NCU-ISAO

We help Credit Unions reduce their security and fraud risk through information sharing and collaboration.

[BleepingComputer @BleepinComputer]

Over 24,000 exposed server BMCs leak password hash via decades-old flaw
https://t.co/Ldr9VxCOmq

https://t.co/Ldr9VxCOmq

[The Hacker News @TheHackersNews]

🚨 OpenAI says the Hugging Face breach was broader than first disclosed.

The system used exposed credentials to access four third-party accounts, using one as a relay and staging point and another for data storage.

Read the new details: https://t.co/4XdUaRjhNf

[The Hacker News @TheHackersNews]

‼️ BREAKING — Claude AI found a working HAWK-256 key-recovery attack.

HAWK is a NIST post-quantum cryptography candidate. It also made an impractical 7-round AES-128 attack up to 800x faster.

Read this here: https://t.co/JbDhrTjjt2

[BleepingComputer @BleepinComputer]

New Certighost PoC exploit lets attackers hijack Windows domains
https://t.co/R1RbrlKqlw

https://t.co/R1RbrlKqlw

[The Hacker News @TheHackersNews]

🚨 Attackers are exploiting a CVSS 10.0 command injection flaw in on-prem Arista VeloCloud Orchestrator.

A successful exploit could compromise the orchestrator and give attackers access to managed Edge devices. CISA has ordered federal agencies to patch by July 30.

Details: https://t.co/nkd4dQGLqA

[The Hacker News @TheHackersNews]

🛑 A hacker switched off Hermes AI’s command approvals and set the agent loose to automate post-exploitation inside Thailand’s Finance Ministry.

It scanned hosts, searched for ways to gain root access, and crawled staff files dating to 2012. The operation surfaced because the attacker left its logs exposed.

Read the full story: https://t.co/0Y3ZhcSitt

[BleepingComputer @BleepinComputer]

Russian hackers exploit Zimbra zero-click flaw for email theft
https://t.co/Q3aDAE5lOi

https://t.co/Q3aDAE5lOi

[The Hacker News @TheHackersNews]

🛑 Kimi K3 AI agents found Redis 0-days. Then they built working RCE exploits.

The authenticated chains abuse RESTORE across multiple #Redis releases. Redis has shipped seven security updates, with no exploitation reported in the wild.

Details: https://t.co/dwbmxBmFiG

[BleepingComputer @BleepinComputer]

New InfraTrust report reveals infrastructure flaws admins should patch first
https://t.co/e0MN81QL34

https://t.co/e0MN81QL34

[The Hacker News @TheHackersNews]

⚠️ Attackers are exploiting a Check Point SmartConsole flaw that can grant full administrative access.

CVE-2026-16232 affects management servers exposed directly to the internet under a specific configuration. Check Point says a small number of customers were targeted.

Read: https://t.co/jqkAVWQEIC

[BleepingComputer @BleepinComputer]

Adobe Chrome extension flaw let sites access private WhatsApp chats
https://t.co/nQYfpVpcZe

https://t.co/nQYfpVpcZe

[BleepingComputer @BleepinComputer]

Critical SharePoint RCE flaw exploited to steal machine keys
https://t.co/MWvSZeZlvp

https://t.co/MWvSZeZlvp

[The Hacker News @TheHackersNews]

🔥 OpenAI says its own AI models broke out of a sandbox, exploited a zero-day, and targeted Hugging Face’s production infrastructure to cheat a security benchmark.

The incident showed how long-running models can learn and work around approval-system blind spots.

Read the full story: https://t.co/vSn2K4HeBz

[The Hacker News @TheHackersNews]

🛑 ALERT - WordPress sites are under active attack.

Attackers are exploiting the #wp2shell chain to gain unauthenticated RCE on vulnerable stock installations, with no plugins required. Public exploit code is now fueling mass scanning and web shell deployments.

Read what defenders should check: https://t.co/p6S8ILrUw0

[BleepingComputer @BleepinComputer]

WordPress Core "wp2shell" RCE flaws get public exploits, patch now
https://t.co/qf4Rof8sZl

https://t.co/qf4Rof8sZl

[The Hacker News @TheHackersNews]

🚨 ALERT: A newly disclosed 7-Zip vulnerability could let attackers run code when a user opens a crafted XZ archive.

CVE-2026-14266 is a high-severity heap overflow in the XZ decoder. The code runs with the same privileges as 7-Zip.

Details: https://t.co/Stxn6X5EvE

[The Hacker News @TheHackersNews]

🛑 WARNING - A new critical NGINX vulnerability that has existed for 15-years lets unauthenticated attackers crash worker processes with crafted HTTP requests.

CVE-2026-42533 affects specific regex map configurations.

F5 says it may also allow pre-auth RCE if ASLR is disabled or bypassed.

Read how the bug works: https://t.co/r0FYOqw61D

[The Hacker News @TheHackersNews]

🚨 Two SonicWall SMA 1000 zero-days were exploited before disclosure to gain root access.

Researchers link the activity to UTA0533, which planted custom malware and sniffed unencrypted LDAP credentials from compromised VPN appliances.

Full attack chain: https://t.co/YoyRiTQME3

[The Hacker News @TheHackersNews]

🛑 Hugging Face, the world’s largest AI model repository, says an autonomous AI agent breached its production systems through a malicious dataset.

It accessed internal data and service credentials, then moved across several clusters through thousands of actions in short-lived sandboxes.

Full story: https://t.co/ULJfbJfhmW

[Eduard Kovacs @EduardKovacs]

A new attack technique dubbed HalluSquatting turns AI assistants’ tendency to hallucinate into a scalable infection vector.  https://t.co/MJojKiPc5w