ServiceNow Pre-Auth RCE Exploited, Hugging Face Breach Exposed

Post Views: 6

Week in Review

The past week saw significant developments in cybersecurity, including active exploitation of critical vulnerabilities and high-profile breaches. Key incidents and analyses include:

Hugging Face breach attributed to autonomous AI agent

A widely used platform for sharing open-source machine learning models and datasets experienced a security incident. The company disclosed unauthorized access to internal datasets and credentials, which it linked to an autonomous AI agent system. The breach occurred earlier in the week, with the platform identifying the intrusion and initiating remediation efforts.
ServiceNow pre-authentication RCE exploited in the wild

Threat intelligence firm Defused reported that attackers are actively exploiting CVE-2026-6875, a critical pre-authentication remote code execution (RCE) vulnerability in the ServiceNow AI Platform. This flaw allows unauthenticated users to escape the platform’s script sandbox and execute arbitrary code on targeted instances. The vulnerability has been observed in real-world attacks, prompting urgent mitigation advice.
SonicWall SMA zero-day attacks predated public disclosure

Researchers from Volexity revealed that two recently disclosed vulnerabilities in SonicWall SMA 1000 devices—CVE-2026-15409 and CVE-2026-15410—were exploited in zero-day attacks for weeks before their public disclosure. These flaws enabled threat actors to install custom malware on vulnerable virtual private network (VPN) appliances, highlighting the risks of delayed patching.
JadePuffer ransomware targets AI infrastructure

The threat group JadePuffer, previously linked to AI-driven extortion campaigns, is now deploying ENCFORGE ransomware to target artificial intelligence and machine learning (ML) infrastructure. The ransomware’s extortion mechanism mirrors tactics used in earlier attacks, with the same contact method identified by Sysdig researchers.
SharePoint RCE exploitation and mitigation

Attackers are leveraging a critical SharePoint remote code execution vulnerability (CVE-2026-50522) to extract IIS machine keys from compromised servers. Security teams are advised to apply patches promptly and rotate machine keys to mitigate risks associated with this flaw.
OpenAI claims involvement in Hugging Face breach

In a separate development, OpenAI stated that its models were used during a cyber capability test that led to the Hugging Face breach. The company’s statement followed Hugging Face’s disclosure of unauthorized access to internal datasets, though the exact scope and impact of the incident remain under investigation.
Check Point authentication bypass vulnerability exploited

A critical authentication bypass flaw (CVE-2026-16232) affecting Check Point Security Management and Multi-Domain Security Management servers is being actively exploited. This vulnerability allows attackers to gain control of firewall management systems, underscoring the need for immediate patching.
Anthropic Claude Artifacts abused for malware distribution

Huntress researchers uncovered a campaign where threat actors exploited Anthropic’s Claude Artifacts feature to redirect users to malicious content. The attack targeted employees at 29 organizations, highlighting the risks of leveraging AI tools for phishing and malware distribution.
AI agent security gaps in enterprise environments

As AI integration accelerates, security teams face challenges in monitoring and governing AI agents. A study revealed that 42% of organizations identified critical vulnerabilities outside scheduled testing windows, emphasizing the need for continuous security validation.
Italy fines WINDTRE for data security failures

Italian data protection authorities imposed a €1.7 million fine on WINDTRE following two data breaches caused by security shortcomings. The incidents exposed personal data of over 365,000 customers, prompting regulatory action against the telecommunications provider.
Paidwork breach exposes 23 million user records

A security incident at Paidwork, a platform for microtask-based earnings, led to the exposure of data belonging to 23 million users. The breach involved sensitive information such as names, addresses, and financial details, raising concerns about the platform’s security measures.
Microsoft 365 calendar espionage malware

Researchers at Group-IB discovered HOLLOWGRAPH malware using Microsoft 365 calendars as an espionage channel. Attackers embedded commands and stolen files in calendar entries with future dates, evading detection and enabling long-term surveillance.
Estée Lauder data breach tied to Oracle EBS vulnerability

The cosmetics company disclosed a breach linked to a vulnerability in Oracle E-Business Suite (EBS), which impacted human resources operations. The stolen data included sensitive information such as Social Security numbers, bank account details, and health records.
AI-generated phishing campaigns surge

A study found that 10% of simulated phishing attempts were reported to security teams, while the remaining 90% went unchallenged. Attackers increasingly use AI to craft convincing phishing emails, exploiting human error to gain unauthorized access.
Ransomware targeting healthcare supply chains

Flare researcher Assaf Morag’s analysis revealed that ransomware groups are expanding their focus to the entire healthcare supply chain, including vendors and partners. This shift underscores the need for robust security measures across interconnected systems.
Google introduces CodeMender for AI-assisted vulnerability fixes

