Sam's News — security — 2026-08-11¶

AI¶

8 OpenAI expands Daybreak cybersecurity program with GPT-5.6-Cyber model¶

OpenAI expanded its Daybreak cybersecurity program with two access tiers and launched GPT-5.6-Cyber, a specialized model for security researchers that completed 95% of advanced vulnerability tasks compared to 1.5% for standard safeguards. The model has already identified multiple previously unknown vulnerabilities in major software systems.

GPT-5.6-Cyber completed 95% of advanced cybersecurity tasks vs. 1.5% for standard guardrails
Two-tier access: Daybreak Blue (defensive) and Daybreak Red (specialized research)
Discovered 2 zero-days in Chrome V8, 5+ in mobile OS, 3 critical in database, 400+ in OS kernel
Model reached High cybersecurity capability threshold under OpenAI's Preparedness Framework

Sources: Quartz AI Web Searched, TahawulTech.com RSS, gadgets360.com RSS, qz.com RSS, Digital Trends RSS, Infosecurity Magazine RSS

Security¶

8 SAP patches critical code injection and memory corruption vulnerabilities¶

SAP released 28 new and two updated security patches addressing four critical-severity vulnerabilities including improper authorization, code injection, and memory corruption flaws affecting multiple enterprise products.

CVE-2026-58231 (CVSS 10.0): improper authorization in Commerce Cloud Data Hub Adapter enabling authentication bypass
CVE-2026-44772 and CVE-2026-44758: critical code injection in Manufacturing Integration enabling arbitrary command execution
CVE-2026-34265 (CVSS 9.8): memory corruption in NetWeaver ABAP exploitable without authentication
8 additional high-severity notes addressing privilege escalation, buffer overflow, RCE across ABAP, Commerce Cloud, BusinessObjects

Sources: SecurityWeek AI Web Searched, The Hacker News AI Web Searched

8 Researchers disclose AI-assisted exploit chain achieving unauthenticated RCE in Microsoft SharePoint¶

Security researchers publicly disclosed an AI-assisted exploit chain combining two SharePoint vulnerabilities—CVE-2026-55040 and CVE-2026-63520—that together allow unauthenticated remote code execution on on-premises servers.

CVE-2026-55040: CVSS 9.1, JWT auth bypass letting attackers impersonate any user
CVE-2026-63520: CVSS 8.1, unsafe .NET type instantiation enabling RCE, chained by Rapid7
Affects SharePoint Server Subscription Edition, 2019, 2016; SharePoint Online unaffected
AI agent ran 96 sessions, 256 prompts, ~80,000 tool calls over 24 days but needed expert steering
Microsoft's July 2026 patch (KB5002882) breaks the exploit chain; CISA saw no in-the-wild exploitation as of July 14

Sources: The Hacker News AI Web Searched

8 Storm-1175 Deploys StormEncryptor Ransomware Following N-Central Vulnerability Exploitation¶

China-linked group Storm-1175 is deploying a new ransomware strain, StormEncryptor, by exploiting an authentication-bypass flaw in N-able's N-central RMM tool, marking its first activity since April 2026.

Exploits CVE-2026-18577, a patch bypass for CVE-2026-18556 in N-central
StormEncryptor written in C++, appends .encrypted extension
Ransom note demands payment within three days, threatens leaks
Uses AnyDesk, SimpleHelp, Advanced IP Scanner, Mimikatz for lateral movement
CISA flags both N-central CVEs as actively exploited; N-able issued a hotfix

Sources: SC Media AI Web Searched, The Hacker News AI Web Searched, scworld.com RSS

