A widespread campaign called FakeGit has deployed over 7,600 fraudulent GitHub repositories to distribute SmartLoader malware. The repositories are designed to trick users into downloading malicious files disguised as legitimate projects. This large-scale operation poses a significant threat to developers and open-source users who might inadvertently install the malware.

Cybersecurity researchers discovered the HollowGraph malware, which conceals its command-and-control server and stolen files within Microsoft 365 events timestamped in the year 2050. This novel evasion technique exploits future-dated calendar entries to bypass detection. The discovery highlights the evolving sophistication of threats targeting cloud services.

This week's security recap covers critical vulnerabilities, including a WordPress remote code execution flaw, multiple SonicWall zero-days, attacks targeting AI services, and a SharePoint zero-day exploit. These issues require urgent patching and highlight ongoing threats to widely-used platforms and infrastructure.

A common security myth suggests that a specific vulnerability ("Mythos") breaks security programs, but the real danger is the duration that systems remain exposed. Organizations need to focus on reducing exposure windows rather than chasing false alarms, as unpatched vulnerabilities pose a greater threat. This matters because misdirected security efforts waste resources and increase risk.

Security expert Bruce Schneier examines the widespread deployment of automated license plate recognition cameras by Flock Safety. These cameras, used by law enforcement and private communities, raise significant privacy issues due to their extensive tracking capabilities and lack of oversight. The discussion highlights the tension between public safety and civil liberties in the age of ubiquitous surveillance.

A Russian-speaking hacker leveraged Google Gemini's command-line interface to remotely control a botnet consisting of eight computers at a dental clinic. The incident demonstrates how AI-powered tools can be misused for cyberattacks, even on small-scale targets, raising concerns about new attack vectors.

Researchers find that prompt injection attacks are effectively stopping AI-powered hacking agents from carrying out malicious tasks. By feeding crafted inputs, attackers can mislead the AI, highlighting a new vulnerability in autonomous cybersecurity systems. This matters because it reveals both a defensive opportunity and a risk for AI-driven security tools.

A vulnerability named HollowByte in OpenSSL allows attackers to trigger memory allocation freezes by sending specially crafted 11-byte TLS requests. This can lead to denial-of-service conditions on affected servers. The flaw highlights ongoing security risks in widely-used cryptographic libraries.

A newly discovered botnet named NadMesh is scanning the internet for exposed AI services, aiming to steal cloud API keys and Kubernetes authentication tokens. This threat exploits misconfigured AI infrastructure, potentially allowing attackers to gain unauthorized access to cloud resources and sensitive data. Organizations relying on AI services must secure their configurations to prevent credential theft and resource hijacking.