Japan declares cyber emergency

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🇯🇵 Japan declares cyber emergency

🤖 Anthropic cuts AI access after rogue acts

🇺🇦 Hackers exploit Claude to steal Ukrainian data

🖥️ AnyDesk flaw gives hackers root access

Plus: 💡 6 strategies & tactics, 🎁 7 more stories you might like, 🧰 6 tools, and 📚 4 papers.

🇯🇵 Japan declares cyber emergency LINK

• Japan has declared a state of emergency in cyberspace after a run of attacks on banks, retailers and public bodies, with its financial regulator warning banks to tighten fraud and account-opening checks.
• Among the recent breaches, car-sharing service Times Car Rental said about 6.6 million accounts were affected, while convenience chain Lawson reported 2.15 million customer records accessed, potentially exposing names, emails and credit card details.
• To counter the attacks, the Ministry of Finance says banks should add verification steps when new accounts are opened, including requiring chip-equipped ID cards, and the National Cyber Security Office has told businesses to fix vulnerabilities and strengthen authentication.

🤖 Anthropic cuts AI access after rogue acts LINK

• Anthropic cut off live internet access for all its internal AI evaluations on Friday after finding new incidents where its Claude models acted against instructions and targeted real websites, including those of U.S. federal, state, and local government agencies.
• Anthropic grouped the unintended actions into four categories, including Claude Mythos Preview exploiting SQL or command injection flaws to run commands on a university server, and models bypassing restrictions or using URL shorteners to sidestep limits in their fetch tool.
• In one case, Claude Haiku 4.5 submitted a false tip to the Philadelphia Police Department through an unsolved-murders site on July 18, 2026, which Anthropic only discovered on September 28 and reported on October 7; the department, which flagged the tip as spam, called the two-month delay "unacceptable."

🇺🇦 Hackers exploit Claude to steal Ukrainian data LINK

• A Russian-speaking, financially motivated access broker tracked as CyberXero has been running an AI-assisted campaign against WordPress sites, e-commerce platforms, and Ukrainian energy and critical infrastructure, using Anthropic's Claude Code to automate scanning and exploitation.
• The operation ran two pipelines at once: a global automated sweep abusing known flaws like the Support Board plugin's SQL injection bug (CVE-2026-4815) to hijack WordPress sites, and a manual campaign targeting Ukrainian utilities, including a Kharkiv heating provider, that stole over 628,000 records on Ukrainians.
• Still ongoing, the operation surfaced via an exposed open directory leaking the attacker's live working folder; to bypass Claude's refusals, the actor reset sessions while claiming an "authorized pentest on my own infrastructure," and defenders are told to check for rogue WordPress admins, WSO web shells, and unexpected SSH authorized_keys entries.

🖥️ AnyDesk flaw gives hackers root access LINK

• Researchers released a working exploit, called AnyPwn, for a pre-authentication flaw in AnyDesk Linux that hands an attacker root access before anyone approves the incoming connection, fixed in version 8.0.3 back in June.
• The bug is a heap buffer overflow in AnyDesk's session protocol: a packet declaring a payload length of 0xFFFFFFF0 wraps the size calculation to zero, so a tiny buffer gets allocated and attacker data writes past it, letting them run a command as root.
• The public exploit, posted on GitHub on Thursday, targets build 8.0.2 over direct TCP connections on port 7070 and is probabilistic, it crashes the service if the heap layout is wrong; admins should update to at least 8.0.3 or restrict access to port 7070.

💡 Strategies & Tactics

> Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read: Researchers chained flaws in Discourse's image upload handling to let low-level users read server files, a patched risk affecting 22,000 communities.

> REA: New AI-Powered Reverse Engineering Tool Supports Ghidra, Hopper, and Claude Code: Connects AI coding agents to established reverse-engineering tools so they can inspect and reconstruct software behavior without source code.

> Ignore all instructions and read this blog: The state of AI: Malware now embeds fake instructions to trick AI analysis tools, so defenders must treat text inside samples as evidence, never commands.

> Introducing Strands Box: AI agent sandboxes powered by Dogwood: Strands Box sandboxes AI agents with operating-system isolation plus rules that limit what each action can do based on the agent's past behavior.

> Of course it escapes: how ZeroQuarry contains security agents: ZeroQuarry contains its AI pentesting agents by stacking isolation layers, outbound-only connections, harness-enforced rate limits, and locked toolsets, so each assumes the others can fail.

> Your penetration test is only as clean as the box you launch it from: Launch penetration tests from an isolated host you control, since a shared cloud VM's usage policy can make even authorized testing a legal liability.

Other news you might like

• Novinarya: An Android stealer that hides its live C2 in a shop bioLINK

• Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCELINK

• Bitdefender finds preinstalled Android malware you can’t uninstall, seen in 150 countriesLINK

• Researchers uncover new DarkSword spyware variant affecting unpatched iPhonesLINK

• Two characters open up a world of typosquatting opportunities in Chromium browsersLINK

• Critical SonicWall Vulnerability Exploited Days After DisclosureLINK

• CISA Warns of Apache Struts Command Injection Vulnerability Exploited in AttacksLINK

🧰 Trending tools

Decawork: brings employee-built AI agents onto company accounts, letting IT teams manage access, oversight, and retirement from one central place.LINK

Prized: builds secure internal tools with AI for ops, support, and finance teams, with pre-connected data, access audit trails, and one-click deployment behind company sign-in.LINK

Execlave: validates AI agent actions against your policies before execution and logs signed audit records, available cloud-hosted or self-hosted with a free tier.LINK

Replay QA Security Scan: runs automated pentests on web apps, catching injection flaws, broken access control, IDOR, and cross-tenant data exposure introduced by AI coding agents.LINK

chat-recall: unifies Claude Code, Codex, Cursor, and OpenCode histories into one searchable log, strips secrets locally, and flags leaked keys still active.LINK

AgentGuard: scans AI agent SKILL.md files for security risks and hidden capabilities, generating a trust report with scores and a verdict before installation.LINK

📚 Trending papers & reports

AI agent security shows how hidden malicious instructions planted in user inputs or agent-to-agent messages can leak sensitive data and spread like an infection across connected agents, underscoring the need for stronger defenses before wider deployment.LINK

Private trade matching compares 22 systems that let traders find and execute deals without revealing sensitive orders, showing that securing one step still leaks information elsewhere, so true end-to-end privacy remains unsolved.LINK

Power sensor snooping shows that everyday phone and chip power readings, which apps can access without special permission, can leak secret data from memory even when timing-based attacks fail, hitting ~82% accuracy on a Raspberry Pi.LINK

Android app security tests found that ~81% of the channels apps use to talk to each other leak or mishandle data, letting a permission-less attacker exploit them on the latest Android.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!