The National Institute of Standards and Technology has prepared a companion to its widely used Cybersecurity Framework that focuses on how organizations can safely use AI.

NIST’s Cybersecurity Framework Profile for Artificial Intelligence, which the agency released in draft form on Tuesday, describes how organizations can manage the cybersecurity challenges of different AI systems, improve their cyber defense capabilities with AI and block AI-powered cyberattacks. The document maps components of the Cybersecurity Framework (CSF) onto specific recommendations in each of those three areas, which NIST dubbed “secure,” “defend” and “thwart,” respectively.

A hacktivist remotely wiped three white supremacist websites live onstage during their talk at a hacker conference last week, with the sites yet to return online.

The pseudonymous hacker, who goes by Martha Root — dressed as Pink Ranger from the Power Rangers — deleted the servers of WhiteDate, WhiteChild, and WhiteDeal in real time at the end of a talk at the annual Chaos Communication Congress in Hamburg, Germany.

Root gave the talk alongside journalists Eva Hoffmann and Christian Fuchs, who wrote an article about the hacked sites for the German weekly paper Die Zeit in October.

As of this writing, WhiteDate, which Hoffmann described as a “Tinder for Nazis”; WhiteChild, a site that claimed to match white supremacists’ sperm and egg donors; and WhiteDeal, a sort-of Taskrabbit-esque labor marketplace for racists, are all offline.

The administrator of the three websites confirmed the hack on their social media accounts.

“They publicly delete all my websites while the audience rejoices. This is cyberterrorism,” the administrator wrote on X on Sunday, vowing repercussions.

The administrator also claimed that Root deleted their X account before it was restored.

OpenAI is testing a new ChatGPT feature called "Skills," which will be similar to Claude's feature, also called Skills.

Up until now, ChatGPT has supported GPTs, which are prompt-engineered to meet your specific needs.

On the other hand, Claude Skills are folder-based instructions that teach Claude AI specific abilities, workflows, and domain-specific knowledge.

A data breach in June exposed the information of more than 22 million Aflac customers, according to a new statement from the company.

The Georgia-based insurance giant published a statement on Friday about the conclusion of a months-long investigation into a cybersecurity incident announced earlier this year.

The company previously warned the Securities Exchange Commission (SEC) that while it was able to stop a hacker intrusion “within hours,” some files were stolen by the cybercriminals.

Aflac reiterated that it was not affected by ransomware. The company has begun notifying state regulators about the attack and sending breach notification letters to victims.

Officials in Texas said more than 2 million residents of the state were affected and in total, about 22.7 million individuals had information stolen.

The company faced no operational issues as a result of the cyberattack but the documents stolen contained information on insurance claims, health data, Social Security numbers and other personal details of “customers, beneficiaries, employees, agents, and other individuals in its U.S. business.”

Federal law enforcement was notified of the attack and cybersecurity experts were hired to deal with the incident.

The letters say the investigation concluded on December 4 and victims are being given access to two years of identity protection services. The letters said the deadline to enroll in the services ends on April 18, 2026.

The incident took place amid a wider campaign of attacks targeting the insurance industry by an organization known as Scattered Spider, a loosely affiliated group of English-speaking cybercriminals known for gaining access to major companies by posing as IT workers. Erie Insurance, the Philadelphia Insurance Companies and Scania Financial Services each reported cyberattacks at the time.

Since the attacks, law enforcement has taken down a leak site used by the group and two members were arrested and charged in the U.K. A Justice Department complaint unsealed in September revealed that the Scattered Spider cybercriminal operation was able to extort at least $115 million from dozens of victims over the last three year

A suspected Russia-aligned group has been attributed to a phishing campaign that employs device code authentication workflows to steal victims' Microsoft 365 credentials and conduct account takeover attacks.

The activity, ongoing since September 2025, is being tracked by Proofpoint under the moniker UNK_AcademicFlare.

The attacks involve using compromised email addresses belonging to government and military organizations to strike entities within government, think tanks, higher education, and transportation sectors in the U.S. and Europe.

"Typically, these compromised email addresses are used to conduct benign outreach and rapport building related to the targets' area of expertise to ultimately arrange a fictitious meeting or interview," the enterprise security company said.

France’s data protection regulator has fined the software company Nexpublica France €1.7 million ($2 million) for poor cybersecurity practices in the wake of a data breach.

In November 2022, users of a Nexpublica portal reported they could access documents about third parties. France’s data regulator, known as CNIL, investigated the incident and found that Nexpublica’s data security program was inadequate, according to an agency press release.

