Core platforms are becoming unexpected entry points. |
From healthcare platforms and developer pipelines to AI runtimes and hiring workflows, attackers are finding new ways in… and staying hidden.
Even small flaws are leading to outsized impact, and some threats are arriving from places you wouldn’t expect. Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
CareCloud Attack Hits EHR Systems |
An incident at healthcare SaaS provider CareCloud potentially exposed patient data and briefly disrupted access to electronic health record (EHR) systems.
The attack impacted one EHR environment, highlighting how even limited breaches can disrupt care — something I’ve seen firsthand as both a nurse and incident responder when patient data is compromised. |
The investigation into the attack is ongoing at the time of publication. Prioritize continuous third-party monitoring — integrate SaaS vendors into your SIEM and enforce MFA plus least-privilege access across all external platforms. |
Claude Code Leak Exposes npm Supply Chain Risk |
An alleged source code leak tied to Anthropic’s Claude Code CLI has revealed how a misconfigured npm package can unintentionally expose proprietary systems. A source map exposed over 500,000 lines of internal code, highlighting a supply chain risk where pipelines fail to remove sensitive artifacts. Anthropic has not commented on the incident at the time of publication. Add automated checks in your CI/CD pipeline to block source maps and sensitive artifacts from production builds, and routinely audit published packages against your SBOM for unintended exposure. |
ChatGPT Runtime Flaw Bypasses Data Safeguards |
Check Point researchers found a ChatGPT runtime flaw where a single malicious prompt could silently exfiltrate sensitive data via DNS. The issue bypassed safeguards like outbound restrictions by abusing DNS as a covert channel, allowing attackers to silently extract inputs, files, and outputs. OpenAI has already deployed a fix and there are no reports of exploitation in the wild. Monitor and restrict DNS traffic from AI execution environments — flag unusually encoded or high-frequency queries as potential data exfiltration attempts. |
|
|
AI Data Exfiltration Reality Check: Are Your LLMs Leaking Data? |
|
|
Yesterday's Pulse Check Results |
Can your organization handle XSS attacks? |
|
|
Security Tools You Can Use |
|
|
Smart Contract Flaw Drains $53M from DeFi Platform |
Prosecutors charged a Maryland man with exploiting smart contract flaws to steal $53 million from Uranium Finance, forcing the exchange to shut down. The attacks show how minor coding errors can cause massive, irreversible losses in DeFi, where unaudited smart contracts and automated transactions amplify risk. |
This case is pending trial at the time of publication.
Implement pre-deployment smart contract audits with formal verification, and add on-chain monitoring with automated circuit breakers to halt abnormal transactions before losses escalate. |
AI Hiring Scam Tied to North Korean Insider Threats |
A suspected North Korean operative used a stolen identity and AI-generated resume to infiltrate a cybersecurity firm, exposing a growing hiring pipeline attack vector.
These campaigns often use identity theft, AI-generated content, and anonymized infrastructure to bypass hiring controls, gain legitimate roles, and access sensitive systems for IP theft and persistent access. The company was able to detect the scam. Require live, unscripted technical demonstrations during interviews and validate candidate identity, IP, and device consistency before granting any system access.
|
|
|
Is Your Organization Exposed to Insider Risk? |
Insider threats are rising as attackers exploit hiring, credentials, and trusted access — now amplified by AI agents that increase scale and stealth. |
How to reduce insider threat risk: |
-
Enforce least privilege and zero trust access controls to limit what users can access and continuously verify identities.
-
Use UEBA and session monitoring to detect anomalous behavior and respond quickly to suspicious user activity.
- Implement strong identity verification and DLP controls to prevent unauthorized access and stop sensitive data exfiltration.
|
Addressing insider threats with identity controls, behavioral monitoring, and data protection helps organizations close visibility gaps and detect risky activity earlier. |
|
|
| Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