8 Sandworm-Linked Threat Actors Target Ukrainian IT Workers with Fake Job Interviews¶

Sandworm (also known as APT44, Seashell Blizzard, and UAC-0002), a GRU-affiliated Russian state-sponsored threat group, has been running a social engineering campaign since at least May 2026 targeting Ukrainian IT workers, particularly system administrators. The operation, attributed by Ukraine's Computer Emergency Response Team (CERT-UA) to a Sandworm subgroup tracked as UAC-0145, uses fake recruitment campaigns on legitimate Ukrainian job sites. Attackers impersonate recruiters from a fictitious company called Atlas Business Group, falsely claiming to hire for projects involving Sopra Steria Bulgaria, a real European IT services firm. After initial contact via job platform messaging, conversations shift to Telegram where a persona claiming to be an HR manager conducts screening interviews asking about work preferences and English proficiency. Candidates are then invited to a Zoom video call with an English-speaking man appearing to be 30-35 years old (status as live operative or AI-generated persona unclear). The technical interview stage deploys the trap: candidates receive emails mimicking official Sopra Steria correspondence instructing them to connect to a corporate network using WireGuard VPN to complete a test assignment. Provided WireGuard configuration files deliberately produce connection errors. When victims report the errors, attackers direct them to download SopraVPN, a custom VPN application hosted on SourceForge, with download links from a phishing domain (soprasteria-bg[.]com) designed to mimic Sopra Steria's official website. The malicious VPN client is compiled from WireGuard source code with modifications including support for a non-standard 'SymmetricKey' option containing BASE64-encoded data for AES-256-GCM encryption (nonce, ciphertext, and authentication tag). A 32-byte value obtained from decoding 'PrivateKey' serves as the AES-256 key. Decrypted PowerShell code is then passed to the standard 'runScriptCommand'. This represents a strategic shift for Sandworm from destructive infrastructure attacks toward patient intelligence collection and durable network access through compromised system administrator accounts, mirroring tactics previously associated with North Korean financially motivated actors. CERT-UA issued a formal advisory on August 9, 2026.

Sources: The Hacker News AI Web Searched, TechTimes AI Web Searched

8 Cisco warns of exploited high-severity VPN flaw in Secure Firewall ASA and FTD¶

Cisco warned that two vulnerabilities in Secure Firewall ASA and FTD VPN software are being actively exploited, including a critical flaw allowing root-level code execution, tied to the ArcaneDoor espionage campaign.

CVE-2025-20333 (CVSS 9.9): needs VPN creds, allows root code execution
CVE-2025-20362 (CVSS 6.5): unauthenticated access to restricted URLs
Exploited on discontinued ASA 5512-X, 5515-X, 5585-X models
Linked to ArcaneDoor campaign; malware deployed, data likely exfiltrated
Emergency patches released September 26, 2025

Sources: SecurityWeek AI Web Searched, BleepingComputer RSS

8 Ransomware gang hijacks hospital Facebook page following data breach¶

Ransomware group 'The Gentlemen' hijacked AnMed hospital's Facebook page to post ransom demands, claiming to have stolen 6 terabytes of sensitive patient data including records on sexual assault and abortions.

Initial breach occurred July 26, 2026; Facebook hijack on August 11
Claimed 6TB of exfiltrated health data, unverified
10 AnMed facilities remained closed to appointments as of August 10
Group linked to former Qilin affiliate 'hastalamuerte'
Claimed 332 victims in first 5 months of 2026, per CheckPoint

Sources: The Record AI Web Searched

7 Gunra ransomware gang exploits Fortinet flaws, bypasses multi-factor authentication¶

The Gunra ransomware gang has weaponized Fortinet security flaws to circumvent multi-factor authentication defenses.

Sources: Dark Reading RSS, Dark Reading RSS

6 Malicious SIM cards can execute code in cellular IoT devices¶

Researchers demonstrated that malicious SIM cards can execute arbitrary code on cellular IoT devices by exploiting a standards-compliant RUN AT command, with vulnerable devices found in EV chargers, routers, and industrial systems. The attack requires physical SIM access but highlights risks in widely deployed Qualcomm and Quectel modules.

9 of 26 tested devices vulnerable: 7 of 8 IoT modems, 3 of 18 phones (no iPhone/Pixel vulnerable)
5 of 6 vulnerable cellular modules were Quectel components in EV chargers and industrial routers
All vulnerable devices run Qualcomm communication processors
Attack requires physical SIM swap, interposer insertion, or supply chain compromise; no real-world attacks reported

Sources: The Hacker News AI Web Searched, The Register AI Web Searched, Interesting Engineering AI Web Searched

6 Windows Plug and Play abuse enables SYSTEM privilege escalation on Windows 11¶

Researchers demonstrate a Windows Plug and Play attack chain leading to SYSTEM-level code execution on fully patched Windows 11.

Sources: The Hacker News RSS