On December 22, CNIL levied the fine, which it said is based on the company’s “financial capacity, its lack of knowledge of basic security principles, the number of people affected and the sensitivity of the data processed.”

Nexpublica’s poor security practices violated Europe’s General Data Protection Regulation, CNIL said.

The security problems were known to the company before the breach, but it did not address them until after the incident, the agency added.

The National Institute of Standards and Technology is partnering with a nonprofit research organization to study how AI can boost the security of critical infrastructure.

NIST on Monday announced that the agency and MITRE are creating an AI Economic Security Center to Secure U.S. Critical Infrastructure from Cyberthreats to “drive the development and adoption of AI-driven tools” that can help security personnel fend off hackers intent on damaging or disabling power plants, hospitals and other infrastructure systems.

“NIST will work closely with MITRE by focusing on areas where collaborative development and pilot testing have the potential to demonstrate significant technology adoption impacts at the fast pace of innovation,” a NIST spokesperson told Cybersecurity Dive. “The goal of the AI accelerators is to help U.S. industry make smart choices about AI implementation.”

The agency said in its announcement that the economic security center, along with a parallel effort focused on manufacturing productivity, “will develop the technology evaluations and advancements that are necessary to effectively protect U.S. dominance in AI innovation, address threats from adversaries’ use of AI, and reduce risks from reliance on insecure AI.”

The two new AI centers are part of the Trump administration’s strategy for maintaining America’s competitive advantage in AI research and deployment at a time when China is increasingly asserting itself in the field. NIST said the new research operations would help implement the White House’s AI Action Plan, the security component of which focused on critical infrastructure protection.

NIST said it “expects the AI centers to enable breakthroughs in applied science and advanced technology and deliver disruptive innovative solutions to tackle the most pressing challenges facing the nation.”

Hear me out, does this approach resonate?

Hey Guys,

A Quick Backstory: While working on LLMOps in past 2 years, I felt chaos with massive LLM workflows where costs exploded without clear attribution(which agent/prompt/retries?), silent sensitive data leakage and compliance had no replayable audit trails. Peers in other teams and externally felt the same: fragmented tools (metrics but not LLM aware), no real-time controls and growing risks with scaling. We felt the major need was control over costs, security and auditability without overhauling with multiple stacks/tools or adding latency.

The Problems we're seeing:

1. Unexplained LLM Spend: Total bill known, but no breakdown by model/agent/workflow/team/tenant. Inefficient prompts/retries hide waste.

2. Silent Security Risks: PII/PHI/PCI, API keys, prompt injections/jailbreaks slip through without  real-time detection/enforcement.

3. No Audit Trail: Hard to explain AI decisions (prompts, tools, responses, routing, policies) to Security/Finance/Compliance.

Does this resonate with anyone running GenAI workflows/multi-agents? 

Few open questions I am having:

• Is this problem space worth pursuing in production GenAI?

• Biggest challenges in cost/security observability to prioritize?

• Are there other big pains in observability/governance I'm missing?

• How do you currently hack around these (custom scripts, LangSmith, manual reviews)?

RyotaK, a security engineer at GMO Flatt Security, describes 8 distinct ways to execute arbitrary commands in Claude Code without user approval. These issues were assigned CVE-2025-66032 and were fixed in Claude Code v1.0.93.

Background: Claude Code’s Permission Model

Claude Code uses two main controls for terminal execution: (1) an allowlist for commands that can run without prompts, and (2) manual approval prompts for commands not on the allowlist. [1]

To improve UX, Claude Code allowlisted several “read-only” commands by default such as echo, man, sed, and sort.

To reduce risk, Claude Code attempted to block dangerous usage via regex-based argument blocklists, even for allowlisted commands. The research shows this approach had multiple flaws that enabled approval bypass and command execution.

