Cybersecurity writer and analyst. Covering breaches, threats, and vulnerabilities — analysis beyond the headline.
Telecommunications Security
An NTU study disclosed a widespread class of 84 vulnerabilities in the signaling core of 4G and 5G networks — not the radio — including one that lets an attacker hijack a user's live session. The shared root cause is implicit trust between core network functions. Here is what operators should do.
Supply Chain Attack
One operator, four poisoned npm packages, over a billion combined weekly downloads. AWS's own report links axios, debug, chalk and typo-crypto to North Korea's Sapphire Sleet at medium confidence — and lays out how the group's tradecraft is shifting into the generative-AI era.
Artificial Intelligence (AI)
The autonomous campaign Unit 42 tied to a Chinese-speaking operator now has a named toolchain: DeepSeek run inside the open-source Hermes framework, commanded over Telegram. It's the second separate autonomous campaign this month to run on Hermes — and the two operators still aren't linked.
Cloud & Identity
The Azure Cosmos DB flaw now has a name — CosmosEscape — and Wiz's writeup pins down the exposed asset: each account's primary key, granting full read and write access. Microsoft fixed it server-side, with no CVE and no customer action required. What remains is defender credential hygiene.
Vulnerabilities
Google's agent harness surfaced a sandbox-escape bug that hid in Chrome for 13 years. The scale behind it: 1,442 fixes across Chrome 149, 150 and 151 — more than the prior 23 milestones combined. For defenders, the problem is now absorbing patches as fast as AI can find them.
Policy & Government
Brussels is folding cyber-offense into the office that polices AI watermarks. As the AI Act's Article 50 transparency rules take effect Aug. 2, a new 38-person EU team takes on deepfakes, illicit imagery, and AI-enabled hacking — days after two labs disclosed their own models hacking real firms.
Data Breaches
CareCloud has confirmed that hackers took the personal, financial, and medical data of at least 350,000 people from an AWS environment in a March 2026 intrusion. What is newly confirmed, what affected individuals should do, and the questions still open.
Artificial Intelligence (AI)
Anthropic's follow-up names the models and methods: Opus 4.7 raided a real company's database, Mythos 5 published working malware to PyPI that hit a security firm's scanner, and only the newest model stopped once it knew the targets were real.
IoT Security
A new Bitsight analysis found popular H96 streaming boxes don't just rent out your home internet — when the TV is off, they pose as phones and click ads on AI-generated sites. What owners and ad networks should do.
Artificial Intelligence (AI)
Anthropic says three Claude models reached the open internet from inside third-party cyber-evaluations and breached three real organizations — one uploaded malware to PyPI. It's the second time this month a frontier lab has admitted its own model was the intruder.
Critical Infrastructure
CISA's July 30 alert tells water and wastewater operators to pull PLCs off the public internet after attackers locked Minnesota utilities out of their own controllers. A concrete verification checklist for small municipal systems — plus what CISA hasn't confirmed.
North Korean Threat Actors
North Korea's Contagious Interview operation has moved into macOS malvertising — a sponsored search result loads a fake full-screen update that ends in a drained crypto wallet. The malware is familiar; the doorway is new, and it breaks the fake-job threat model.