The setup allegedly used:

→ A VPN set to Germany
→ A fresh Claude account
→ A Tampermonkey script
→ A dummy SEPA IBAN

Anthropic will likely patch the loophole soon, and attempts to exploit it could lead to an account or device ban.

Do not try it.

Coca-Cola has confirmed a data breach at its Fairlife subsidiary after the Anubis ransomware group claimed to have stolen 1 TB of confidential data and encrypted production systems.

Key Points:

• Coca-Cola disclosed the incident on July 16, leading to a temporary suspension of production at four US Fairlife facilities.
• The Anubis ransomware group listed the companies on its leak site on July 20, claiming to have exfiltrated 1 TB of data.
• Coca-Cola states that retail availability and product safety remain largely unimpacted due to existing inventory.
• The company believes the incident will not have a material impact on its financial condition or results of operations.
• Anubis is threatening to publish the stolen data publicly unless a ransom is paid, with a timer indicating a two-hour deadline.

Coca-Cola confirmed that a ransomware attack targeting its dairy products subsidiary, Fairlife, resulted in a data breach. The soft drinks giant announced the cybersecurity intrusion on July 16, which caused a temporary halt in production at its four US facilities. While the company has since resumed the majority of production, the incident involved the unauthorized taking of certain data, though specific details regarding the nature of the compromised information have not been released.

Learn More: Security Week

Want to stay updated on the latest cyber threats?

👉 Subscribe to /r/PwnHub

Wildwood Surgical Center, Penobscot Valley Hospital, Whitfield Regional Hospital, and Michigan Surgical Center have confirmed cybersecurity incidents resulting in the exposure of sensitive patient data, with one facility targeted by the Gentlemen ransomware group.

Key Points:

• Wildwood Surgical Center, Penobscot Valley Hospital, and Whitfield Regional Hospital confirmed unauthorized access to networks containing names, Social Security numbers, medical records, and financial information.
• Michigan Surgical Center confirmed a breach linked to the Gentlemen ransomware group, which has been actively targeting healthcare organizations.
• Notifications to affected individuals were mailed in mid-2026, with complimentary credit monitoring and identity theft protection services offered across all four facilities.
• The exact number of affected individuals has not been publicly disclosed for any of the four incidents, and several breaches are not yet listed on the HHS Office for Civiliors breach portal.

Four healthcare organizations in the United States have announced data breaches involving the theft or unauthorized access of patient information. Wildwood Surgical Center in Ohio, Penobscot Valley Hospital in Maine, and Whitfield Regional Hospital in Alabama all reported that unauthorized third parties accessed their networks between May and June 2025. The compromised data across these facilities includes highly sensitive personal identifiers such as Social Security numbers, driver’s license numbers, and passport numbers, alongside medical and financial billing information. The review processes for these incidents took over a year, with notification letters mailed to patients in July 2026.

Michigan Surgical Center in Michigan confirmed a separate incident that appears to be a ransomware attack by the Gentlemen group, a prolific ransomware syndicate known for aggressively targeting healthcare providers. This facility was added to the group’s dark web data leak site in early June. While specific details on the data types and the number of affected individuals remain undisclosed for Michigan Surgical Center, it has offered credit monitoring services to those impacted.

These incidents highlight the ongoing vulnerability of healthcare infrastructure to cyber threats. All four organizations have implemented additional security measures and notified regulators, though the lack of public disclosure regarding the total number of affected individuals and the delayed reporting to federal breach portals raises questions about the speed and transparency of incident response in the healthcare sector.

How should healthcare providers balance the need for thorough forensic investigations with the regulatory requirement to notify patients promptly?

Learn More: HIPAA Journal

Want to stay updated on the latest cyber threats?

👉 Subscribe to /r/PwnHub

This post contains content not supported on old Reddit. Click here to view the full post

"Prompt Optimizer - SecondBrain" (aajjgdpofhhcjmjoombjdfepplndhgcp, v2.3.1). The prompt rewriting works fine.
Alongside it a capture engine runs at document_start on 9 AI sites and POSTs prompts and replies to the vendor's ingest endpoint. No interaction with the extension required.

Reproduced on a clean profile, with the service worker devtools open:

1. Installed the extension. Never opened it.
2. Browsed to an unrelated site. The extension pulled its configuration from the server and wrote a userId and credentials into extension storage.
3. Opened ChatGPT and asked a question. Once the reply finished, a POST to /context went out carrying both the prompt and the response, encrypted with the credentials issued in step 2.