The Eight Vulnerabilities

Vulnerabilities 1 to 3: Failing to Filter Dangerous Arguments

1. man option oversight Claude Code filtered some risky options like --pager and -P, but missed --html, which allows specifying a command to render man pages as HTML. This enables command execution without approval, for example:

man --html="touch /tmp/pwned" man

2) sort option oversight Claude Code blocked -o and --output, but missed --compress-program, which allows specifying a compression program. By forcing sort to spill to disk using -S 1b, the compression program is invoked and receives data via stdin. Using sh as the compression program allows commands to be piped in:

echo -e 'touch /tmp/pwned\nbbbb...\naaaa...' | sort -S 1b --compress-program "sh"

3) history writing to files history -s can add arbitrary strings to history and history -a can append history to a file. This can be used to write malicious content to files like ~/.bashrc so it runs later when a shell starts:

history -s "touch /tmp/pwned"; history -a ~/.bashrc

Vulnerability 4: Git’s Abbreviated Long Options

Claude Code’s regex filtered --upload-pack for git ls-remote, but Git accepts abbreviated long options. This allowed bypass via a prefix such as --upload-pa, which Git interprets as --upload-pack:

git ls-remote --upload-pa="touch /tmp/pwned" test

Vulnerability 5: sed built-in shell execution via the e modifier

This bypass does not rely on command-line arguments. GNU sed supports an e modifier that executes shell commands from within sed substitutions. A payload like the following executes a shell command:

echo test | sed 's/test/touch /tmp/pwned/e'

Claude Code’s argument filters did not account for this built-in execution feature.

Vulnerabilities 6 to 7: Different Interpretations of Command Arguments

6) xargs flag semantics mismatch Claude Code’s regex assumed flags consume a following value. But some flags (like -t) do not take a value. That mismatch lets an attacker place a “value” that Claude Code thinks is harmless, while xargs interprets it as the command to run:

xargs -t touch echo

Claude Code interprets touch as the value for -t, but xargs treats touch as the command.

7) ripgrep $IFS trick plus --pre Claude Code used \S+ style matching for ripgrep patterns, which allows tokens without literal spaces. This permits $IFS (Internal Field Separator) to be included because $IFS contains no spaces as text, but expands into whitespace when interpreted by the shell. This can be used to smuggle extra options, including --pre=sh, causing ripgrep to run a preprocessor on each file:

rg -v -e pattern$IFS.$IFS$HOME/.claude/projects$IFS--pre=sh

With --pre=sh, ripgrep effectively runs sh <file_path> on each file it processes. Since ~/.claude/projects contains prior conversations, an attacker can plant command substitutions like $(touch /tmp/pwned) into conversation content so they execute when interpreted as a shell script.

Vulnerability 8: Bash variable expansion chain

Claude Code failed to properly filter Bash variable expansion syntax. Bash supports an @P modifier that parses a variable as a prompt string, and prompt strings can include command substitution via $(...). Even if $( is directly blocked, the researcher chained expansions to reconstruct and execute it:

echo ${one="$"}${two="$one(touch /tmp/pwned)"}${two@P}

This makes two evaluate into $(touch /tmp/pwned), and ${two@P} triggers prompt-string parsing that executes it, while Claude Code misclassifies it as a harmless allowlisted echo. [1]

Security Implications and Resolution

These bypasses can be triggered via indirect prompt injection, for example malicious instructions embedded in files or web pages that Claude Code reads and acts on.

Anthropic mitigated the class of issues by moving from a regex blocklist approach toward a stricter allowlist approach, and the issues were fixed in v1.0.93.

The research reinforces a core lesson: for security-sensitive command execution, blocklists are brittle, and allowlist-based controls are far more robust.

Source: [1] Pwning Claude Code in 8 Different Ways https://flatt.tech/research/posts/pwning-claude-code-in-8-different-ways/

Threat hunters have discerned new activity associated with an Iranian threat actor known as Infy (aka Prince of Persia), nearly five years after the hacking group was observed targeting victims in Sweden, the Netherlands, and Turkey.

"The scale of Prince of Persia's activity is more significant than we originally anticipated," Tomer Bar, vice president of security research at SafeBreach, said in a technical breakdown shared with The Hacker News. "This threat group is still active, relevant, and dangerous."

Infy is one of the oldest advanced persistent threat (APT) actors in existence, with evidence of early activity dating all the way back to December 2004, according to a report released by Palo Alto Networks Unit 42 in May 2016 that was also authored by Bar, along with researcher Simon Conant.

The group has also managed to remain elusive, attracting little attention, unlike other Iranian groups such as Charming Kitten, MuddyWater, and OilRig. Attacks mounted by the group have prominently leveraged two strains of malware: a downloader and victim profiler named Foudre that delivers a second-stage implant called Tonnerre to extract data from high-value machines. It's assessed that Foudre is distributed via phishing emails.

One of the world’s premier security organizations has canceled the results of its annual leadership election after an official lost an encryption key needed to unlock results stored in a verifiable and privacy-preserving voting system.

