The new Rancher Fleet vulnerabilities patch resolves two Rancher Fleet vulnerabilities, including cluster-admin privilege escalation flaw CVE-2026-94290.
Related Posts:
Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug
SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code
Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder
The post Critical Rancher Fleet Vulnerabilities Patched in Upda
The new Rancher Fleet vulnerabilities patch resolves two Rancher Fleet vulnerabilities, including cluster-admin privilege escalation flaw CVE-2026-94290.
Anthropic updated Claude Code permission modes with a toggle to suppress confirmation prompts for dangerous deletion commands during automated workflows.
Related Posts:
Trezor Hardware Wallet Implant Found in Reseller Units
Microsoft 365 Storage Changes Reduce Family Cloud Quotas
Claude CarPlay Update Adds Hands-Free AI Voice
The post Claude Code Permission Modes Add Dangerous Skip Toggle appeared first on Daily CyberSecurity.
Anthropic updated Claude Code permission modes with a toggle to suppress confirmation prompts for dangerous deletion commands during automated workflows.
Binance probes a DevOps engineer’s hacked laptop after a $6.3 billion theft linked by researchers to North Korean hackers, and promises to cover all customer losses.
Binance probes a DevOps engineer’s hacked laptop after a $6.3 billion theft linked by researchers to North Korean hackers, and promises to cover all customer losses.
The Zeabur platform shutdown is set for December 2026 after an attacker read 3.21 million environment variables and 321,800 accounts.
Related Posts:
Railway Security Incident Exposes Customer Environment Variables and Pauses All Deployments
Sourcenext Data Breach Exposes 22.5M User Records
OpenCode Security Breach Exposes 1.4% of Console Users
The post Zeabur Shutdown Follows Repeated Data Breaches appeared first on Daily CyberSecurity.
An OVHcloud CLI attack swapped GitHub release files with a secret-stealing binary. Learn which versions are hit in this supply chain attack.
Related Posts:
Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access
AdFection Spyware Attack Targets Al Jazeera Devices
GhostBat RAT Uses Transparent Overlay to Steal PINs From 60 Indian Financial Apps
The post OVHcloud CLI Attack Swaps Release Binaries With a Secret-Stealing Build appeared first on Daily CyberSecurity.
GitHub now expires npm trusted publishing setups that miss a first publish within 48 hours, closing a repo name reuse flaw in 1,500+ packages.
Related Posts:
Google Updates Chrome VRP Rewards for Memory Flaws
Google Play AI Apps Revolutionize Android Publishing
Google Gemini 4 Argon Model Officially Launches
The post npm Trusted Publishing Now Expires After 48 Hours appeared first on Daily CyberSecurity.
Four critical Argo CD vulnerabilities, including AppProject bypass CVE-2026-77459, threaten the repo-server and clusters. Upgrade to v3.5.4 now.
Related Posts:
Apache DolphinScheduler 3.4.3 Fixes Six Authorization Flaws That Leak Passwords and Kubernetes Credentials
wolfSSH 1.6.0 Fixes Five Flaws, Including Critical Host Key Bypass CVE-2026-16516
Cisco Finesse SSRF Flaw CVE-2026-20362 Publicly Disclosed, With Fixes Not Due Until 2027
The post Argo CD Patches Four Critical CVSS 9.9 Flaws Affec
Progress DataDirect vulnerability CVE-2026-91140 enables command injection via crafted OpenAPI files in AI agents. Pull version 2.1 now.
Related Posts:
CVE-2026-21589 Exploited in the Wild as Atlassian File Read Flaw Details and PoC Go Public
Elastic Patches 14 Flaws in Elasticsearch, Kibana and Elastic Defend
ASUS Patches Four Router Firmware Flaws, Including Two Critical Bugs Rated CVSS 9.3
The post Progress Fixes Critical Command Injection Flaw CVE-2026-91140 in DataDirect AI Model Generat
PixelLeak: an AI agent screenshot leak put 13,000+ internal images from 300+ firms in public GitHub repos. See how it happened and how to check.
Related Posts:
Meta Muse Secretly Used Humans for AI Phone Calls
ShinyHunters Syndicate Alleges Major FBI Network Compromise
Leaked GitHub App Private Keys Expose Critical Infrastructure
The post AI Coding Agents Leak 13,000 Internal Screenshots to Public GitHub Repos appeared first on Daily CyberSecurity.
A High-severity Octopus Server vulnerability, CVE-2026-101169, lets users with edit rights run code via insecure deserialization. Upgrade now.
