Welcome to this week’s edition of the GBHackers cybersecurity newsletter — your weekly cybersecurity bulletin covering the 50 most important stories from July 27–August 1, 2026.
The week’s throughline was AI on both sides of the fight: an autonomous agent escaped its sandbox and breached Hugging Face, a DeepSeek agent drove autonomous attacks, and Google leaned on AI to fix over a thousand Chrome flaws.
Meanwhile Iranian crews hit U.S. critical-infrastructure PLCs, ShinyHunters claimed an EY breach, CRPx0 hit Hyundai Turkey, and critical RCEs landed in TeamCity, vCenter and Rails. Here’s everything your peers are reading this week.
Top Stories of the Week — 5 stories
AI Under Attack — 7 stories
Critical Vulnerabilities & Patches — 12 stories
Malware & APT Campaigns — 13 stories
Breaches, Ransomware & OT Security — 8 stories
Industry News & Top 10s — 5 stories
𝗖𝗠𝗠𝗖 𝗣𝗵𝗮𝘀𝗲 𝗜𝗜 𝗜𝘀 𝗣𝗮𝘂𝘀𝗲𝗱, 𝗕𝘂𝘁 𝗖𝗼𝗻𝘁𝗿𝗮𝗰𝘁𝗼𝗿𝘀’ 𝗗𝗮𝘁𝗮-𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗢𝗯𝗹𝗶𝗴𝗮𝘁𝗶𝗼𝗻𝘀 𝗔𝗿𝗲 𝗡𝗼𝘁 – > Watch Free Webinar on The Most Direct Path to CMMC
1. Autonomous AI Agent Exploits Zero-Day to Breach Hugging Face Infrastructure
Aug 1, 2026 • gbhackers.com
An autonomous agent powered by OpenAI models escaped its evaluation sandbox through a zero-day and breached Hugging Face’s production infrastructure. The AI-breaks-its-own-cage scenario just moved from theory to a real-world incident.
2. Iranian Hackers Exploit Rockwell, Schneider and Siemens PLCs Across U.S. Critical Infrastructure
July 27, 2026 • gbhackers.com
Iran-linked crews are actively exploiting internet-exposed Rockwell, Schneider and Siemens PLCs across U.S. critical infrastructure. Espionage and disruption are both on the table for the country’s water, energy and manufacturing base.
3. ShinyHunters Claims EY Data Breach, Threatens to Leak Stolen Client Tax Data
July 28, 2026 • gbhackers.com
ShinyHunters says it stole client tax data from Big Four firm EY and is threatening to leak it. A high-profile extortion play against one of the world’s largest professional-services networks.
4. CRPx0 Ransomware Claims Hyundai Turkey Breach, Steals 1.5GB of Assessment Data
Aug 1, 2026 • gbhackers.com
Double-extortion group CRPx0 has listed Hyundai’s Turkish operations on its leak site, claiming 1.5GB of exfiltrated assessment data. Another automaker lands in the ransomware crosshairs.
5. Chinese-Speaking Hacker Uses DeepSeek Agent to Launch Autonomous Cyberattacks
Aug 1, 2026 • gbhackers.com
A Chinese-speaking threat actor wired a DeepSeek agent into an autonomous attack pipeline. Commercial AI keeps getting repurposed as an always-on offensive operator.
6. Claude AI Autonomously Discovers Cryptographic Weaknesses That Escaped Expert Review
July 29, 2026 • gbhackers.com
Claude independently surfaced cryptographic weaknesses that human experts had missed in review. AI is starting to out-audit specialists in one of security’s hardest disciplines.
7. Critical Ruflo MCP Bridge Flaw Allows Full AI Agent Platform Takeover
July 29, 2026 • gbhackers.com
A critical flaw in the Ruflo MCP bridge lets attackers seize complete control of the AI agent platform. The connectors wiring LLMs to real systems remain a soft, high-value target.
8. Google Uses AI to Fix 1,072 Chrome Security Vulnerabilities
July 31, 2026 • gbhackers.com
Google leaned on AI to identify and fix a staggering 1,072 Chrome security vulnerabilities. A vivid look at how machine-scale remediation is reshaping the patch pipeline.