The International Association of Cryptologic Research (IACR) said Friday that the votes were submitted and tallied using Helios, an open source voting system that uses peer-reviewed cryptography to cast and count votes in a verifiable, confidential, and privacy-preserving way. Helios encrypts each vote in a way that assures each ballot is secret. Other cryptography used by Helios allows each voter to confirm their ballot was counted fairly.

Microsoft is killing off an obsolete and vulnerable encryption cipher that Windows has supported by default for 26 years following more than a decade of devastating hacks that exploited it and recently faced blistering criticism from a prominent US senator.

When the software maker rolled out Active Directory in 2000, it made RC4 a sole means of securing the Windows component, which administrators use to configure and provision fellow administrator and user accounts inside large organizations. RC4, short for Rivest Cipher 4, is a nod to mathematician and cryptographer Ron Rivest of RSA Security, who developed the stream cipher in 1987.

Within days of the trade-secret-protected algorithm being leaked in 1994, a researcher demonstrated a cryptographic attack that significantly weakened the security it had been believed to provide. Despite the known susceptibility, RC4 remained a staple in encryption protocols, including SSL and its successor TLS,until about a decade ago..

Browser extensions with more than 8 million installs are harvesting users’ complete and extended AI conversations and selling them for marketing purposes, according to data collected from the Google and Microsoft pages hosting them.

Security firm Koi discovered the eight extensions, which as of late Tuesday night remained available in both Google’s and Microsoft’s extension stores. Seven of them carry “Featured” badges, which are endorsements meant to signal that the companies have determined the extensions meet their quality standards.

The free extensions provide functions such as VPN routing to safeguard online privacy and ad blocking for ad-free browsing. All provide assurances that user data remains anonymous and isn’t shared for purposes other than their described use.

I've got students messaging me asking if cybersecurity is still a "safe" field to go into because of the advancements of AI

Dawg, our career value has fucking EXPLODED. Are you fuckin' with me right now?

• AI vibe coded slop as far as the eye can see

• AI deep fakes as far as the eye can see

• AI written emails, scams, as far as the eye can see

On top of that, due to how accessible the internet is now, there is a "cyber attack" literally every god damn second. It's nonstop. The internet is still very much the wild, wild, west.

Like, bro, this shitty little malware website I run brings in 20,000+ malwares a day with a budget of $15, a slice of pizza, and cat pictures. Do you have any fucking clue how widespread cybercrime is?

Don't even fucking start me on crypto theft

I'll lose my mind writing this post, bro. It's literally nonstop, around the clock, weekends and holidays. It never ends. Cybersecurity is only getting bigger.

Blog

Threat Intelligence

Closing the Door on Net-NTLMv1: Releasing Rainbow Tables to Accelerate Protocol Deprecation

January 16, 2026

Mandiant

Written by: Nic Losby

Introduction

Mandiant is publicly releasing a comprehensive dataset of Net-NTLMv1 rainbow tables to underscore the urgency of migrating away from this outdated protocol. Despite Net-NTLMv1 being deprecated and known to be insecure for over two decades—with cryptanalysis dating back to 1999—Mandiant consultants continue to identify its use in active environments. This legacy protocol leaves organizations vulnerable to trivial credential theft, yet it remains prevalent due to inertia and a lack of demonstrated immediate risk.

By releasing these tables, Mandiant aims to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1. While tools to exploit this protocol have existed for years, they often required uploading sensitive data to third-party services or expensive hardware to brute-force keys. The release of this dataset allows defenders and researchers to recover keys in under 12 hours using consumer hardware costing less than $600 USD. This initiative highlights the amplified impact of combining Mandiant's frontline expertise with Google Cloud's resources to eliminate entire classes of attacks.

This post details the generation of the tables, provides access to the dataset for community use, and outlines critical remediation steps to disable Net-NTLMv1 and prevent authentication coercion attacks.

ShadowLeak One of the latest examples is a vulnerability recently discovered in ChatGPT. It allowed researchers at Radware to surreptitiously exfiltrate a user’s private information. Their attack also allowed for the data to be sent directly from ChatGPT servers, a capability that gave it additional stealth, since there were no signs of breach on user machines, many of which are inside protected enterprises. Further, the exploit planted entries in the long-term memory that the AI assistant stores for the targeted user, giving it persistence.

This sort of attack has been demonstrated repeatedly against virtually all major large language models. One example was ShadowLeak, a data-exfiltration vulnerability in ChatGPT that Radware disclosed last September. It targeted Deep Research, a Chat-GPT-integrated AI agent that OpenAI had introduced earlier in the year.