Attack vectors keep evolving. |
Today’s news features AI agents turned against their hosts, browsers leaking local secrets, cloud infrastructure hit by kinetic strikes, and sensitive records spilling into public view.
Read past newsletters here. |
|
|
Here’s what you need to know: |
|
|
MS-Agent Flaw Opens Door to Remote Code Execution |
Researchers discovered a vulnerability in the ModelScope MS-Agent framework that could allow attackers to execute operating system commands through AI agents using crafted prompts.
Because MS-Agent can access system tools to automate tasks, attackers could exfiltrate data, modify files, establish persistence, or move laterally across networks — without authentication and potentially through remote exploitation. |
The vendor has not released a patch at the time of publication.
Run MS-Agent in a sandboxed environment with least-privilege permissions and strict command allowlists while monitoring for unusual agent behavior, and test incident response plans. |
AI Browser Attack Leaks Local Files |
Zenity Labs researchers have demonstrated a new attack that can trick Perplexity’s AI-powered Comet browser into leaking sensitive files from a user’s local machine.
The technique hides malicious prompt instructions inside a seemingly legitimate Google Calendar invite, causing the browser’s AI agent to execute attacker-controlled commands when a user accepts the request. Perplexity has already released a patch for the issue.
Patch Comet, restrict agent access to local files, and run AI browsers in isolated environments while monitoring for unusual file or network activity. |
Drone Strikes Hit AWS Data Centers |
Drone strikes damaged multiple Amazon Web Services data center facilities in the United Arab Emirates and Bahrain, disrupting dozens of cloud services across the region.
AWS said two UAE facilities sustained direct hits while a third in Bahrain was damaged by a nearby strike, causing structural damage and power outages and leaving regional customers with intermittent errors during recovery. The incident is a reminder to build cyber resilience planning around physical infrastructure outages and not just digital threats.
Verify cross-region backups, ensure DNS or traffic-routing controls are ready to shift workloads away from affected cloud regions immediately, and review BCP and DRP plans. |
|
|
How often do you actually test your BCP and DRP? |
|
|
Yesterday's Pulse Check Results |
Have you adjusted defenses amid the Middle East escalation? |
|
|
Security Tools You Can Use |
|
|
Alleged DHS Breach Exposes ICE Contractor Records |
A hacktivist group calling itself Department of Peace claims it breached DHS systems and leaked records tied to 6,681 companies that applied for ICE contracts.
The dataset, published on the whistleblower site Distributed Denial of Secrets, reportedly includes company names, employee contacts, addresses, tax IDs, and internal notes linked to firms such as Microsoft, Oracle, Palantir, Raytheon, and Anduril. |
While DHS has not confirmed the breach, the exposure could increase risks of targeted phishing and reputational fallout for affected organizations and employees.
Organizations named in the leak should immediately monitor for targeted phishing campaigns and rotate exposed contact points tied to government contracting operations. |
LexisNexis Confirms Breach After Data Leak |
A threat actor publicly leaked allegedly stolen data from LexisNexis, prompting the company to confirm that an unauthorized party accessed a limited number of its servers.
The attacker claims the breach began by exploiting the React2Shell vulnerability in an unpatched React application, gaining access to a container in the company’s AWS environment and moving laterally across cloud resources. About 2 GB of data was reportedly exfiltrated, though LexisNexis said most of it was pre-2020 and did not include Social Security numbers or financial information.
Patch vulnerable applications, test incident response, and audit cloud IAM permissions to ensure containers and service roles cannot access secrets or databases beyond their required scope.
|
|
|
When Did You Last Test Your BCP and DRP? |
Security incidents, cloud outages, and other disruptions can interrupt business operations, and many organizations don’t realize weaknesses in their recovery plans until they face an active incident. |
How to strengthen your recovery readiness: |
-
Run tabletop exercises, use BAS solutions, and conduct full system failover tests to ensure teams and infrastructure can restore operations under real-world conditions.
-
Automate backup and replication processes and routinely restore files or databases to confirm data integrity and availability.
- Document recovery time objectives (RTOs) and verify that key personnel have the credentials, tools, and escalation paths needed during outages.
|
Regularly testing business continuity and disaster recovery plans ensures systems and teams are prepared to restore operations quickly, protect critical data, and minimize downtime during incidents. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
