CRITICALAi
Global

CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

·Source: The Hacker News

Updated:

Executive Summary

Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed

Analysis

Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed
Source Attribution

Originally published by The Hacker News on Oct 12, 2026.

Related Threats

MEDIUMAiNEW

Independent Auditors Find Gaps in OpenAI Agent Monitoring

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/independent-auditors-find-gaps-in-openai-agent-monitoring-image_small-1-a-33183.jpg" align=right hspace=4><b>METR and Redwood Uncover Codex Safeguard Bypasses, OpenAI Says Flaws Now Patched</b><br>Third-party artificial intelligence safety evaluators found several vulnerabilities in OpenAI's monitoring system for its coding agents

Bank Info Security
CRITICALAi

GitLab critical patches include one for a bug that allows code execution by unauthenticated users

GitLab on Wednesday published updated versions of its Community Edition (CE) and Enterprise Edition (EE) that address a dozen bugs and security issues, including some that allow various unauthenticated actions. The most serious of the security issues, labeled critical in severity, is CVE-2026-110264 , an integer overflow issue. “GitLab has remediated an issue that, under certain conditions, could

CVE-2026-110264CVE-2026-15723
CSO Online
LOWAi

CVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server

<p><b>Bulletin ID:</b> 2026-146-AWS<br> <b>Scope:</b> AWS<br> <b>Content Type:</b> Important (requires attention)<br> <b>Publication Date:</b> 10/22/2026 13:00 PM PDT</p> <p><b>Description:</b></p> <p>Strands Agents is an open-source SDK, available for Python and TypeScript, for building AI agents. The SDK includes an Agent2Agent (A2A) server component that exposes an agent over HTTP so other agen

CVE-2026-115419
AWS Security Bulletins