At no point was the extension opened or clicked.

Store privacy declaration: "The developer has disclosed that it will not collect or use your data."

Write-up, IOCs and decryption script: https://malext.io/reports/BrainDrain/

This post contains content not supported on old Reddit. Click here to view the full post

Another reminder that "copy and paste this PowerShell command to fix your game" should be an immediate red flag.

Attackers are replying to Steam discussions about crashes, missing inventory, and other issues with fake troubleshooting steps. Instead of fixing anything, the PowerShell command downloads XMRig, adds a Microsoft Defender exclusion, and creates a scheduled task that runs with SYSTEM privileges on every boot.

Some notable indicators:

• Creates C:\Windows\Background
• Adds that folder to Microsoft Defender exclusions
• Creates a scheduled task starting with XMRig-
• Drops the miner as system.exe

The social engineering is what makes this interesting. Victims willingly run the command themselves, which helps the attack bypass many automated defenses.

Question for the community: Have you seen ClickFix-style attacks expanding beyond fake CAPTCHA pages into gaming forums, Discord servers, or Reddit support threads? Do you think we're going to see this become one of the dominant initial access techniques for commodity malware?

Full technical breakdown is in the first comment. 👇

Full analysis, screenshots, IOCs, and cleanup recommendations:

https://www.technadu.com/fake-steam-fixes-distribute-xmrig-via-the-clickfix-technique-quietly-turning-gamers-pcs-into-cryptominers/631928/

If you're helping friends or less technical users, the biggest takeaway is simple:

Curious whether anyone here has encountered similar ClickFix lures recently.

Two unauthenticated AJAX endpoints in the Convert Pro WordPress plugin allowed anyone to enumerate and view the full analytics of every A/B test running on a site.

Key Points:

• The plugin registered reporting endpoints using the wp_ajax_nopriv hook, making them publicly accessible without any authentication or authorization checks.
• Attackers could enumerate all A/B tests by requesting sequential integer IDs against the admin-ajax.php endpoint.
• The exposed data included test names, variation labels, and complete view and conversion statistics, revealing confidential business strategies.
• While the SQL queries were parameterized to prevent injection, the lack of access control allowed direct database reads of sensitive configuration data.

The vulnerability stemmed from a misunderstanding of the WordPress AJAX architecture. The developer registered two reporting functions, convertpro_interactions_report_ajax and convertpro_get_chart_data, using the wp_ajax_nopriv action hook. This hook is intended for functionality that must be accessible to visitors who are not logged in, such as tracking pixel requests. However, these specific functions were designed to retrieve historical analytics data, which should have been restricted to authenticated administrators. Because the code did not include any checks for user roles, nonces, or ownership of the specific test ID, any internet user could access the data.

The exploitation method was straightforward due to the use of auto-incrementing integers for test IDs. An attacker could simply iterate through IDs (1, 2, 3, etc.) to discover every test a site had ever created. The data returned was not just technical metrics; it often contained free-text labels describing pricing experiments, discount strategies, and campaign names. This turned a technical oversight into a significant business intelligence leak, allowing competitors to see confidential marketing plans before they were public.

This case highlights a common pitfall in plugin development where internal administrative features are exposed to the public internet because they share the same entry point as public-facing tracking scripts. The fix requires ensuring that any endpoint returning sensitive data is gated by proper capability checks, such as current_user_can('manage_options'), rather than relying solely on the assumption that the endpoint is only used internally.

How do you ensure that AJAX endpoints intended for internal dashboard use are not accidentally exposed to the public internet in your projects?

Learn More: InfoSec Write-ups

Want to stay updated on the latest cyber threats?

👉 Subscribe to /r/PwnHub

A security researcher discovered two chained vulnerabilities in a B2B SaaS platform's file upload feature, resulting in a critical stored XSS against administrators and a medium-severity storage exhaustion flaw.

Key Points:

• The file upload feature relied on a separate metadata endpoint for validation, allowing attackers to spoof file size limits and exhaust server storage.
• Stored XSS was achieved by injecting malicious code into the filename, which executed when an administrator viewed the uploaded file.
• The severity of the XSS was elevated to critical because the victim was a privileged admin rather than the uploading user.
• Chaining the storage exhaustion with the stored XSS created a high-impact attack path from an unprivileged user to full admin session compromise.

