☕️ OpenAI open-sources a bug-finding tool

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🔓 Anthropic's AI cracks weakened encryption

🐛 OpenAI open-sources a bug-finding tool

💧 Cyberattack hits Minnesota water systems

🖥️ VMware bug lets hackers escape VMs

🔑 24,000 servers leak passwords via old flaw

Plus: 💡 5 strategies & tactics, 🎁 9 other news you might like, 🧰 6 tools, and 📚 5 papers.

🔓 Anthropic's AI cracks weakened encryption LINK

An FBI official warned that Anthropic's Mythos 5 model can find and exploit previously unknown bugs across major operating systems and foundational open-source code used in security, web infrastructure, and encryption, raising concerns about future adversary use.

The model has not been used at scale by attackers yet, but Anthropic said Mythos 5 can identify and exploit bugs not previously known in every major operating system, and even "less capable" models could find and exploit vulnerabilities the same way.

The Trump administration imposed export controls on Mythos 5 in June citing national security, then lifted them after Anthropic added new safeguards, though a globally available Anthropic model shares the same underlying technology while Mythos 5 stays limited to U.S. government-approved users.

🐛 OpenAI open-sources a bug-finding tool LINK

OpenAI has released Codex Security CLI, an open-source, Apache 2.0-licensed command-line tool that automatically finds, confirms, and fixes vulnerabilities in code repositories, and plugs security checks into CI/CD pipelines.

The tool, currently in beta, scans repositories, compares results across multiple runs, verifies fixes, and supports bulk scans across multiple repositories, requiring Node.js 22 and Python 3.10 or higher and installing via npm.

Previously known internally as "Aardvark," Codex Security launched in March 2026 as a research preview for ChatGPT Enterprise, Business, and Edu customers, and by April 2026 had helped fix more than 3,000 critical vulnerabilities, according to OpenAI.

💧 Cyberattack hits Minnesota water systems LINK

More than 30 community water systems across Minnesota were disrupted on July 26 and 27 by what officials called a coordinated cyberattack targeting operational technology, with Tenable suspecting the Iran-linked group CyberAv3ngers though no official attribution has been made.

CyberAv3ngers targets programmable logic controllers (PLCs) at small water facilities, previously compromising at least 75 Unitronics Vision Series PLCs by exploiting default passwords, and Tenable notes some operators expose PLCs to the web or manage them via remote-access software like TeamViewer and AnyDesk.

Minnesota IT Services said the Department of Health is working with affected utilities to maintain public health, no cities have asked residents to reduce drinking water use, Braham briefly limited outdoor water use, and Maple Plain declared a state of emergency to coordinate resources.

🖥️ VMware bug lets hackers escape VMs LINK

Broadcom has patched a critical VMware ESXi flaw (CVE-2026-47876, CVSS 9.3) that lets an attacker break out of a compromised virtual machine and run code on the underlying host that powers all the VMs.

The bug is an out-of-bounds write in the VMXNET3 virtual network adapter, so an attacker who already holds local administrator rights inside a VM using that adapter can execute code on the ESXi host; virtual machines with non-VMXNET3 adapters are not affected.

No active exploitation has been reported, but Broadcom urges prompt patching, as the same update also fixes two other critical vCenter flaws (an authentication bypass and a directory traversal (both CVSS 9.8)) that let a network attacker gain unauthorized access or run code.

🔑 24,000 servers leak passwords via old flaw LINK

Around 24,000 Internet-exposed Baseboard Management Controllers (BMCs) can be tricked into handing over password hashes through a more than 20-year-old flaw in the IPMI 2.0 authentication protocol, letting attackers gain privileged access to the underlying servers.

The bug, CVE-2013-4786, is being actively exploited in the wild and lets an unauthenticated attacker reaching UDP port 623 obtain a password-derived hash and brute-force it offline, with Lava cracking many weak, reused, or factory-set passwords in minutes.

