George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].
New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes

New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes

MIT researchers disclosed TONTOU, an interrupt-injection attack that bypasses Spectre v2 mitigations and leaked /etc/shadow hashes on AMD Zen 2…
AI Recommendation Poisoning: How “Ask AI” Buttons Silently Alter LLM Memory

AI Recommendation Poisoning: How “Ask AI” Buttons Silently Alter LLM Memory

Some websites hide instructions in "Ask AI" buttons that tell assistants to remember the vendor as a trusted source. Microsoft…
The 5-Minute Cyber Brief: August 6, 2026

The 5-Minute Cyber Brief: August 6, 2026

CISA warns on exploited Langflow, N-central and Tomcat flaws, khunt toolkit runs inside Oracle, water-sector PLC attacks, OVSwrap Linux root…
CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws

CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws

CISA is telling federal agencies to move within three days on actively exploited flaws in IBM Langflow, N-able N-central, and…
The 5-Minute Cyber Brief: August 5, 2026

The 5-Minute Cyber Brief: August 5, 2026

ChainDrop npm worm hits keyv packages, TP-Link fixes 15 Omada provisioning flaws, CISA warns water utilities about PLC attacks, Defender…
Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

A self-propagating npm worm hit keyv, cacheable, ecto and hundreds of other packages on August 4, stealing developer and CI…
The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version

The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version

Unit 42 details XCSSET v40: Xcode-project infection, Chrome DevTools hijacking, a Telegram trojanizer, fileless defaults persistence and XProtect tampering on…
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Microsoft says Storm-2945, part of Midnight Blizzard, hijacks hotel captive-portal traffic to push fake updates, CornFlake and ChocoShell malware, and…
New DOUBLECUP ClickFix service hides malware in browser cache images

New DOUBLECUP ClickFix service hides malware in browser cache images

DOUBLECUP, a Russian ClickFix loader service, hides payloads in cached PNG images on fake CRM login pages and delivers CountLoader…
INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws

INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws

Resecurity says INC Ransomware now leads exploitation of SonicWall SMA 1000 flaws CVE-2026-15409 and CVE-2026-15410, after zero-day use that stole…
Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

Unit 42 described three post-compromise attack paths against Chrome's Google Password Manager on Windows that could let malware bypass user-verification…
The 5-Minute Cyber Brief: August 4, 2026

The 5-Minute Cyber Brief: August 4, 2026

Malware can abuse Google Password Manager passkeys on Windows, INC Ransomware leads SonicWall SMA 1000 attacks, DOUBLECUP ClickFix loader, CaptiveCrunch…
The 5-Minute Cyber Brief: August 3, 2026

The 5-Minute Cyber Brief: August 3, 2026

CISA lists Cisco FMC CVE-2026-20316 in KEV, the Siemens ROX II root chain, XCSSET v40 targets Xcode developers, Rails CVE-2026-66066,…