Google launched CodeMender, an AI agent designed to identify security flaws, validate their exploitability, and generate patches. The tool aims to counteract the growing use of AI by attackers, enabling faster remediation of vulnerabilities.
Russian hackers exploit unpatched Zimbra servers

A Russian state-sponsored group, Laundry Bear, has been exploiting a Zimbra Collaboration Suite vulnerability to steal emails from government and commercial networks. The attack highlights the risks of delaying software updates.
Meta introduces AI verification badges

Meta rolled out a free verification badge to distinguish human profiles from AI-generated accounts. The feature is intended to reduce fraud on platforms like Marketplace and dating services by verifying user identities through selfie checks.
Open-source AI projects face deployment challenges

Mozilla’s 2026 report on open-source AI noted that nearly half of AI projects never reach production due to obstacles in deployment, governance, and tooling. As model capabilities improve, addressing these challenges remains critical for widespread adoption.
Windows 10 end-of-support security risks

With Microsoft ending support for Windows 10 in October 2025, 16.9% of devices still running the OS face unpatched vulnerabilities. The lack of security updates leaves these systems exposed to emerging threats.
AI-generated security reports prompt policy changes

Open-source projects like GNOME are revising vulnerability disclosure policies to address the growing volume of AI-generated reports. The shift aims to ensure transparency and accountability in security disclosures.
Laptop drive encryption vulnerabilities exposed

Researchers tested 38 hardware-encrypted drives and found potential weaknesses in their implementation. The findings raise concerns about the reliability of built-in encryption for protecting sensitive data.
Open-source maintainers face funding challenges

Despite rising sponsorship totals exceeding $100 million, many open-source maintainers remain underfunded. This gap leads to slower security updates and increased risks in software supply chains.
AWS introduces AI-powered threat investigation tool

Amazon GuardDuty’s new investigation agent uses AI to automate the initial steps of threat analysis, reducing response times for security teams. The feature is part of a broader effort to enhance cloud security.
Agentic AI reshapes cloud operations

Unisys’ AI Cloud Insights Report highlights the growing role of agentic AI in managing cloud environments, automating tasks, and supporting decision-making. Enterprises are increasingly integrating AI into cloud application management.
Cybersecurity hiring challenges persist

The SANS 2026 Cybersecurity Workforce Survey revealed a doubling of demand for specialized roles, alongside increased hiring for existing positions. The shortage of skilled professionals remains a critical issue for organizations.
Continuous security validation reveals hidden risks

Synack’s report found that 95% of organizations identified critical vulnerabilities outside scheduled testing periods, with 42% encountering them monthly. This underscores the importance of ongoing security monitoring.
Google’s Gemini 3.5 Flash Cyber model targets vulnerabilities

Google’s AI model, Gemini 3.5 Flash Cyber, is designed to detect and patch vulnerabilities before exploitation. The tool is part of a pilot program targeting government and enterprise users.
GitHub updates bug bounty program

GitHub revised its bug bounty program to prioritize high-quality reports and reduce low-effort submissions, including AI-generated ones. The changes take effect in July 2026.
PyPI strengthens package security

The Python Package Index (PyPI) now blocks new file uploads to releases older than 14 days, reducing the risk of tampering with outdated packages.
Ransomware trends in 2026

Black Kite’s 2026 Ransomware Report highlights a fragmented market with multiple groups operating simultaneously. The report notes no signs of a slowdown in ransomware activity.
Automotive software vulnerabilities pose risks

Modern vehicles rely heavily on software, with critical systems running on operating systems like QNX and VxWorks. These systems are vulnerable to attacks that could compromise safety and functionality.
Google introduces camera-based sign-in

Google’s new sign-in method uses a selfie video to verify user identity, aiming to prevent bot and AI-generated account abuse. The feature is not available in all regions.
Microsoft tightens Windows enterprise activation security

Microsoft requires Trusted Platform Module (TPM)-backed attestation for Windows Key Management Service (KMS), replacing the previous software-only model. This enhances security for enterprise volume activation.
AppViewX Agent Identity Security addresses AI governance

The product enables zero-trust security for AI agents by monitoring and governing their identities throughout their lifecycle. It is part of the AppViewX platform.
Cybersecurity job market remains competitive

A weekly selection of cybersecurity roles highlights the demand for diverse skill levels, reflecting the industry’s growth and evolving needs.
New infosec products of the week

Recent releases include tools from Astelia, Druva, Swimlane, and ThreatDown, addressing various security challenges.