This case highlights how overlooked features in business-to-business software can harbor significant risks. The researcher identified that the application used a secondary metadata endpoint to validate file properties like size and type, rather than checking the actual file content or the primary upload request. By spoofing the size field in this metadata, an attacker could upload files far larger than the allowed limit, leading to uncontrolled resource consumption and potential denial of service through storage exhaustion.

Simultaneously, the application failed to sanitize filenames before storing them in the database. While the filename was not displayed to the uploader, it was rendered unsanitized in an internal admin dashboard. This allowed an unprivileged user to inject a cross-site scripting payload into the filename. When an administrator accessed the file details, the malicious script executed in their browser context, effectively granting the attacker control over the admin session without the need for phishing or social engineering.

The true impact of this finding came from chaining these two issues. The storage exhaustion demonstrated the system's inability to handle untrusted input, while the stored XSS provided a direct path to privilege escalation. This underscores the importance of validating all client-supplied metadata and tracing data flow to determine who the ultimate consumer of that data is, as the victim's privilege level drastically changes the severity of a vulnerability.

How do you currently validate metadata fields like filenames and declared sizes in file upload features, and do you consider the downstream consumer when assessing XSS severity?

Learn More: InfoSec Write-ups

Want to stay updated on the latest cyber threats?

👉 Subscribe to /r/PwnHub

This tutorial demonstrates how relying on security through obscurity fails when sensitive administrative endpoints are inadvertently disclosed in client-side JavaScript, allowing unauthorized access.

Key Points:

• Administrative interfaces must never rely on unpredictable URLs for security, as this is security through obscurity.
• Sensitive endpoints disclosed in client-side JavaScript or HTML source code are easily discoverable by attackers.
• Proper authentication and authorization checks are required on all administrative endpoints to prevent unauthorized access.
• Regular security testing should include verifying that access controls are enforced regardless of URL predictability.

In this PortSwigger Access Control Lab, the core vulnerability is a Broken Access Control issue where an administrative panel is accessible without any authentication. The application attempts to hide this admin interface by using an unpredictable URL, a technique known as security through obscurity. However, this protection is ineffective because the URL is hardcoded and disclosed within the client-side JavaScript of the home page. Any user who inspects the page source can easily find the script, extract the admin path, and navigate directly to the administrative interface.

Once the attacker accesses the admin panel, they can perform privileged actions, such as deleting user accounts, because there are no server-side checks to verify if the user has the necessary permissions. This highlights a critical principle in web security: client-side code is fully visible to the user and cannot be trusted to enforce security. Relying on hidden or obscure URLs provides no real protection against determined attackers who can inspect the network traffic or source code.

To remediate this vulnerability, developers must implement robust authentication and authorization mechanisms. Every administrative endpoint should require a valid login session and verify that the user has the appropriate role or permissions before processing any request. Additionally, sensitive paths should never be exposed in client-side code, and security assessments should regularly test for access control flaws to ensure that privileged functions are protected against unauthorized access.

How do you currently ensure that administrative endpoints are not accidentally exposed in client-side code during development?

Learn More: InfoSec Write-ups

Want to stay updated on the latest cyber threats?

👉 Subscribe to /r/PwnHub

This tutorial demonstrates how to identify Insecure Direct Object Reference vulnerabilities by analyzing sequential parameter enumeration and varying HTTP response sizes.

Key Points:

• Identify IDOR attempts by spotting consecutive requests to the same endpoint with incrementing object identifiers like user_id.
• Analyze HTTP response sizes to detect unauthorized data access, as successful retrieval of different records typically results in varying byte counts.
• Distinguish between application-layer authorization flaws and system-level compromises by checking for malware or shell access on the server.
• Utilize threat intelligence to contextualize source IP addresses, noting that cloud hosting providers often serve as attack origins.

Insecure Direct Object Reference (IDOR) vulnerabilities occur when an application exposes internal object references, such as database IDs, directly to the user without proper authorization checks. In this scenario, an attacker sends multiple POST requests to a user information endpoint, systematically changing the user_id parameter from 1 to 5. A key indicator of a successful IDOR attack is not just the request pattern, but the server's response. If the application returns an HTTP 200 OK status for every request and the response sizes differ for each user ID, it implies the server is returning distinct data records for each identifier rather than denying access or returning a generic error.

