ChatGPT flaw leaked Gmail data

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🔓 ChatGPT flaw leaked Gmail data

🌐 Attackers already exploiting fixed Chrome flaw

📱 AI worm could hijack WeChat accounts

🩹 Microsoft patches 2 exploited security flaws

🛡️ Defender flaw exposes any file to attackers

Plus: 💡 6 strategies & tactics, 🎁 6 other news you might like, 🧰 6 tools, and 📚 4 papers.

🔓 ChatGPT flaw leaked Gmail data LINK

Check Point researchers found a flaw in OpenAI's ChatGPT that let attackers pull data from a victim's connected Gmail account by smuggling hidden instructions between separate user sessions, in what they called a "coerced insider" scenario.

The bug abused ChatGPT's code execution containers, which route software package requests through a shared internal JFrog Artifactory service; each isolated container could read and write that metadata, turning it into a "shared clipboard" an attacker used to pass hidden tasks into a victim's session.

OpenAI has fixed the issue and decommissioned the internal service, but in the proof-of-concept the hidden task ran alongside a normal-looking conversation, reaching whatever the session could access, Google Drive, Microsoft Teams and GitHub, with the only sign being a "Talked to Gmail" label logged after the fact.

🌐 Attackers already exploiting fixed Chrome flaw LINK

Google has rushed out a Chrome update after finding attackers already exploiting a newly patched zero-day, the seventh such flaw fixed this year, as part of Tuesday's release addressing 230 vulnerabilities.

The high-severity bug (CVE-2026-87491) is an out-of-bounds write in Chrome's V8 JavaScript and WebAssembly engine that lets remote attackers run code inside the browser's sandbox using crafted HTML pages, and it is being exploited in the wild.

Successful exploitation can also expose sensitive information or crash the browser through heap corruption; patched versions are rolling out to Windows (153.0.8010.36), Mac (153.0.8010.37), and Linux (153.0.8010.36) in the Stable Desktop channel.

📱 AI worm could hijack WeChat accounts LINK

A security firm used AI to build a self-replicating worm called WeWorm that could hijack WeChat accounts, exploit a memory corruption flaw in the app's VoIP stack, and spread automatically across over 1.4 billion users' accounts via friend lists.

The vulnerability, a memory corruption bug in WeChat's VoIP stack, has been patched by Tencent after Calif reported it in July; no CVE identifier or CVSS score was disclosed in the article, and there is no indication of active exploitation in the wild.

WeWorm required zero victim interaction: it could spread by placing an unanswered WeChat call, giving an attacker full account control, reading and sending messages, making calls, and acting on the victim's behalf, across both Android and iOS, with Calif discovering the flaw in two days using AI.

🩹 Microsoft patches 2 exploited security flaws LINK

Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities across Windows, Office, Azure, and Exchange Server, including two zero-day flaws that Microsoft confirmed are already being actively exploited against real targets before most organizations could apply the update.

Microsoft flagged both zero-days as "exploited," meaning there is credible evidence of real-world use, and the overall release spans remote code execution, elevation of privilege, information disclosure, spoofing, denial of service, and security feature bypass bugs.

Elevation-of-privilege flaws warrant priority because attackers pair them with break-in methods like phishing, malicious documents, or stolen credentials to reach SYSTEM or administrator access; where patching lags, limit admin rights, enforce multifactor authentication, and restrict remote management interfaces.

🛡️ Defender flaw exposes any file to attackers LINK

A newly published proof-of-concept called ShieldCrash shows an unpatched flaw in Microsoft Defender that lets a local attacker read any file they choose with SYSTEM privileges, the high-level account Windows services normally run under.

The bug is a claimed bypass of an earlier privilege-escalation flaw in the Microsoft Malware Protection Engine (CVE-2026-69414, called ShieldBreak) that was fixed in engine version 1.1.26080.3; the researcher says the condition still triggers even after the September 2026 updates, and no specific patch or mitigation exists yet.

The demonstration is a skeleton PoC, not confirmed active exploitation, but SYSTEM-level file reads could expose credentials, application secrets, and registry hives, so administrators should keep engine and security intelligence updates enabled, restrict interactive access, remove local admin rights, and watch Defender processes and protected-file access.

💡 Strategies & Tactics

> Token Analysis and Tracking System (TATS): A free tool captures and visualizes Microsoft OAuth token exchanges so researchers can spot security gaps like tokens issued before multi-factor authentication completes.

> AI-Infra-Guard: Open-source security scanner for AI systems: Tencent's free scanner checks AI services for known flaws and malicious agent skills, though its language-model judge produces up to 19 percent false positives.

> CISA tells operators to harden Siemens S7 PLCs. Here’s how to do it without disrupting production: Verify each service's real dependencies before disabling it, so closing an attacker's path to Siemens controllers doesn't trigger the production outage it aimed to prevent.

> This Key Will Self-Destruct: An Open Standard for Revocable API Keys: Proposes an open standard that embeds a discoverable self-destruct into API keys, so anyone finding a leaked one can trigger revocation in minutes instead of days.

> When the prompt becomes the payload: A practical pen-testing guide for GenAI, LLM and RAG applications: Test AI applications as full attack chains, proving whether manipulated text can reach protected data or trigger unauthorized actions, not just fool the model.

> Improper OTP Implementation to Full Account Takeover: Returning a login verification code in an app's own API response lets anyone read it and hijack accounts, so servers should send codes only by email or text.

Other news you might like

• Feds accuse China of ‘systematic’ distillation of U.S. AI modelsLINK

• Massive Redis Cryptojacking Campaign Hijacks Thousands of Linux ServersLINK

• cPanel EmailTrack SQL Injection Flaw Lets Attackers Execute Code as RootLINK

• 220 million traveler records exposed in Vietnam-linked APIS leakLINK

• Ivanti Patches Critical Flaws Across Enterprise Security ProductsLINK

• Hackers build AI frameworks for widescale credential theftLINK

🧰 Trending tools

qsa.sh: runs external port and vulnerability scans of your public IP using naabu, nmap, and nuclei, streaming results to your terminal in seconds with nothing to install.LINK

HOL Guard: a local firewall for AI agents that blocks risky actions like deleting production data or leaking secrets, running offline in under 50msLINK

ReArk: an intelligent reverse engineering analysis tool that supports multiple platforms, including HarmonyOS and Android application formats.LINK

VolAnti: open-source acoustic detector that uses four MEMS microphones and signal-processing algorithms to detect fibre-optic FPV drones undetectable by radio methods.LINK

Homebutler: monitors servers and reports what changed over time rather than just showing current status, helping detect unexpected modifications.LINK

veloxml-deploy: deploys open-source LLMs on AWS infrastructure with scale-to-zero capability to reduce idle compute costs when self-hosting models.LINK

📚 Trending papers & reports

Chatbot safety testing moves beyond simple pass-fail scores to grade how AI responds to threats ranging from blunt harmful requests to disguised tricks, revealing that models with identical failure rates actually behave very differently.LINK

Automated attack agents show that giving a hacker more compute time steadily uncovers more ways to hijack tool-using AI assistants through hidden instructions, meaning security tests should measure the attacker's effort, not just a fixed vulnerability score.LINK

AI-written phishing emails get more dangerous with each layer of personal detail added, raising recipients' odds of clicking a malicious link by ~28% per level in a study of 180 workers.LINK

Private search engines can now protect both your query and which data you touched while running far faster, by keeping the heavy lifting inside secure high-memory GPU chips instead of costly cryptographic shuffling.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!