DJBSEC's CyberNews 2026-06-04

Today’s daily news covers the following categories: Vulnerability Threat Intelligence Ransomware Nation-State/APT Malware

---

Claude Code GitHub Actions Vulnerability Exposes Development Pipelines

Vulnerability
Researchers have disclosed a vulnerability involving Claude Code integrations with GitHub Actions that could allow attackers to manipulate automated development workflows. The issue may enable unauthorized actions within CI/CD pipelines, potentially exposing source code, secrets, and deployment processes. Software supply chains remain attractive targets because compromising a single workflow can affect numerous downstream systems. Security experts warn that organizations relying heavily on automation should review workflow permissions and security controls. Developers are encouraged to audit GitHub Actions configurations and apply mitigations where available.
Read More

Anthropic Expands Project Glasswing Into Critical Infrastructure

Threat Intelligence
Anthropic is expanding Project Glasswing, its AI-driven cybersecurity initiative, into critical infrastructure sectors. The program uses Claude Mythos and other advanced AI models to identify vulnerabilities, analyze threats, and improve defensive operations. Anthropic says the goal is to help operators of essential services such as energy, transportation, and healthcare strengthen their cybersecurity posture. The expansion reflects growing confidence in AI’s ability to assist with large-scale vulnerability management and threat detection. Industry experts view critical infrastructure as one of the most important future applications for AI-assisted cybersecurity.
Read More

Anthropic Broadens Access to Project Glasswing

Threat Intelligence
Anthropic announced a broader rollout of Project Glasswing, extending access to its AI-powered cybersecurity capabilities across additional organizations and sectors. The initiative focuses on automated vulnerability discovery, threat analysis, and defensive security operations. Company officials say Glasswing has already identified thousands of security weaknesses and accelerated remediation efforts. The expansion highlights the increasing role AI is playing in proactive cybersecurity programs. Security leaders expect similar AI-driven initiatives to become more common across the industry.
Read More

Cisco Highlights Success of AI-Powered Bug Hunting

Threat Intelligence
Cisco is praising the results of its AI-assisted vulnerability discovery efforts, saying the technology has significantly improved bug hunting efficiency. While the company declined to reveal exactly how many vulnerabilities were identified, executives described the findings as substantial. AI systems are increasingly being used to analyze code, identify weaknesses, and prioritize remediation efforts. Researchers note that while AI can uncover flaws at unprecedented speed, organizations still face challenges in validating and fixing the growing volume of findings. The announcement underscores the transformative impact AI is having on software security.
Read More

Oracle WebLogic Vulnerability Added to CISA KEV Catalog

Vulnerability
CISA has added Oracle WebLogic vulnerability CVE-2024-21182 to its Known Exploited Vulnerabilities catalog after evidence of active attacks. The flaw affects enterprise application servers and can potentially be used to gain unauthorized access or execute malicious actions. Inclusion in the KEV catalog signals that threat actors are already exploiting the vulnerability in real-world environments. Organizations using WebLogic are being urged to prioritize patching and review systems for signs of compromise. Security experts warn that publicly known enterprise vulnerabilities are often quickly weaponized by attackers.
Read More

AI-Powered Ransomware Toolkit Automates Key Attack Stages

Ransomware
Researchers have discovered an AI-assisted ransomware toolkit capable of automating tasks such as endpoint detection evasion, Active Directory discovery, and attack planning. The toolkit uses AI to reduce the expertise traditionally required to conduct sophisticated ransomware operations. Security analysts warn that automation could allow attackers to scale campaigns more rapidly and target more victims. While human operators remain involved, AI is increasingly becoming a force multiplier for cybercriminals. The discovery highlights the growing intersection between artificial intelligence and ransomware development.
Read More

China Conducts Dual-Track Cyber Campaign Against Czech and Taiwan Targets

Nation-State/APT
Researchers report that Chinese state-linked threat actors are conducting coordinated cyber campaigns against organizations in the Czech Republic and Taiwan. The operation combines espionage-focused intrusions with broader intelligence collection and influence activities. Targets reportedly include government agencies, technology firms, and strategically important organizations. Analysts say the campaign demonstrates a sophisticated approach that blends multiple objectives within a single operation. The activity underscores the continued importance of cyber operations in geopolitical competition.
Read More

DriveSurge Campaign Compromises Thousands of Websites

Malware
A malware campaign known as DriveSurge has hijacked thousands of websites to distribute malicious payloads using ClickFix and FakeUpdate-style tactics. Visitors are tricked into downloading malware disguised as browser updates or troubleshooting tools. Researchers say the campaign leverages trusted websites to improve credibility and increase infection rates. Once installed, the malware can steal credentials, deploy additional payloads, or establish persistence on compromised systems. The operation demonstrates the continued effectiveness of social engineering combined with website compromise.
Read More

OpenAI Upgrades GPT-5.5 and Retires Legacy ChatGPT Models

Threat Intelligence
OpenAI has announced significant upgrades to GPT-5.5 while outlining plans to retire several older ChatGPT models. The updated model includes improvements in reasoning, coding assistance, and security-related analysis capabilities. Organizations using AI-powered tools may need to evaluate workflows and integrations as legacy models are phased out. The transition reflects the rapid pace of innovation and competition within the AI industry. Experts expect the newer capabilities to further expand the use of AI in software development and cybersecurity operations.
Read More