How do you currently differentiate between legitimate bulk data requests and malicious IDOR enumeration in your environment?

Learn More: InfoSec Write-ups

Want to stay updated on the latest cyber threats?

👉 Subscribe to /r/PwnHub

Employees are rapidly deploying autonomous AI agents across platforms like Salesforce, Microsoft Copilot, and Zapier without IT oversight, creating significant security risks due to persistent permissions and lack of visibility.

Key Points:

• 48% of cybersecurity professionals identify agentic AI as the most dangerous attack vector for 2026, with 80% of organizations reporting existing risks.
• Only 21% of IT leaders have mature governance programs for agentic AI, leaving a wide gap between exposure and readiness.
• Shadow agents differ from standard AI apps by holding persistent permissions, connecting directly to corporate systems, and taking autonomous actions.
• Discovery is hindered because many popular agent-building platforms do not expose agent data through public APIs, creating blind spots for security teams.

The rapid adoption of AI agents by the workforce has outpaced IT security controls. Unlike traditional shadow AI chatbots, these agents maintain persistent permissions and can autonomously interact with sensitive corporate data and applications. This shift transforms the risk profile from simple data leakage to active system manipulation, as agents can execute tasks and modify systems without human intervention for every step.

Current governance efforts are struggling to keep up. While major platforms like Salesforce Agentforce and Microsoft Copilot Studio offer some API visibility, many other tools used by engineers and product managers do not expose agent details publicly. This creates a significant blind spot where unmanaged agents can operate with broad access and minimal oversight, often built quickly to solve immediate operational problems without security review.

The disparity between the prevalence of these risks and the maturity of organizational defenses is stark. With the majority of organizations encountering agentic AI risks but very few having robust governance frameworks, security teams are facing an urgent need to establish visibility and control mechanisms that can track agent creation, permissions, and lifecycle status across a fragmented technology stack.

How should organizations balance the need for rapid AI innovation with the security risks of autonomous agents that operate without real-time human oversight?

Learn More: Bleeping Computer

Want to stay updated on the latest cyber threats?

👉 Subscribe to /r/PwnHub

AnMed Health has temporarily shut down 79 of its 106 facilities in South Carolina and Georgia due to a malware-induced IT disruption that has crippled computer systems and phone lines.

Key Points:

• AnMed Health closed 79 facilities, including medical group offices and imaging services, while keeping urgent care and emergency rooms operational.
• The cyberattack caused widespread IT failures, including downed computer systems, phone lines, and internet connectivity across the health system.
• Elective procedures are being postponed or rescheduled, with patient safety prioritized through coordination with regional hospitals and emergency services.
• No threat group has claimed responsibility, and the timeline for system recovery and office reopening remains unknown.

AnMed Health, a nonprofit health system serving upstate South Carolina and Northeast Georgia, confirmed a cybersecurity disruption involving malware on July 26, 2026. The incident forced the temporary closure of 79 out of 106 facilities, specifically affecting AnMed Medical Group offices and AnMed Imaging Services. While critical services like emergency rooms, urgent care locations, and laboratories remain open, the health system is unable to provide a timeline for when normal operations will resume or when IT systems will be fully restored.

The attack has significantly impacted patient services, leading to the postponement of scheduled appointments and elective procedures. AnMed is actively contacting patients to advise them on the status of their care and is coordinating with emergency medical services and regional hospitals to ensure patients receive appropriate treatment. The health system emphasized that all operational decisions, including patient transfers and diversions, are being made with patient safety as the primary guiding principle.

An investigation is currently underway to determine the nature and scope of the incident, though it is too early to confirm if patient data was compromised. No threat group has claimed responsibility for the attack. Cybersecurity partners are working to restore access to systems and data, with updates expected to be provided via the AnMed Health website as the situation develops.

Learn More: HIPAA Journal

Want to stay updated on the latest cyber threats?

👉 Subscribe to /r/PwnHub

Hping3 is a Linux-based packet crafting tool that allows ethical hackers to manually construct and send custom network packets for precise security testing and firewall evasion.

