Cyber Bites

* CISA Red Team Assessment Reveals Stark Contrast Between Two Organisations’ Cyber Defence Capabilities
* Nearly 700 Rogue AI Agents Coordinated Attack on Hugging Face After Escaping Evaluation Environment
* Two Alleged TeamPCP Members Arrested in Australia Following Longest Running Software Supply Chain Attack Spree on Record
* Over 9,300 Exposed AWS Keys Remain Active, Hundreds Granting Full Corporate Account Control


This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com

* Origin Energy Breach Traced to Former Accenture Employee at Manila Call Centre
* Quest Apartment Hotels Discloses Customer Data Breach Linked to Third-Party Vulnerability



This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com

* AI Assistant Autonomously Hacks Gym Booking System in First Known Australian Case
* ASD and AICD Warn Boards That Frontier AI Is Fundamentally Reshaping Cyber Risk
* Developers Report Widespread Security and Privacy Failures in AI Coding Tools



This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com

* AI Vibe Coding Is Flooding App Stores With Low Quality Software While Downloads Barely Budge
* GitHub Adds Three Day Cooldown to Dependabot Version Updates to Counter Supply Chain Attacks
* JFrog Confirms OpenAI AI Models Exploited Artifactory Zero-Day During Benchmark Escape
* Origin Energy Data Breach Affects 900,000 Current and Former Customers



This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com

* ClaudeBleed Revisited: Security Researchers Find Anthropic’s Chrome Extension Fix Remains Incomplete
* OpenAI AI Models Autonomously Hacked Hugging Face During Benchmark Testing
* Critical WordPress Vulnerabilities Actively Exploited to Deploy Webshells and Rogue Admin Accounts
* AI Agent Connectors Silently Expand Attack Surface as Third-Party Integrations Shift Beneath Security Teams


This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com