In today’s cybersecurity news…

A.I. hackers find software flaw

Google says it has identified the first known case of hackers using AI to discover and exploit a previously unknown software flaw. The AI-assisted attack targeted a popular open-source administration tool and could have let attackers bypass two-factor authentication, though Google patched the vulnerability before damage occurred. (New York Times)

Xbox leaks ‘Forza Horizon 6’

Forza Horizon 6 leaked online more than a week before launch after unencrypted PC files briefly appeared on Steam, letting pirates crack and distribute the game. Early reports blamed a preload error, but Microsoft later said the leak was “not the result of a pre-load issue,” suggesting the files may have come from a reviewer or early-access source instead. Microsoft has begun issuing franchise-wide bans to players using the cracked version, though the game remains playable offline. (Windows Central)

Linux kernel hit by 2nd flaw

Researchers disclosed a new Linux kernel vulnerability dubbed “Dirty Frag,” the second major Linux flaw revealed in two weeks after the earlier “Copy Fail” bug. The chained vulnerabilities let attackers with basic access gain full root privileges and escape cloud containers by exploiting how Linux handles files in memory, while leaving little trace for security tools to detect. The flaw was publicly released after a disclosure embargo collapsed, accelerating patch efforts across major Linux distributions including Red Hat, Ubuntu, and AlmaLinux. (The Record)

Fake Claude code page pushes PowerShell stealer

Researchers uncovered a malware campaign using fake Claude Code installation pages to infect developers with a new PowerShell-based information stealer. The malware targeted Chromium-based browsers to steal cookies, passwords, and payment data while evading detection through heavily obfuscated scripts and minimal native code activity. Researchers warned that compromised developer machines could give attackers access to source code repositories, cloud infrastructure, and CI/CD pipelines. (Infosecurity Magazine)

Huge thanks to our sponsor, Doppel

Netflix sued over ‘surveillance machinery’

Texas Attorney General Ken Paxton sued Netflix, alleging the company secretly collected and shared subscriber data with advertisers and data brokers without proper consent. The lawsuit claims Netflix tracked viewing habits, locations, device data, and children’s profiles while publicly downplaying its data collection practices, and shared information with firms including Experian, Acxiom, and Google’s ad platforms. Texas is seeking fines and restrictions on Netflix’s data practices, including changes to autoplay settings on kids’ accounts. (The Record)

TeamPCP compromises Checkmarx

Checkmarx confirmed that attackers linked to TeamPCP published a malicious version of its Jenkins AST plugin to the Jenkins Marketplace, weeks after the group compromised the company’s KICS Docker image and developer tools in a separate supply chain attack. Researchers say TeamPCP briefly took over the plugin’s GitHub repository and inserted credential-stealing malware, raising concerns that the group either retained access to Checkmarx systems or exploited incomplete remediation from the earlier breach. (The Hacker News)

Spy agencies seek more power

The Washington Post reports the US administration is divided over whether U.S. intelligence agencies should gain a larger role in evaluating advanced AI models amid growing cybersecurity concerns tied to systems like Anthropic’s Mythos. National security officials want the Office of the Director of National Intelligence to oversee AI testing, while Commerce Department officials argue their existing AI evaluation programs are better suited and warn against heavier regulation that could slow U.S. competitiveness against China.. (The Washington Post)

Canvas data leak extortion deadline looms

Instructure, parent company of Canvas, is facing more pressure after cybercriminal group ShinyHunters threatened to leak data allegedly stolen from more than 8,800 school systems using the Canvas learning platform. The attackers claim to have stolen 3.65 terabytes of student, teacher, and school data and escalated the extortion campaign by defacing Canvas login pages and setting a new ransom deadline after the company reportedly refused to pay. The breach exposed usernames, email addresses, enrollment details, and messages, but  some are questioning the company’s response and warning the incident could become one of the largest education-sector data exposures on record. (CyberScoop)