← Risky Bulletin
Loading summary
Transcript1 lines
- [00:04]
A
Rogue OpenAI models were behind last week's Hugging Face breach. The Linux kernel discloses 442 vulnerabilities as the AI bugpocalypse settles in, France becomes the first EU country to pass a social media age limit and Germany takes down the Kratos phishing service. This is the Risky bulletin prepared by Catalyn Kim Panu and read by me, Claire Airdrop. Today is the 22nd of July and this podcast episode is brought to you by Thinkst, the makers of the much loved Thinxt Canary. In today's top story, OpenAI has taken responsibility for last week's hack of the Hugging Face AI model hosting platform. The company says its models escaped their sandboxes during an evaluation of their cyber capabilities and breached Hugging Face servers. The models involved included GPT 5.6 SOL, as well as an unnamed and as yet yet unreleased model. OpenAI says it's working with Hugging Face to investigate the incident. In other news, Google has released Gemini 3.5 Flash Cyber, a cybersecurity model designed to find and patch vulnerabilities. The company has positioned the model as a lightweight alternative to frontier models such as Mythos. Google says the model has already been used internally to find bugs in Chrome and Android and YouTube. The Linux kernel team has disclosed 442 vulnerabilities over the last three days. Both Microsoft and Google also patched hundreds of vulnerabilities this week after finding them with AI. Microsoft patched 620 bugs, while Google patched 433 in its Chrome browser. Companies including Adobe and Oracle have also increased the frequency of patching cycles, citing the rise of AI bug discovery. Threat actors are exploiting a recently disclosed remote code execution in WordPress sites. The vulnerability was patched on Friday and is one of the worst bugs disclosed in the popular WordPress CMS in the last decade. It allows remote attackers to take over WordPress sites in their default configurations. Reconnaissance activity was detected shortly after the disclosure, with attackers now planting web shells on vulnerable installations. Hackers are exploiting a recently disclosed vulnerability to take over Microsoft SharePoint servers. Attacks began hours after Proof of Concept Exploit code was published on Monday. The vulnerability is a remote code execution bug that Microsoft fixed last week. South Korea's Diplomat Academy was breached by unknown hackers last year. In April. The attackers exploited 0 and remain in the academy's network until February this year. The National Diplomatic Services network is still down while officials investigate. The South Korean Ministry of Foreign affairs believes sensitive data relating to more than 6,000 current and past diplomats may have been stolen. Hackers have stolen customer data from healthcare billing software provider craneware. The company says it's evicted the hackers from its network. Craneware's software is used by thousands of hospitals and pharmacies in the US to bill patients. Sol's public bike sharing service will compensate users affected by its 2024 data breach. More than 6.4 million users had their data stolen in the hack. They'll receive a 30 day pass on all Dharangi bikes, allowing them one free hour per day for a month. Two high school students were arrested in February over the hack. The Canadian government has signed the recent UN Convention against Cybercrime. The treaty was adopted in 2024 and offers a legal basis for international cooperation in the fight against online crime. The controversial treaty has been signed by 78 of the UN's 193 members. The convention will come into force once it has been ratified by 40 states. Only three states have ratified it so far. France has passed a law banning children under the age of 15 from social media networks. President Macron will sign the bill into law from September. Social media Companies must ban under 15s from registering new accounts. From January, they'll have to remove existing accounts registered to children under 15. France is the first EU country to pass such a law. US President Donald Trump has signed an executive order requiring defence contractors to map out their supply chains. The order covers hardware, raw materials and software supply chains. The EO is designed to reinforce the ban on using components from adversary countries. German and US authorities have seized the Kratos phishing as a service platform. Kratos has been active since 2024 is and was used in more than 15,000 phishing campaigns. It was primarily used to target Microsoft 365 accounts. Indonesian authorities have also arrested the site's administrator. A threat actor has published more than 7,600 malicious GitHub repositories that pose as legitimate software projects but infect users with infostealers. Almost a fifth of the projects targeted AI users and MCP related technologies, according to Ireland. The campaign has been live since April and received more than 14 million downloads. And finally, Cisco has open sourced Antares, a local AI model for finding vulnerabilities in code bases. The company describes Antares as a small language model due to its size and focus on a single task. The model is intended for local deployment in environments prioritising data security, regulatory compliance and operational control. Antares was released in two versions, one with 350 million parameters and another with 1 billion. A third version with 3 billion model parameters will be released later. And that is all for this podcast edition. Today's show was brought to you by our sponsor, thanks to Canary. Find them at Canary Tools. Thanks to your company, Sam.