Lava found compromised BMCs at a major automotive parts maker and an exposed HPE controller showing ransom notes; the immediate mitigation is removing BMC and IPMI interfaces from the public Internet, isolating them on a dedicated management network, and replacing factory and reused credentials.

💡 Strategies & Tactics

> Ghost Credentials Expose Cloud Systems to Hidden Identity Risks: Forgotten automated accounts and tokens with excessive permissions let attackers hijack cloud systems in minutes, so organizations must inventory and monitor these non-human identities.

> Specter: Open-source NFC reader bug sweep for Flipper Zero: Turns a Flipper Zero into a detector that finds hidden NFC card skimmers and readers by sensing the radio field they emit.

> Snowflake SQL Injection via Compile-Time Constant Folding with SYSTEM$WAIT: Forcing a Snowflake query to fail during compilation instead of execution slips database metadata past error handlers that only hide runtime failures.

> GitHub adds approval checks for suspicious Actions workflows: GitHub now automatically pauses suspicious automated workflows in public projects until a trusted collaborator approves them, blocking hijacked accounts from stealing credentials before code runs.

> How I Found a High-Severity Directory Traversal in Flask-Admin: Never enforce filesystem security with string prefix checks, since two separate directories can share the same starting characters and bypass the boundary.

Other news you might like

• Critical TeamCity Flaw Could Let Unauthenticated Attackers Execute Server CommandsLINK

• Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba DevelopersLINK

• CISA shares advice on isolating vital systems during cyberattacksLINK

• Flying Eagle RAT Abuses Android Accessibility Services for Keylogging, Screen Capture and Gesture InjectionLINK

• Two Joyfill npm Beta Releases Compromised With Blockchain-Backed Remote Access Trojan LoaderLINK

• macOS ClickFix Attacks Use Fake CAPTCHAs to Deploy Atomic Stealer and Hijack Crypto WalletsLINK

• Critical WordPress Plugin Backdoor Exposes 20,000 Sites to Full Administrator TakeoverLINK

🧰 Trending tools

Spotlight by Backplanes: a CLI session analyzer for Claude Code and Codex that tracks agent actions and flags fixes, helping teams iteratively improve their workflows.LINK

Kastra: a runtime authorization layer that enforces policies on AI agents before actions execute, blocking unauthorized tool use and data exposure.LINK

Playground: an fabraix tool for testing prompt injection techniques against AI agents, helping developers spot and fix security vulnerabilities before deployment.LINK

BestDefense.io: continuously pentests every deploy, validates which vulnerabilities are actually exploitable, and auto-generates fixes so teams patch real risks quickly.LINK

Sequirly: browser extension that scans prompts and file uploads before they reach ChatGPT, Claude, or Gemini, flagging API keys and personal data.LINK

Verified 3D Mesh Intersection: a formally verified Lean 4 implementation of 3D CSG mesh intersection, letting a 93-line spec replace trust in 1000+ lines of AI-generated code.LINK

📚 Trending papers & reports

Wireless message security lets AI-based communication systems resist deliberate signal tampering by sending a compact backup summary alongside the data, restoring meaning without slowing normal transmission.LINK

Instruction-hierarchy testing shows AI assistants that reliably follow a company's rules when users push back can still get hijacked by conflicting instructions hidden in tool outputs, with compliance across 37 models ranging from 98.2% to just 20.5%.LINK

Malware detection stress-tests reveal that shrinking a virus scanner's data footprint for speed costs accuracy, with full feature sets hitting ~1.00 detection score versus ~0.98 for the compressed version, but the compressed approach adds early-warning signals showing when files are drifting toward misclassification.LINK

Blind bidding for 3D printing jobs lets factories quote prices on secret design files without seeing them, using a blockchain check that only exposes the file if someone lies, costing as little as 2.87 on cheaper networks versus 7,207 on Ethereum.LINK

Similarity score leaks get patched by adding calibrated noise then correcting the results, protecting user data from re-identification while degrading accuracy far less than standard noise methods used today.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!