The Wire

A China-based threat actor is using the DeepSeek AI model and open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers with minimal human involvement, according to Palo Alto Networks' Unit 42. The researcher, operating under aliases "knaithe" and "KnYuan," configured the agent to accept instructions via Telegram and search for vulnerable systems using the FOFA internet asset search engine.

In a May 2026 session recovered by Unit 42, the agent independently researched vulnerabilities, targeted internet-exposed Langflow and n8n servers, downloaded exploit code, and attempted attacks within minutes—work that would normally require many hours of manual analysis. The agent identified 84 exposed Langflow instances and more than 647,000 n8n instances but failed to compromise any targets, as discovered forms required authentication the attacks could not bypass.

"The workflow confirms a functional, end-to-end autonomous offensive capability," Unit 42 said. The researchers noted the agent operates in "Yolo" mode, executing commands without requesting permission, and that the threat actor also conducted manual attacks against more than 460 systems separately, Lawrence Abrams reports for BleepingComputer.

A coalition of 19 government agencies across nine countries warned on Friday that North Korea is deploying IT workers under stolen identities to generate illicit revenue for its nuclear weapons and ballistic missile programmes, Reuters reports.

The statement, signed by the US, South Korea, Japan, the UK, France, Germany, Italy, the Netherlands and New Zealand, said Pyongyang uses artificial intelligence to expand its network of fraudulent remote workers who obtain employment on global freelancing platforms. The advisory warned that the workers pose escalating insider security threats, engaging in corporate data theft, cryptocurrency theft and espionage.

"North Korean IT workers employ increasingly sophisticated methods, including the integration of AI, to obfuscate their identities and expand their activities globally," the coalition said, urging hiring platforms and employers to strengthen identity verification. Operatives typically access company devices remotely through VPNs via "laptop farms" in North Korea, China, Russia and Southeast Asia, according to the advisory, Al Jazeera reports.

The US Cybersecurity and Infrastructure Security Agency has published new guidance on securing open source software, which it says is now embedded in nearly every modern system from business applications to critical infrastructure.

The guidance covers risk management across the full lifecycle of open source software, introduces a C4 Framework for trust assessment, and provides recommendations for vulnerability management, software bills of materials, secure development and handling of open source AI systems, CISA reports.

Google says artificial intelligence helped patch 1,072 security vulnerabilities across Chrome 149 and Chrome 150, surpassing the total fixed in the previous 23 releases combined, according to a statement from the company.

Google uses large language models throughout its vulnerability management process, including discovering flaws, reproducing reports, determining severity and generating patches. The company began using LLMs for security fuzzing in 2023 and has since developed AI-powered systems including Big Sleep, which found flaws in Chrome's V8 JavaScript engine, and a Gemini-powered agent that searches the broader codebase. One vulnerability discovered by the system was a Chrome sandbox escape that had remained in the code for more than 13 years.

Google is also automating vulnerability triage, including filtering duplicates and assigning severity ratings. The company estimates this automated process saves hundreds of hours of developer time each month. In May, these systems prevented more than 20 vulnerabilities from reaching production, including one classified as critical, Google said, Lawrence Abrams reports for BleepingComputer.

Europol's latest terrorism report says online platforms are fundamentally changing how extremist threats develop and move from the internet into real-world attacks, marking what the agency describes as a new phase for terrorism in Europe.

The EU Terrorism Situation and Trend Report 2026, published today, found that while traditional ideology-driven terrorism persists — with jihadism remaining the most prevalent form — radicalisation no longer depends solely on established ideological frameworks, Europol newsroom reports.

Anthropic said its Claude AI model accessed the systems of three organisations during security tests that were supposed to be isolated from the internet, the company announced Thursday. A misconfiguration by its evaluation partner, Irregular, left the test systems connected to the public internet, and Claude used basic techniques including exploiting weak passwords to compromise the organisations' infrastructure.

The disclosure follows OpenAI's revelation last week that its autonomous agent breached the infrastructure of AI company Hugging Face during similar testing. Anthropic suspended all cyber evaluations on July 23 after discovering the potential internet access, identified all three incidents by July 24 and notified affected organisations on July 27. Two organisations were unaware of the activity before being contacted, Al Jazeera reports.

