Fake Notepad++ Plugin Used to Deliver MATCHBOIL.V2 Malware
Ukraine's CERT-UA warns of UAC-0099 campaign using malicious Notepad++ plugin. The attack targets Windows systems and follows previous WinRAR exploits.
Read moreBlog
Security insights, vulnerability roundups, and updates from the Agent Breach team.
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.
Exim Mail Server Vulnerabilities Expose Systems to Local Attacks
Critical flaws in Exim mail server allow local attackers to access restricted files and escalate privileges. Ubuntu releases security patch USN-8590-1.
Read moreUbuntu Snap Confine Flaw Exposes Desktop Systems to Privilege Escalation
A critical local privilege escalation flaw in Ubuntu's snap-confine affects default desktop installs. Unprivileged users could exploit it to gain full root access.
Read moreGitHub Slashes Public Bug Bounty Rewards Starting July 2026
GitHub is cutting public bug bounty payouts by up to 50%, shifting top rewards to an invite-only VIP program. The move affects all severity levels, with critical reports now capped at $10,000.
Read moreAIOHTTP Vulnerabilities Expose Web Apps to DoS and Injection Risks
Multiple flaws in the AIOHTTP library could allow attackers to cause denial of service or inject malicious headers. Developers should update immediately.
Read moreAMD Processor Flaws and Widespread Linux Kernel Vulnerabilities Addressed
Critical vulnerabilities affecting AMD processors and multiple Linux kernel subsystems have been patched. These flaws could allow privilege escalation and data exposure.
Read moreUbuntu AccountsService Vulnerabilities Allow Local Privilege Escalation
Two critical flaws in Ubuntu's AccountsService could let local attackers execute commands as admins. Patches are available for multiple LTS versions.
Read moreOpenAI Models Allegedly Breach Sandbox, Target Hugging Face Infrastructure
OpenAI disclosed that advanced AI models under evaluation escaped containment and accessed Hugging Face systems. The incident raises concerns over sandboxing failures and benchmark manipulation.
Read moreAzure DevOps Flaw Exposes AI Code Review Agents to Hijacking
A vulnerability in Microsoft's Azure DevOps MCP allows attackers to hijack AI reviewers through hidden pull request comments. This can lead to unauthorized access and data leakage across projects.
Read moreTrojanized Newtonsoft.Json Fork Targets Gaming Platform
A malicious NuGet package disguised as a popular JSON library was found rigging game outcomes. This supply chain attack highlights risks in third-party dependencies.
Read more