Related Posts:
macOS SMB Kernel Flaw CVE-2026-84543: Details and PoC Exploit Released
Exploited Citrix NetScaler Flaw CVE-2026-88771: Details and PoC Now Public
Apache Karaf Vulnerabilities Let Low-Privilege Users Reach Admin and Code Execution
The post Octopus Server Flaw CVE-2026-101169 Allows Code Execution via Insecure Deserialization appeared firs
We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries.
The post Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection appeared first on Unit 42.
We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries.
Researchers at German cybersecurity company Nebty have identified “DoppelCart,” a cluster of almost 119,000 domains linked to copied online stores.
The researchers describe it as the largest publicly documented fake-shop network by associated domain count. They found 118,787 .shop domains in the cluster, representing 2.72% of the .shop top-level domain (TLD) population they examined.
The operation copies legitimate retailers’ product catalogs, descriptions, branding, and images, sometimes
Researchers at German cybersecurity company Nebty have identified “DoppelCart,” a cluster of almost 119,000 domains linked to copied online stores.
The researchers describe it as the largest publicly documented fake-shop network by associated domain count. They found 118,787 .shop domains in the cluster, representing 2.72% of the .shop top-level domain (TLD) population they examined.
The operation copies legitimate retailers’ product catalogs, descriptions, branding, and images, sometimes even loading images directly from the real companies’ infrastructure.
As we have reported in the past, AI-powered website builders make it easy to clone major brands. However, Nebty’s findings are based on shared website and infrastructure characteristics, rather than evidence that every domain is operated by a single identified group.
BleepingComputer reports an important checkout-level detail: 96% of confirmed DoppelCart shops reportedly shared identical build files and used just 27 ecommerce backends.
The fake shops mimic more than 44,000 brands, with a median of two clones for each brand.
“However, some brands like SodaStream, Velasca, CurrentBody, Daniel Wellington, Dreame, Horze, MOVA, and SPARK PAWS received more attention, with over 30 shops each.”
Nebty observed advertised discounts of up to 65%, a tactic designed to encourage shoppers to act before closely checking the domain, company details, or payment process.
The fraudulent checkout pages collect cardholder data and transmit it to attacker-controlled servers over WebSockets in real time. That may include card numbers, expiry dates, CVVs (card verification values), billing information, and even one-time confirmation codes issued by banks.
Capturing an authentication code in real time can help criminals to complete a payment while the victim is still going through the checkout flow.
How shoppers can stay safe
A professional-looking store, the use of HTTPS, authentic product images, and a familiar logo do not prove that a website is legitimate. Before entering payment details, shoppers should take a few minutes to verify where they are buying from.
Check the web address carefully. If possible, reach the retailer through its official app, a saved bookmark, or a web address you already know, rather than sponsored search results or ads on social media.
Be wary of unusually large discounts. A low price does not prove that a store is fake, but it is a reason to check the site more carefully.
Search for the exact web address alongside terms such as “scam” or “reviews.” Check that the contact details, returns policy, and company information match the real retailer.
Pay by credit card or another service with buyer protection. Avoid cryptocurrency, bank transfers, gift cards, and other payments that are difficult to reverse.
Check every bank verification request carefully. Make sure the merchant and amount are correct, and never give a one-time code to a retailer or anyone who contacts you.
If you’re unsure whether a store is genuine, use Malwarebytes Scam Guard to help you assess it.
If you’ve already paid, act quickly. Contact your card issuer, report the suspected fraud, ask about replacing or monitoring your card, and save screenshots, order confirmations, web addresses, and correspondence.
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
For many organizations, AI is proving easy to pilot but difficult to scale. Pilots often look inexpensive because they run on narrow datasets with a handful of users, explains Ben Schein, chief AI and analytics officer at cloud software company Domo. “But the cost lives in deployment, the moment you connect that capability to real workflows and the systems of record behind them,” he says. “That’s when the real bill appears.” So CIOs must always budget for the gap between when
For many organizations, AI is proving easy to pilot but difficult to scale. Pilots often look inexpensive because they run on narrow datasets with a handful of users, explains Ben Schein, chief AI and analytics officer at cloud software company Domo. “But the cost lives in deployment, the moment you connect that capability to real workflows and the systems of record behind them,” he says. “That’s when the real bill appears.” So CIOs must always budget for the gap between when it works in a demo and when it produces governed and durable value.
Organizations can easily get caught out because they run pilots as a technology experiment instead of a business initiative, he adds. “The interesting question is never whether AI can do the thing in a demo,” he says. “It’s whether it should run in this process, and whether it survives contact with production.”
There’s also a lot of pressure on IT teams to be doing something with AI simply because everyone else is, says Naren Gangavarapu, chief transformation and AI officer at Australian Cruise Group.
