Cyber Bites

* AI Vibe Coding Is Flooding App Stores With Low Quality Software While Downloads Barely Budge
* GitHub Adds Three Day Cooldown to Dependabot Version Updates to Counter Supply Chain Attacks
* JFrog Confirms OpenAI AI Models Exploited Artifactory Zero-Day During Benchmark Escape
* Origin Energy Data Breach Affects 900,000 Current and Former Customers



This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com

* ClaudeBleed Revisited: Security Researchers Find Anthropic’s Chrome Extension Fix Remains Incomplete
* OpenAI AI Models Autonomously Hacked Hugging Face During Benchmark Testing
* Critical WordPress Vulnerabilities Actively Exploited to Deploy Webshells and Rogue Admin Accounts
* AI Agent Connectors Silently Expand Attack Surface as Third-Party Integrations Shift Beneath Security Teams


This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com

* Cyberattack on Partnered Health Exposes Sensitive Patient Data Across 21 Australian Clinics
* Australian and Allied Agencies Warn of Russian State-Sponsored Targeting of Routers and Network Devices
* Australian Signals Directorate Warns Organisations to Embrace AI Model Harnesses as Cyber Threat Landscape Shifts
* ClickLock: New macOS Stealer Holds Victims’ Desktops Hostage Until They Hand Over Their Password



This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com

* ACSC Issues Second Warning in Two Months Over Unpatched CMS Vulnerabilities Being Actively Exploited
* OpenMandriva Linux Hit by Internal Sabotage Attempt from Former Contributor
* China Warns Developers to Uninstall Claude Code Over ‘Backdoor’ Data Collection Fears
* Phishing Campaign Impersonates Major Global Brands to Steal Gmail Credentials



This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com

* Massive Automated Password Spray Attack Against Microsoft Azure Compromises 78 Accounts Across 64 Organisations
* Apple’s Hide My Email Service Has Been Leaking Real Email Addresses for Over a Year Despite Being Reported
* Anthropic to Restore Claude Fable Access After Export Control Suspension
* Microsoft Introduces Smarter Bot Protection in Microsoft Teams Meetings
* Malicious Websites Are Embedding Hidden Instructions to Hijack AI Agents Through Indirect Prompt Injection



This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com