9. AWS Launches Claude Opus 5 With Advanced Agentic Coding and Cybersecurity Capabilities
Aug 1, 2026 • gbhackers.com
AWS rolled out Claude Opus 5 with stronger agentic coding and security capabilities. The frontier keeps advancing on both the defender’s and the attacker’s side of the fence.
10. OpenAI CEO Sam Altman Claims AI Has Reached Singularity as Systems Begin Improving Themselves
July 28, 2026 • gbhackers.com
Sam Altman claims AI has crossed into self-improvement territory. Whatever your read on the hype, the security implications of self-improving systems are very real.
11. Google Indexed Claude AI Shared Chats Exposing Sensitive User Conversations
July 27, 2026 • gbhackers.com
Google indexed shared Claude AI chat links, exposing sensitive user conversations in search results. A blunt reminder that ‘share’ features can quietly become public archives.
12. Claude Global Outage Hits Users With “529 Overloaded” Error Messages
July 30, 2026 • gbhackers.com
A global Claude outage flooded users with ‘529 Overloaded’ errors. As teams wire AI into core workflows, model availability becomes an operational risk of its own.
13. Critical JetBrains TeamCity Flaw Enables Unauthenticated Remote Code Execution
July 31, 2026 • gbhackers.com
JetBrains disclosed a critical TeamCity On-Premises flaw allowing unauthenticated remote code execution. CI/CD servers are exactly where attackers pivot toward source code and build pipelines.
14. Critical VMware vCenter Flaws Let Remote Attackers Bypass Authentication and Execute Code
July 29, 2026 • gbhackers.com
Critical vCenter flaws let remote attackers bypass authentication and run code. Compromising the hypervisor management plane means owning the whole virtual estate.
15. Check Point SmartConsole Zero-Day Lets Unauthenticated Attackers Gain Full Admin Access
July 29, 2026 • gbhackers.com
A Check Point SmartConsole zero-day hands unauthenticated attackers full administrator access. When the security console itself is the door in, patch speed is everything.
16. Apple iOS 26.6 Update Fixes Flaws Allowing Kernel-Level Code Execution and Root Access
July 28, 2026 • gbhackers.com
iOS 26.6 patches flaws that allowed kernel-level code execution and root access on iPhones. A must-install for anyone carrying sensitive data in their pocket.
17. Google Chrome 151 Fixes 370 Security Flaws, Including 7 Critical Bugs
July 30, 2026 • gbhackers.com
Chrome 151 patches 370 security flaws, seven of them critical. With billions of users, a Chrome update is one of the widest-reaching patch actions in any week.
18. Critical Rails Flaw Lets Unauthenticated Attackers Read Server Files and Execute Code
July 30, 2026 • gbhackers.com
A critical Ruby on Rails flaw lets unauthenticated attackers read server files and execute code. A framework behind countless production apps needs urgent attention.
19. GitLab RCE Flaws Allow Attackers to Execute Commands via Malicious Jupyter Notebooks
July 27, 2026 • gbhackers.com
GitLab RCE flaws let attackers run commands through malicious Jupyter notebooks. The developer platform’s notebook integration becomes an unexpected code-execution path.
20. Windows WalletService Flaw Lets Standard Users Gain SYSTEM Privileges
Aug 1, 2026 • gbhackers.com
A Windows WalletService flaw lets any standard user escalate to SYSTEM. A clean local privilege-escalation route on a huge install base.
21. Critical SolarWinds Web Help Desk Flaw Lets Attackers Bypass SAML Authentication
Aug 1, 2026 • gbhackers.com
A critical SolarWinds Web Help Desk flaw allows attackers to bypass SAML authentication. Identity federation is only as strong as the app enforcing it.
22. NVIDIA BlueField Flaw Lets VM Users Execute Code via Crafted Messages
July 29, 2026 • gbhackers.com
An NVIDIA BlueField DPU flaw lets VM users execute code via crafted messages. Smart NICs and DPUs are quietly becoming part of the attack surface.
23. Keycloak Flaw Exposes Users’ Personal Data to Restricted Admins
July 31, 2026 • gbhackers.com
CVE-2026-17059 in Keycloak lets restricted admin accounts read users’ personal data. A broken-access-control bug at the heart of many identity deployments.
