CYBER45

Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign.

The affected GitHub Actions are listed below -


actions-cool/issues-helper
actions-cool/maintain-one-comment

Visiting either of the repositories now shows the message: "Access to this

Anthropic's Claude Opus 5.5 appears to be changing how it writes, with new analysis showing fewer obvious AI writing patterns, shorter sentences, and simpler wording compared with Opus 5. [...]

Anthropic now allows you to run Claude Code via cloud sessions without signing up for the research preview, and it's offering up to $250 in free usage credits, so more users can give it a try. [...]

A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts. [...]

We look at a new version of the MacSync macOS stealer with a backdoor module that targets crypto enthusiasts and developers.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

The vulnerabilities in question are as follows -


CVE-2026-65660 (CVSS score: 8.8) - A code injection vulnerability in Microsoft Office SharePoint

Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally.

The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in unauthenticated remote code execution.

The vulnerability was first exploited as a zero-day

The final developer build offers a glimpse of the future Cupertino abandoned for NeXT

AI apps that interpret external data (read: most AI apps) need exceptionally rigorous security filters, or attackers can take advantage.

Even if the organization locks down employee accounts, forgotten and lost service accounts can still undo the organization's entire M365 environment.