Dark Reading
@darkreading.bsky.social
One of the most widely read and trusted cybersecurity news sites, providing IT security professionals informed insights into the latest news and trends.
Flaws in Google APK for Python Unlock Agent-to-Agent Attack: https://bit.ly/4ghNqIP by Elizabeth Montalbano
Flaws in Google APK for Python Unlock Agent-to-Agent Attack
Google has fixed the issues, which exploited a trust boundary between two AI agents with different privileges to potentially compromise the supply chain.
darkreading.com
Angola's Largest Telco Breached Hours Before IPO: https://bit.ly/3TEMw1h by Robert Lemos #DRGlobal
Angola's Largest Telco Breached Hours Before IPO
Unitel, Angola's top mobile operator, continues to recover from a cyberattack that disrupted the government-owned telco on the day of its public offering.
bit.ly
Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook: https://bit.ly/4pTCYeC by Elizabeth Montalbano,
Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook
The attacks use diverse social engineering lures and rotating payloads to deliver ScreenConnect for persistent remote access to compromised networks.
darkreading.com
Device Code Phishing Up 1,500% in 2026; Vishing Doubles: https://bit.ly/4xldtFH by Nate Nelson
Device Code Phishing Up 1,500% in 2026; Vishing Doubles
Newer social engineering techniques help attackers ignore entrenched security controls and limit the evidence they leave behind.
darkreading.com
AI Notetaker Lets Hackers Spy on Government, Corporate Video Calls: https://bit.ly/4w014G1 by Nate Nelson
AI Notetaker Exposes Government, Corporate Video Calls
A Google Firebase misconfiguration lets users of tl;dv, an AI meeting tool, query any other users' meeting information and join calls.
darkreading.com
Attackers Exploit N-able Patch Bypass Flaw on RMM Servers: https://bit.ly/4ciGUA1 by Alex Culafi
Attackers Exploit N-able Patch Bypass Flaw on RMM Servers
Over the weekend, the vendor discovered another vector of authentication bypass CVE-2026-18577 that gives attackers administrator access.
bit.ly
Anthropic: Claude Attacks Result of Security Gaps, Not Model Issues: https://bit.ly/3TTXXlD by Jai Vijayan
Anthropic: AI Attacks Result of Security Gaps, Not Model Issues
Last month's incidents in which Claude breached real-world systems derived from over-permissioning, especially with Internet access.
bit.ly
Latest on @darkreading.bsky.social #DRTechnology: New Tool Traces AI Videos Back to Their Source https://zpr.io/iUJ3ZCBpLZu8 #darkreading #cybersecurity
New Tool Traces AI Videos Back to Their Source
Researchers dug into the root of the problem with the goal of promoting industry collaboration on improved protective measures.
zpr.io
Is There Really a Fix for CISO Fatigue?: https://bit.ly/3TAfBuL Commentary by Dirk Schrader, Netwrix
Is There Really a Fix for CISO Fatigue?
Accountability without any real authority is driving CISO burnout, and organizations need to take notice.
darkreading.com
Chinese Actor Weaponizes DeepSeek AI Agent to Attack Security Firm: https://bit.ly/3Ub8yJ1 by Elizabeth Montalbano
Chinese Actor Weaponizes DeepSeek AI Agent Against Security Firm
Researchers intercepted and investigated the model, which was attempting to compromise hosts for proxyjacking to launch other attacks.
darkreading.com
Minnesota Water Utility Attacks Expose Sector's Cyber-Risks: https://bit.ly/4xjDmpr by Jai Vijayan
Minnesota Water Utility Attacks Expose Sector's Cyber-Risks
A likely Iran-backed actor targeted over 30 community water systems in Minnesota in a sobering reminder of rising threats to US critical infrastructure.
darkreading.com
AI Harnesses Burst With Potential Exploit Opps: https://bit.ly/3TvIBnq by Robert Lemos #BHUSA #BlackHatUSA2026
AI Harnesses Burst With Potential Exploit Opps
A myriad of software makes up the typical AI harness, and trust issues between the components can create concerning attack vectors.
darkreading.com
CISA Issues Fresh SBOM Guidance. Did They Get It Right?: https://bit.ly/3Ub741p by Nate Nelson
CISA Issues New SBOM Guidance. Did They Get It Right?
A couple dozen changes to SBOM fields will make them more comprehensive, but some argue that the framework lacks real risk-management improvements.
bit.ly
As we head into Black Hat USA 2026, hear the voices that have been sounding the alarm for two decades, including: ✓ Bruce Schneier ✓ Katie Moussouris ✓ Rich Mogull ✓ Robert "RSnake" Their favorite Dark Reading columns from the past 20 years are still relevant today. https://bit.ly/45COi5A
Cyber Pioneers Ponder Past as Prologue
Robert "RSnake" Hansen, Katie Moussouris, Rich Mogull, Richard Stiennon, and Bruce Schneier consider whether columns they penned have stood test of time.
bit.ly
In case you missed it, Rich Mogull sat down with the Dark Reading Confidential podcast to lay out the lessons cyber teams should take from OpenAI's rogue agent attacks against Hugging Face. https://bit.ly/3RouYWt
Hugging Face Hack: Lessons for Cyber Defenders
Dark Reading Confidential Episode 20: Expert Rich Mogull reflects on lessons cyber teams should pull from the OpenAI agent's attack on Hugging Face.
bit.ly
With 50,000 members ranging from young children to senior athletes, USA Fencing faced a growing challenge: verifying age and nationality accurately while managing an increasingly manual review process. Here's how USA Fencing approached the problem. https://bit.ly/4bou1Ep
USA Fencing: The Hidden Identity Challenge in Amateur Sports
The org behind Team USA's Olympic fencing team automated ID verification to handle membership growth and ensure athletes compete in the correct categories.