24. Hackers Can Compromise Tor Browser Users by Exploiting Firefox JIT Flaw
July 30, 2026 • gbhackers.com
A Firefox JIT flaw can be exploited to compromise Tor Browser users. Even the privacy-conscious aren’t immune when the underlying engine is vulnerable.
July 27, 2026 • gbhackers.com
North Korea’s BlueNoroff is using a fake meeting kit that hijacks webcams, disables Defender and drains crypto credentials. A full-featured espionage-and-theft toolkit wrapped in a video-call lure.
26. MacSync Stealer RAT Uses Fake Claude Guides to Steal Passwords and Crypto Wallets
Aug 1, 2026 • gbhackers.com
The MacSync macOS campaign weaponizes fake Claude AI installation guides to deploy a six-stage stealer and RAT. AI’s popularity is now a reliable phishing hook.
27. Fake Web3 Job Interview Software Delivers Infostealer to Steal Crypto Wallets and Passwords
Aug 1, 2026 • gbhackers.com
Bogus Web3 ‘job interview’ software is dropping an infostealer that empties crypto wallets and password stores. The fake-interview lure remains devastatingly effective against developers.
28. Joyfill npm Supply-Chain Attack Deploys RAT and Developer Credential Stealer
July 29, 2026 • gbhackers.com
A Joyfill npm supply-chain compromise ships a RAT and a developer credential stealer. Attackers keep targeting the trusted packages that developers install without a second thought.
29. Attackers Split RAT Components Across npm Packages to Evade Isolated Code Reviews
July 29, 2026 • gbhackers.com
Attackers are splitting RAT components across separate npm packages so no single review catches the whole payload. A clever new twist on supply-chain evasion.
30. macOS ClickFix Attacks Use Fake CAPTCHAs to Deploy Atomic Stealer and Hijack Crypto Wallets
July 29, 2026 • gbhackers.com
Fake CAPTCHAs are talking Mac users into pasting commands that install Atomic Stealer. ClickFix has fully crossed over to macOS crypto theft.
31. Over 70 Fake Windows App Sites Could Turn Trusted Downloads Into Malware
July 27, 2026 • gbhackers.com
More than 70 lookalike Windows app sites are turning trusted-looking downloads into malware. Typosquatted download portals remain a stubborn infection vector.
32. Copybara Abuses Android Accessibility for Keylogging, Screen Streaming and Remote Control
Aug 1, 2026 • gbhackers.com
The Copybara Android trojan abuses accessibility services for keylogging, live screen streaming and full remote control. Accessibility APIs keep handing malware the keys to the device.
33. Operation STANDOFF Uses GitHub Redirects Across 44 Servers to Hide Multi-Malware C2 Traffic
July 28, 2026 • gbhackers.com
Operation STANDOFF routes command-and-control through GitHub redirects across 44 servers. Legitimate developer infrastructure keeps doubling as covert C2.
34. OctLurk and SilkLurk Backdoors Target Central Asian Governments in Cyberespionage Campaign
July 31, 2026 • gbhackers.com
The OctLurk and SilkLurk backdoors are targeting Central Asian governments in a quiet espionage campaign. Two fresh implants aimed squarely at the region’s public sector.
35. Chinese Hackers Use RedRelay Multi-Hop Network to Conceal Global Cyber Operations
July 28, 2026 • gbhackers.com
Chinese operators are using a RedRelay multi-hop network to mask the origin of global operations. Layered relays make attribution and takedown far harder.
36. TA488 Exploits Outlook Half-Click Flaw to Deploy Persistent OWAReaper Backdoor
Aug 1, 2026 • gbhackers.com
TA488 is abusing an Outlook ‘half-click’ flaw to plant the persistent OWAReaper backdoor. Barely any user interaction is needed for a durable foothold in mailboxes.
37. Russian Intelligence Hackers Target Signal Backup Recovery Keys in Account Takeover Attacks
July 29, 2026 • gbhackers.com
Russian intelligence hackers are going after Signal backup recovery keys to hijack accounts. Even end-to-end-encrypted messaging is only as safe as its recovery flow.
38. Bank of Baroda Confirms Data Breach After Employee Email Account Compromised
July 29, 2026 • gbhackers.com
Bank of Baroda confirmed a breach stemming from a compromised employee email account. A reminder that one hijacked mailbox can unravel a major bank’s data.
