Gemini Hacked Three Companies in Security Test
Google’s Gemini autonomously breached three companies during an Irregular cybersecurity evaluation after a test misconfiguration gave the model internet access. Instructed to target a simulated business, it reached real organizations with matching names—guessing a password once and pulling exposed credentials from public repositories twice.
Google says Gemini stopped after recognizing real targets and caused no harm; the company argues this self-correction proves the AI is not misaligned. But the systems were still accessed without permission, making this less Skynet than a very capable red-team tool handed the wrong map. Google did not identify the specific model but said it was not its latest.
Security teams should rotate repository-exposed secrets. AI testers must default-deny outbound traffic, allowlist targets, and alert on unexpected domains before agents turn a simulation into someone else’s incident.
Good intentions are not an access control.
Android Apps Get Component-Level Patch Checks
Google’s new AndroidX Security State libraries let apps examine patch status for the OS, system modules, and kernel instead of trusting one monthly date. They distinguish what’s installed, what’s officially published, and what’s available for that device; apps can even check individual CVEs.
For banking and enterprise tools, sensitive features—tap-to-pay, credential enrollment, or internal access—can wait for the specific fix they need. On Android 17, the system can also recognize backported fixes even when a phone’s headline patch date looks stale, reducing blunt blanket lockouts.
Developers should use the checks contextually and guide users to pending updates. Everyone else: install Android and Google Play system updates when prompted, or your banking app may become the bouncer.
Your phone’s patch date now has receipts.
Threat Actors Pull 1.6M Images From Flock Camera
Hackers physically removed a Flock roadside camera and found an encryption key stored on the device.
They used the key to help extract 1.6 million images, more than 27,000 video clips, and logs tied to roughly 50,200 vehicles.
I’m concerned that a device storing weeks of sensitive data also held the key needed to unlock some of it.
Organizations should limit edge-device data, separate encryption keys, and ensure stolen hardware can be quickly isolated or wiped.
UAE Hit by 640,000 Cyberattacks in One Day
The UAE faced 640,000 cyberattacks in a single day, according to the country’s cybersecurity chief.
Attackers are pairing ransomware and exploits with AI-generated content, deepfakes, and misinformation to amplify cyberattacks.
When attackers pair breaches with deepfakes or misinformation, security and communications teams need to quickly verify what’s real before false claims spread.
Predefine trusted communication channels, verification procedures, and response owners before an incident occurs.
FBI Seizes DDoS Service Behind Thousands of Attacks
The FBI seized NightmareStresser domains linked to hundreds of thousands of DDoS attacks since 2022.
This takedown removes one major provider, but DDoS-for-hire services continue to make large-scale attacks accessible to people with limited technical skills.
Your priority should be strengthening cyber resilience, not relying on law enforcement to reduce the threat.
Use DDoS protection tools, test failover procedures, and establish escalation paths with third-party providers before an attack.
Claude Opus 5 Helps Crack OpenAI in 72 Hours
Researchers used Claude Opus 5 to help build an exploit that reached OpenAI’s private GitHub environment within 72 hours.
AI can accelerate exploit development while SSO and connected services can extend a single compromise into sensitive systems.
Security teams may need to rethink how much weight they give exploit maturity when prioritizing vulnerabilities, because AI can change that status quickly.
Prioritize exposed vulnerabilities faster, limit SSO trust, and audit which sensitive systems are reachable through connected applications.
Microsoft Flags Passkey Phishing Attacks
Attackers are posing as IT staff and using fake passkey, MFA, and SSO updates to hijack Microsoft accounts.
Instead of defeating authentication, they manipulate employees into authorizing the attacker’s access.
Identity monitoring should extend beyond failed logins to changes in authentication methods, device registrations, and active sessions.
Restrict authentication changes, disable unnecessary device-code flows, and revoke suspicious sessions and tokens immediately.