In today’s cybersecurity news…
Anthropic releases Claude Fable 5
Ever since Mythos Preview was announced, everyone has been itching to get access to Anthropic’s new model. A general release of Mythos still seems to be a way off, but Anthropic is getting closer, releasing the “Mythos-class” Fable 5 model. Anthropic says this model operates similarly to Mythos in terms of knowledge work, vision, and long-running tasks,, but has targeted blocks in place. For areas ripe for misuse, such as cybersecurity and biology, Fable 5 will fall back to Opus 4.8-level performance. Anthropic claims that 95% of sessions run on Fable 5’s native capabilities and that external bug bounty and read-teaming efforts failed to uncover critical bypasses or universal jailbreaks.
French government messaging service breached
The digital affairs directorate of the French government, DINUM, warned that threat actors breached the government encrypted messaging app, Tchap. This service was developed by DINUM with the French cybersecurity agency ANSSI back in 2018, based on the Matrix protocol. DINUM said a threat actor gained access to the service through a compromised user account. A threat actor taking credit for the breach said they stole hardcoded LDAP credentials shared by the French tax authority and stole over 13 gigabytes of documents, as well as information on over 73,000 accounts. DINUM said it blocked access to the compromised account and is reviewing logs to see what conversations they had access to.
CISA rethinking risk evaluations
Acting CISA Director Nick Anderson said that CISA is looking to reevaluate how it prioritizes risks and vulnerabilities for both privately owned critical infrastructure and the federal government. As part of this, CISA will issue a binding operational directive for federal agencies to revise vulnerability management practices. Anderson characterized the overall approach to date as applying patches as quickly as possible after release. However, this new directive will ask critical infrastructure operators to focus on the risk associated with the vulnerability and whether it can be exploited, and have a fine-grained understanding of which systems are most important to patch. Andersen framed this directive as a response to the increase in vulnerability disclosures with AI-based tools.
Romance scams target Russian soldiers
The Russian cybersecurity firm F6 released a report detailing a campaign by the group SiribClone, targeting members of the Russian Armed Forces stationed near combat zones and border crossings. These attackers impersonate women, posing to either volunteer humanitarian assistance or engaging in romantic relationships. Both are lures to get soldiers to download malicious apps or share Telegram credentials on spoofed websites. The overall goal of the campaign is to install an Android spyware app called SafeLoveStealer that looks to steal files, monitor communications, and collect sensitive military information. The researchers did not attribute the campaign to a specific country or threat actor.
Huge thanks to our sponsor, Doppel
They use one connected attack chain to hit your brand externally, infiltrate your inbox, and manipulate your team.
Stop playing whack-a-mole with fragmented tools. Doppel unifies Digital Risk Protection, Human Risk Management, and Email Security into one unified platform.
One attack chain. Three pillars of defense. Zero blind spots.
Secure your enterprise relentlessly at doppel.com.
Taiwan considers AI chip limits to China
Bloomberg sources say that Taiwanese authorities are considering stricter export controls on AI chip sales in an attempt to combat smuggling to China. Sales of AI chips to China already require approval by US regulators. Currently, exporting unauthorized AI chips to China isn’t considered a crime in Taiwan unless it’s to entities on a specific ban list. Authorities just warn sellers that they may be breaking US rules. These new export controls would open the door for Taiwan to criminally prosecute all smugglers to China.
WinRAR flaw exploited against Ukraine
Last year, a path traversal flaw was discovered in the popular archive utility WinRAR. The flaw was subsequently patched in July 2025. That’s not stopping two Russian-aligned campaigns from continuing to exploit the flaw in WinRAR against Ukrainian organizations. According to Trend Micro, the groups Earth Dahu and SHADOW-EARTH-066 are both using the flaw in active campaigns. SHADOW-EARTH-066 is using the flaw to install its infostealer, GIFTEDCROOK. Earth Dahu has more of a reputation for industrial-scale efforts to maintain long-term access to compromised organizations and is using the flaw to deliver espionage modules that have been active since at least April.
Another day, another Cisco SD-WAN zero-day
Seven might be a lucky number, but it’s not for Cisco, which is dealing with its seventh actively exploited zero-day in Cisco SD-WAN this year. The vulnerability was first disclosed by Mandiant late last week, although Cisco said it saw “limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices.” The vulnerability requires valid credentials or privileged access and exploits a validation error, allowing an attacker to execute commands as root and opening the door to a range of attacks. There is no current patch or workaround available, and Cisco only said that “a patch for this vulnerability will be provided at a future date.”
Judge throws the book at AI
File this under too good to pass up. Senior United States District Judge for the Northern District of Mississippi, Sharion Aycock, issued a sanctions order against both sides of a federal court case, saying “this court is yet again “burdened with addressing AI hallucinations in court filings.” The case involved a contract dispute with the city of Aberdeen, Mississippi, about unpaid legal fees. However, both sides cited nonexistent, hallucinated cases in their arguments, in what was described as “paying for ChatGPT to argue against itself.” Judge Aycock canceled the trial, disqualifying all four lawyers involved, barring two from appearing in court for two years, and issuing fines up to $3,500. One attorney, Kathleen Wilson, had already been cited multiple times for AI-hallucinated filings, going back to January.