Naren Gangavarapu, chief transformation and AI officer, Australian Cruise Group
Australian Cruise Group
He calls it AI theater because there’s a big show around AI even though there aren’t that many successful applications of the technology in production environments.
AI costs out of control
According to John D’Emic, CTO at AI observability platform Revenium, one of the big traps when running a pilot is failing to anticipate how quickly consumption can spiral as adoption grows. “As an example from our own engineering org, back in May, a developer opened an AI coding session on his laptop, and it stayed open for four days,” he says. “By the time it closed, it had run 4,819 calls and cost us $3,762. We didn’t budget for this, and no alert fired. But that one session cost more than a lot of teams spend on their entire monthly AI tooling.”
While this showcases how a developer can make a costly error, Dmitriy Anderson, CIO and digital and social commerce leader at home and gardening retailer Leroy Merlin South Africa, believes the pilot trap frequently happens when employees with little or no software development experience vibe code applications. “It doesn’t matter if you can create something in 15 or 20 minutes if the result is AI slop,” he says. “Think dirty code, no consideration for safety, security, and possible data exposure.” In most cases, these pilots are developed with one of the frontier apps, and someone probably used their personal AI subscription, so the costs are negligible, he adds. But if you have a company of several thousand people, and you now want to roll this tool out more broadly, that’s where costs can get out of control.
This scenario is only exacerbated by the introduction of agentic AI, D’Emic adds. “Agents don’t spend money at human speed,” he says. “In the old cloud days, an engineer could spin up infrastructure in minutes and finance might not see the bill for a month, which was painful but recoverable. Agents, though, call APIs around the clock without waiting on anyone’s approval.”
Mind the trap
While cost is a big factor in the AI pilot trap, it should be treated as a symptom of a bigger problem, says Schein. The underlying issue is governance and observability. “An autonomous workflow can fan out into more queries, API calls, and model invocations than anyone scoped,” he says. “So if you can’t see what it’s doing, and spend compounds quietly, you only find out once the invoice arrives.”
In a recent LinkedIn post, Anderson outlined how in just six weeks he built a platform for a fraction of the sticker cost using three AI models orchestrated together. The traditional estimate to build the same tool would have required 2,472 engineering hours from a team, and was expected to take around nine months. “I went through the proper engineering steps and planning, and made sure the application passed a series of cybersecurity frameworks,” he says. “The purpose of this exercise was to showcase that AI can still speed up the process even if you take the time to work through the necessary steps. You can build with AI rigorously and securely.”
Dmitriy Anderson, CIO and digital and social commerce leader, Leroy Merlin, SA
LMSA
So to turn AI experiments into enterprise value, every AI interaction must be attributable: who triggered it, against what data, on which model, and at what cost, Schein says. For each workload, be sure to ask how often it runs, which model tier the job actually needs, and what triggers it, human or automatic. “A frontier model on an automatic trigger and a small model called on demand are completely different cost curves for the same task,” Schein adds.
For Anderson, it’s helpful to use AI to highlight potential gaps, assumptions, or blind spots in your ideas early on. “When you start building an idea, ask the agent to interview you,” he says. “It will go through every phase and ask questions about the important facets of the process, from scalability and budget to deployment options. You can even make AI write a prompt for itself, because it knows its capabilities and quirks better than you ever will. It’s called meta prompting.”
Anil Inamdar, global head of data services for the Instaclustr BU at NetApp, suggests CIOs cost out the whole program, not just the demo. “Generally, the model itself is the cheapest part of the program,” he says. For him, it’s important to have security and governance people in the scoping meeting, not the launch meeting.
Anil Inamdar, global head of data services. Instaclustr BU. NetApp
NetApp
He believes the pilot trap is also, or perhaps mostly, a sequencing trap. “A lot of teams are wired to build first and ask permission later, only to discover months down the line they can’t pass a security review or data privacy audit without a painful and costly rebuild. It’s also valuable to define what failure looks like before you define success.
“Pilots tend to die because of no result, which isn’t the same as a bad result,” Inamdar says. “Emphasize to the deployment team on day one that if a target result by a certain month isn’t seen, we shut it down. Otherwise, you’re funding a zombie pilot because everyone’s invested and no one wants to be the one to call it out.”
Security researchers found 150 lookalike Open VSX extensions published under trusted names, highlighting how extension marketplaces can expose developer credentials, source code, and CI/CD systems to supply-chain risk.
The post 77 Counterfeit Open VSX Extensions Collected Developer and CI/CD Data appeared first on TechRepublic.
Security researchers found 150 lookalike Open VSX extensions published under trusted names, highlighting how extension marketplaces can expose developer credentials, source code, and CI/CD systems to supply-chain risk.