bit.ly
Interpol Leverages Global System to Curtail Fraud Payments: https://bit.ly/4g3VNZo by Robert Lemos
Interpol Leverages Global System to Curtail Fraud Payments
When a fraudulent transaction occurs, law enforcement agencies must work quickly to halt payments before cybercriminals cash out.
darkreading.com
The Morning After We Pull a Root of Trust, Nobody Owns It https://bit.ly/4h7w5nV Commentary by Rajeev Mohindra, Independent Researcher
The Morning After We Pull a Root of Trust, Nobody Owns It
The most valuable move any security team can make is building a certificate and key inventory.
bit.ly
Latest on @darkreading.bsky.social #DRTheEdge: DROP Platform Lets Californians Reduce Digital Footprint https://zpr.io/CaFgpppip3JP #darkreading #cybersecurity
DROP Platform Lets Californians Reduce Digital Footprint
The Delete Request and Opt-out Platform (DROP) launches Aug. 1 and hundreds of thousands of California residents already registered. Other states could follow if the process goes smoothly.
zpr.io
OpenAI's Rogue Model Claims More Victims Beyond Hugging Face: https://bit.ly/4pQiELl by Alexander Culafi
OpenAI's Rogue Model Claims More Victims Beyond Hugging Face
OpenAI's goal-seeking agent compromised a Modal customer environment and others during its sandbox escape.
darkreading.com
SE Asian Cybercriminal Syndicates Become a Global Power: https://bit.ly/4w1NDFQ by Robert Lemos #DRGlobal
SE Asian Cybercriminal Syndicates Become a Global Power
The organized crime groups have moved from goods to services, trafficking people from at 80+ countries, costing nations more than $88 billion in 2025.
darkreading.com
'Flying Eagle' Full-Service Mobile RAT Builder Wings Across China: https://www.darkreading.com/endpoint-security/flying-eagle-mobile-rat-builder-china by Nate Nelson #DRGlobal
'Flying Eagle' Full-Service Mobile RAT Builder Wings Across China
A premium-grade malware-as-a-service offering takes flight with multiple threat groups, building infostealers that drain victims' bank accounts.
darkreading.com
Latest on @darkreading.bsky.social #DRTheEdge: Claude Mythos — Hype vs. Reality: What Security Teams Need to Know https://zpr.io/8BnWcCYpPrxu #darkreading #cybersecurity
Claude Mythos — Hype vs. Reality: What Security Teams Need to Know
In this edition of Reporters' Notebook, our journalists discuss the ins and outs of Anthropic's Claude Mythos rollout. How seriously should we take its risks? How big of a deal is it?
zpr.io
The OpenAI/Hugging Face incident raises urgent questions for every security leader. What concerns you most? ✅ Sandbox containment ✅ AI telemetry gaps ✅ Liability questions ✅ Disclosure requirements Vote in our poll (available on any Dark Reading article page): https://bit.ly/4fByFzQ
Escape Artists: 'Incorrigible' AI Models Resist Rehabilitation
The hacking of Hugging Face by a rogue OpenAI agent is significant, but unsurprising — and preventing the next AI model escape will be difficult, at best.
bit.ly
What separates good security leaders from great ones? Former Citigroup CISO Charles Blauner shares the leadership qualities that matter most in today's threat landscape — from building security-aware cultures to earning board-level trust. https://bit.ly/3RKlgh0
Former Citigroup CISO Blauner on What Makes A Great Leader
The cybersecurity pioneer discusses the evolution of the CISO role, AI, and why operational resilience is the profession's next frontier.
bit.ly
An autonomous AI agent broke out of its sandbox, moved laterally through production systems, and triggered 17,000 alerts. The twist? When defenders tried to investigate using AI tools, their own safety guardrails blocked them. Watch our breakdown of what happened. https://bit.ly/45u4xBX
Hugging Face Breach Raises Hard Questions on Liability
Dark Reading walks through how OpenAI's agent AI system broke out of its sandbox and decided to target Hugging Face, and what CISOs should be aware of.
bit.ly
OpenAI's Rogue Model Claims More Victims Beyond Hugging Face: https://bit.ly/4pQiELl by Alexander Culafi
OpenAI's Rogue Model Claims More Victims Beyond Hugging Face
OpenAI updated its disclosure to reveal rogue AI models breached additional services, including a Modal customer and others.
bit.ly
Red Agents vs. Blue Agents: How to Make AI Better At Defense: https://bit.ly/3S6Lpa5 by Rob Wright #BHUSA #BlackHatUSA2026
Red Agents vs. Blue Agents: How to Make AI Better At Defense
The agentic AI playing field was heavily tilted toward offense, so researchers began using red team agents to help teach their blue counterparts.
bit.ly
When AppSec Scanners Become a Supply Chain Attack Vector: https://bit.ly/4pMlyk0 by Ericka Chickowski #DRTechnology #BHUSA #BlackHatUSA2026
When AppSec Scanners Become a Supply Chain Attack Vector
New research shows how security scanners embedded in the software supply chain can be attacked to serve as a foothold for downstream attacks.
bit.ly
Stronger AI Safety Requires Peeking Inside the 'Black Box': https://www.darkreading.com/cybersecurity-analytics/stronger-ai-safety-requires-peeking-inside-black-box by Robert Lemos
Stronger AI Safety Requires Peeking Inside the 'Black Box'
Researchers propose focusing on identification of certain cognitive elements in LLMs that indicate when AI systems may take an unwanted action.
darkreading.com