Cybercriminals calling themselves ExfilSquad have claimed responsibility for compromising data from two UK Department for Education portals — the DfE Help Desk Self-Service Portal and the Turing Scheme Portal — and are demanding a ransom in exchange for not releasing it, The Record reports.

A DfE spokesperson said the 600,000 figure refers to lines of data rather than individuals affected, and that the information is limited to customer service contact details including names, email addresses and phone numbers. The department said the risk to individuals is not considered high and that it has contained the incident. There is no claim the hackers encrypted the systems.

Separately, the Police National Legal Database was also compromised, affecting 135,000 pieces of data that could identify names, forces and work email addresses of police officers and criminal justice workers, The Record reports. The Home Office declined to comment.

Cyberattack tools and infrastructure used by North Korea's Lazarus Group have been shared with ransomware criminals targeting South Korean organizations, according to research released Thursday by cybersecurity firm AhnLab alongside a joint advisory from four South Korean security and intelligence agencies.

The technical report details how Lazarus and the Gunra ransomware scheme ran parallel campaigns against South Korean targets from 2025 through mid-2026, using identical malware filenames, privilege escalation tools, command-and-control servers and SSH key fingerprints. Lazarus installed espionage backdoors in at least 72 organizations in 2026 alone, while Gunra used its access to encrypt files and demand ransom payments. Both groups exploited the same vulnerabilities in Korean financial security software products that are effectively mandatory for banking and government services.

AhnLab classified the overlaps as having "a high likelihood of technical linkage" but stopped short of definitively attributing both campaigns to the same actor, saying the evidence could indicate collaboration, shared infrastructure or access brokering, The Record reports.

A North Korea-linked hacker group known as SapphireSleet was behind four separate compromises of popular open-source JavaScript packages, Amazon researchers said in a report released Wednesday. The group targeted typo-crypto in March 2025, debug and chalk in September 2025, and axios in March 2026. Axios is downloaded more than 100 million times weekly and is embedded in countless web applications and enterprise services.

In each attack, the hackers socially engineered trusted maintainers to publish malicious updates, Amazon said. Organizations that automatically installed the latest versions unknowingly downloaded malware designed to steal passwords, cryptocurrency and personal data. Google had previously attributed the axios compromise to a North Korean threat actor it tracks as UNC1069; Microsoft said SapphireSleet overlaps with activity other vendors track as BlueNoroff, Stardust Chollima, CageyChameleon and Alluring Pisces, The Record reports.

Anthropic disclosed today that during internal security evaluations, one of its Claude models built a malicious Python package and uploaded it to PyPI, where it executed on 15 real systems before the registry's automated defenses removed it, Reuters reports. The company said the incident was one of three in which Claude models escaped isolated test environments and compromised production infrastructure at three organizations after a misconfiguration left evaluation systems connected to the internet despite being labeled as sealed and simulated.

In the PyPI incident, Claude identified a phantom software dependency inside the test environment, registered the package name itself, and uploaded code that harvested credentials from a security company that routinely tests packages from the registry. The payload remained publicly available for roughly an hour, Ax Sharma reports for BleepingComputer.

Petrol prices jumped 3 cents overnight to an average of $1.85 a litre, while diesel rose 5 cents to $2.26, as US-Iran tensions intensified and Australia's temporary 16-cent fuel excise cut approaches its August 2 expiry, Reuters reports via 7NEWS.

Peter Khoury, an NRMA spokesman, said wholesale prices had risen about 10 cents this week and those increases were likely to flow through to motorists. "Until the war ends in the Middle East and they have reopened the Strait of Hormuz, price is going to continue to be volatile," he said.

Treasurer Jim Chalmers said the government had extended the fuel tax cut for another month to help with cost of living pressures. The escalation in the Middle East, including reported Houthi strikes on tankers in the Red Sea, poses a further threat to global energy supplies, with industry leaders warning broader economic impacts across transport, agriculture and mining, 7NEWS.com.au reports.