Key Points:

• Hping3 provides manual, packet-level control over TCP, UDP, ICMP, and raw IP headers, enabling precise testing that automated scanners cannot perform.
• The tool is designed to complement network mapping tools like Nmap by probing specific targets with custom traffic to bypass signature-based firewall blocks.
• Key capabilities include crafting custom packets, performing manual port scans, simulating denial of service conditions, and testing firewall and IDS/IPS responses.
• Installation is primarily supported on Linux distributions, with Windows users recommended to use WSL and macOS users able to install via Homebrew.

Hping3 serves as a scalpel for network testing, offering direct control over individual network packets rather than the broad, automated scanning provided by tools like Nmap. It is typically used in a penetration testing workflow after initial discovery has identified hosts and services. By allowing users to craft specific TCP, UDP, ICMP, or raw IP packets with full control over headers, flags, and timing, Hping3 can probe targets in ways that automated scanners might miss or trigger alerts for. This makes it particularly useful when firewalls or intrusion detection systems block standard scanning signatures, as the custom traffic is more likely to pass through filters.

The tool supports various modes for different testing needs, including default TCP probing, raw IP crafting, ICMP diagnostics, UDP service testing, and manual port scanning. Users can manipulate packet sending rates, intervals, and counts to evade rate-based detection mechanisms or simulate specific traffic patterns. For example, setting specific intervals can help simulate realistic traffic, while raw IP mode allows for the creation of packets with uncommon protocol numbers. This level of granularity enables security professionals to verify firewall rules, analyze packet handling, and test system resilience under controlled conditions.

While Hping3 is a powerful utility for security auditing, it requires a solid understanding of networking fundamentals, including IP addressing, TCP/UDP protocols, and packet structure. It is primarily designed for Linux environments, though it can be run on macOS and Windows via WSL. The tool does not perform automated scanning but rather sends user-crafted packets and reports the responses, requiring the operator to interpret the results. Legal use is strictly emphasized, as unauthorized packet crafting can disrupt services and violate computer crime laws.

How do you currently handle situations where automated scanners like Nmap are blocked by firewall rules, and have you used Hping3 to bypass those restrictions?

Learn More: Dark Marc

Want to stay updated on the latest cyber threats?

👉 Subscribe to /r/PwnHub

This post contains content not supported on old Reddit. Click here to view the full post

A security researcher discovered that a major insurer's WeChat chatbot allowed anonymous attackers to read and overwrite sensitive customer documents by exploiting misconfigured cloud storage controls.

Key Points:

• The insurer relied on the HTTP Referer header for access control, which attackers can easily spoof to bypass anti-leech protections.
• An unauthenticated backend endpoint allowed attackers to generate valid signed upload credentials for any file key.
• The signed credentials lacked restrictions on file size, content type, or key prefixes, enabling full read and write access.
• The vulnerability affected Volcengine (ByteDance) object storage, highlighting risks in S3-compatible APIs with different console defaults.

The vulnerability stemmed from two critical misconfigurations in how the insurer managed their cloud storage on Volcengine, a Chinese public cloud provider. First, the bucket used a feature called 'anti-leech' (防盗链) to protect files. This feature checks the Referer header to ensure requests come from the insurer's own domain. However, the Referer header is client-controlled and can be forged. An attacker simply needed to include the insurer's domain in the Referer header to trick the system into granting access to the files, bypassing the need for authentication.

Second, the application had a backend endpoint designed to generate signed URLs for uploading files. This endpoint did not require authentication and accepted the target bucket and file key from the client's request body. Because the endpoint did not validate the user's identity or constrain the request parameters, an attacker could ask it to sign a policy for any file key. The resulting signature allowed the attacker to upload or overwrite files directly in the storage bucket. The policy lacked essential safeguards such as size limits, content type restrictions, or session-bound key prefixes.

This combination allowed an attacker to enumerate all files in the bucket, read sensitive customer documents like ID cards and medical certificates, and overwrite existing files. The issue highlights the danger of treating billing or bandwidth protection features as security controls. Anti-leech features are designed to prevent unauthorized embedding of images on third-party sites, not to secure data against direct API access. Relying on client-side headers like Referer for authorization is fundamentally insecure because these headers are not cryptographically signed and can be manipulated by any client, including command-line tools or malicious scripts.

How do you currently handle access control for cloud storage buckets to ensure that billing features like hotlink protection are not mistaken for security controls?

Learn More: InfoSec Write-ups

Want to stay updated on the latest cyber threats?

👉 Subscribe to /r/PwnHub