup covering recent malware and cybercrime developments.

This is the 112th installment of Security Affairs' recurring malware newsletter, which aggregates recent malware and cybercrime stories into a single roundup. The retrieved page text contains only cookie-consent boilerplate, so no specific malware families, campaigns or indicators are described in the available content.

Security AffairsAug 30, 12:31 UTC · 16d agoMalware

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 111

Security Affairs malware newsletter Round 111 roundup; the provided page text contains only cookie-consent boilerplate with no story details.

Security Affairs published Round 111 of its malware newsletter, a periodic roundup of recent malware coverage. The provided page text contains only cookie-consent language, so no specific stories, actors, or incidents can be extracted.

Security AffairsAug 23, 17:04 UTC · 23d agoMalware

Security Affairs newsletter Round 591 by Pierluigi Paganini

Security Affairs general newsletter Round 591 aggregates recent security news; the provided page text contains only cookie-consent boilerplate.

This general Security Affairs newsletter (Round 591 by Pierluigi Paganini, international edition) aggregates recent cybersecurity news. The provided page text contains only cookie-consent language, so the specific covered stories are unknown.

Security AffairsAug 23, 08:29 UTC · 23d agoIndustry

Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline

ThreatFabric identifies Manic, an Android banking fraud and spyware platform targeting Ukraine with offline Bluetooth/Wi-Fi Direct mesh exfiltration and device takeover.

ThreatFabric's Mobile Threat Intelligence team identified Manic, an Android malware active in the wild since at least February 2026 that combines banking fraud with surveillance and device-control capabilities. It monitors 169 Android apps including Ukrainian banks, government and eID services, messaging apps, crypto exchanges, and 2FA tools, using the Accessibility service as a classified UI keylogger and WebRTC for live screen viewing and remote control. A distinctive store-and-forward relay exfiltrates AES-GCM-encrypted data through nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, supporting chains of up to four hops when direct C2 is unavailable. A July update added stronger anti-analysis, in-memory DEX loading, lock-secret phishing to extract device PINs, and hiding from the app launcher.

Security AffairsAug 20, 18:03 UTC · 26d agoMalware in the wild

U.S. CISA adds a MLflow flaw to its Known Exploited Vulnerabilities catalog

CISA added actively exploited MLflow SSRF flaw CVE-2026-64849 (CVSS 9.3) to its KEV catalog; attackers are stealing cloud credentials from exposed instances.

CISA added CVE-2026-64849, a critical unauthenticated server-side request forgery in MLflow, to its Known Exploited Vulnerabilities catalog. The flaw affects MLflow versions before 3.15.0 and allows unauthenticated attackers to reach internal services including cloud metadata endpoints, exposing temporary cloud credentials. watchTowr observed in-the-wild exploitation exfiltrating credentials and secrets, plus widespread scanning of exposed MLflow instances within hours of the CVE's assignment on August 17, 2026. MLflow is an open-source platform for managing the machine learning and AI development lifecycle with over 60 million monthly downloads.

Security AffairsAug 20, 08:58 UTC · 26d agoExploit / PoC in the wildCVE-2026-64849

US Indicts 17 Iranians Over Years

US unsealed superseding indictment charging 17 Mabna Institute Iranians for IRGC-linked espionage stealing 31TB from universities, companies, and government agencies.

The Justice Department unsealed a superseding indictment charging 17 members of the Iran-based Mabna Institute, which conducted hacking campaigns since at least 2013 on behalf of the IRGC and other Iranian clients. The group compromised 144 US and 178 foreign universities, at least 42 US companies, and multiple government agencies, stealing over 31 terabytes of academic data and IP plus employee email inboxes. Hackers breached roughly 8,000 of 100,000 targeted professor accounts across 24 countries, selling stolen research through Megapaper.ir and Gigapaper.ir. Behzad Mesri, tied to the HBO breach and $6 million Bitcoin extortion, is among eight new defendants, and five defendants carry State Department Rewards for Justice bounties up to $10 million.

Security AffairsAug 20, 08:36 UTC · 26d agoThreat actor in the wild

CEVA Logistics Cyberattack Disrupts European Warehouses and Shipments

Cyberattack on CEVA Logistics disrupted eight European warehouses and exposed customer data of clients including Valve, Ajax, and De Bijenkorf.

CEVA Logistics, part of CMA CGM Group, suffered a July 29 cyberattack that disrupted eight European warehouses and halted shipments of stored goods. Customer data linked to Valve, Ajax, and Dutch retailer De Bijenkorf was exposed, potentially including names, contact details, and online order information; Valve said payment details and passwords were not accessed. No ransomware group has claimed responsibility and the company has not disclosed technical details. A database containing customer lists, shipping records, and banking details was reportedly later offered for sale on a dark web marketplace.

Security AffairsAug 12, 20:05 UTC · Aug 12, 2026Data breach in the wild

Related CVEsby mentions

CVE-2026-648499.316%
Unauthenticated SSRF in MLflow Exposes Cloud Credentials and Secrets
MLflow versions prior to 3.15.0 contain a server-side request forgery flaw (CWE-918) in the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint. The webhook URL is validated only for the original request, but delivery follows redirects and re-resolves the hostname without pinning the validated address, letting an attacker redirect server-side requests to internal network services or cloud instance metadata endpoints. Because the endpoint returns response_status and response_body, attackers can read internal service responses and, per public reporting, steal cloud credentials and secrets from metadata services. Any self-hosted MLflow deployment is affected, with internet-exposed servers at the highest risk. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-19, and headlines report active attacks stealing cloud credentials; EPSS puts 30-day exploitation probability at 16.4% (97th percentile).
· lfprojects MLflow All versions prior to 3.15.0 (fixed in 3.15.0) KEV PoC ×3moderate

Appears with

victim Manchester Airports Group 2 threat actor Islamic Revolutionary Guard Corps 1 organization The Register 1 threat actor Mirage Kitten 1 malware curlRAT 1 malware Manic 1 malware Pegasus 1 malware Ted backdoor 1 malware ValleyRAT 1 organization Anthropic 1 organization CISA 1 organization Collins Aerospace 1 organization FBI 1 organization OpenAI 1 threat actor Mabna Institute 1 threat actor FulcrumSec 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.