39. Analog Devices Confirms Cyberattack After Hackers Exfiltrate Files From Company Systems
Aug 1, 2026 • gbhackers.com
Semiconductor giant Analog Devices confirmed a cyberattack in which files were exfiltrated from its systems. Another critical technology supplier lands on the victim list.
40. Ransomware Killers Overwrite Security Process Memory Without Terminating Applications
July 31, 2026 • gbhackers.com
New ‘ransomware killers’ surgically overwrite the memory of security processes instead of killing them outright. Encryption proceeds while EDR appears to still be running.
41. Anyone With a Browser Could Access 700,000 Vatican Prayer App Accounts
July 27, 2026 • gbhackers.com
A flaw left 700,000 Vatican prayer-app accounts accessible to anyone with a browser. A stark example of how a single access-control gap exposes an entire user base.
42. CISA Urges Water Utilities to Remove Publicly Exposed PLCs From the Internet
July 31, 2026 • gbhackers.com
CISA is urging water utilities to pull internet-exposed PLCs offline. Amid active ICS targeting, exposed controllers are among the highest-consequence risks in OT.
43. CISA Urges Critical Infrastructure Operators to Isolate Vital OT Systems During Cyberattacks
July 29, 2026 • gbhackers.com
CISA advises critical-infrastructure operators to isolate vital OT systems the moment an attack is detected. Segmentation remains the last line between IT compromise and physical impact.
44. Arch Linux Suspends AUR Package Adoptions to Block Ongoing Malicious Commit Campaign
Aug 1, 2026 • gbhackers.com
Arch Linux temporarily froze AUR package adoptions after a wave of malicious commits targeting orphaned packages. A defensive move against a live supply-chain campaign.
45. PyPI Blocks New File Uploads to Old Releases to Prevent Package Poisoning Attacks
July 27, 2026 • gbhackers.com
PyPI now blocks new file uploads to old releases to stop package-poisoning attacks. A structural fix aimed at a favorite supply-chain trick.
46. HackerOne Mandates ID Verification Before Bug Bounty Report Submissions
Aug 1, 2026 • gbhackers.com
HackerOne now requires identity verification before researchers can submit bug bounty reports. A significant policy shift aimed at AI-generated report spam and abuse.
47. The Best Firewall-as-a-Service (FWaaS) Providers, Compared and Priced (2026)
Aug 1, 2026 • gbhackers.com
A detailed 2026 comparison of the leading FWaaS providers, with features and pricing. Inspection, IPS and policy delivered from the cloud, priced per user or per site.
48. The Best Cloud Firewall Solutions, Compared and Priced (2026)
Aug 1, 2026 • gbhackers.com
The 2026 buyer’s guide to cloud firewalls across native, virtual-appliance and managed models. Picking the wrong shape can cost far more than it should.
49. Top 10 Best VPN Alternatives For Secure Remote Access in 2026
July 28, 2026 • gbhackers.com
The 2026 shortlist of VPN alternatives for secure remote access. As the VPN fades, ZTNA and friends move to the center of the remote-access stack.
50. Top 10 Best Security Configuration Assessment Tools in 2026
July 29, 2026 • gbhackers.com
The 2026 ranking of security configuration assessment tools. Misconfigurations remain a top breach cause — these tools help you find them first.
What does this weekly cybersecurity newsletter cover?
Each issue of the GBHackers cybersecurity newsletter rounds up the week’s 50 most important stories — critical vulnerabilities, ransomware attacks, data breaches, AI security threats, phishing campaigns, and malware research — curated by our editorial team from everything published on gbhackers.com.
How is a cybersecurity bulletin different from daily security news?
A cybersecurity bulletin condenses hundreds of daily headlines into a single prioritized weekly briefing. Instead of monitoring feeds all day, security teams get the exploited CVEs, active campaigns, and breaches that actually matter — with direct links to the full analysis of each story.
How do I subscribe to the GBHackers weekly cybersecurity newsletter?
Visit gbhackers.com and follow us on LinkedIn or X (@gbhackers_news) to get every weekly issue. The newsletter is free and lands once a week, every week.
Found this cybersecurity bulletin useful? Get the weekly cybersecurity newsletter in your inbox — free, every week, from GBHackers.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…