DJBSEC's CyberNews 2026-06-05

Today’s daily news covers the following categories: Vulnerability Threat Intelligence Ransomware Nation-State/APT Malware

---

Claude Code GitHub Actions Vulnerability Exposes CI/CD Pipelines

Vulnerability
Researchers have disclosed a vulnerability involving Claude Code integrations with GitHub Actions that could allow attackers to manipulate automated development workflows. Under certain conditions, malicious actors may be able to influence pipeline behavior, potentially exposing source code, secrets, or deployment processes. Because CI/CD environments sit at the heart of modern software development, they remain attractive targets for supply chain attacks. Security experts recommend reviewing workflow permissions, limiting automation privileges, and auditing build processes for unusual activity. The incident highlights the growing need to secure AI-powered development tooling alongside traditional software pipelines.
Read More

Anthropic Expands Project Glasswing to Critical Infrastructure

Threat Intelligence
Anthropic has announced the expansion of Project Glasswing into critical infrastructure sectors, bringing advanced AI-driven cybersecurity capabilities to organizations responsible for essential services. The initiative leverages Claude Mythos and related security-focused AI models to identify vulnerabilities and improve defensive operations. Anthropic says the program aims to help operators in energy, transportation, healthcare, and other key industries strengthen cyber resilience. As threats against critical infrastructure continue to grow, AI-assisted security programs are becoming increasingly important. Industry experts view this expansion as a major step toward integrating AI into national cyber defense efforts.
Read More

Anthropic Broadens Access to Project Glasswing

Threat Intelligence
Anthropic is expanding access to Project Glasswing, allowing more organizations to benefit from its AI-powered vulnerability discovery and threat analysis capabilities. The company says the initiative has already uncovered large numbers of software weaknesses and helped accelerate remediation efforts. By widening participation, Anthropic hopes to improve defensive cybersecurity capabilities across both public and private sectors. The expansion reflects growing confidence in AI’s ability to augment human security teams. Analysts expect AI-assisted vulnerability research to become a standard component of enterprise security programs.
Read More

Cisco Highlights Success of AI-Assisted Vulnerability Discovery

Threat Intelligence
Cisco is praising the results of its AI-powered bug hunting initiatives, claiming that automated systems are significantly improving vulnerability discovery efforts. Although the company declined to reveal the exact number of flaws identified, executives described the findings as substantial. AI is increasingly being used to analyze large codebases and uncover security weaknesses faster than traditional methods. Researchers note that while AI accelerates discovery, organizations still face challenges in validating and fixing the resulting flood of vulnerabilities. The announcement underscores the growing role of AI in software assurance and security testing.
Read More

Oracle WebLogic Flaw Added to CISA’s KEV Catalog

Vulnerability
CISA has added Oracle WebLogic vulnerability CVE-2024-21182 to its Known Exploited Vulnerabilities catalog following evidence of active exploitation. The flaw affects enterprise application servers and may allow attackers to gain unauthorized access or execute malicious actions. Inclusion in the KEV catalog signals that attackers are already weaponizing the vulnerability in real-world campaigns. Security agencies are urging organizations to prioritize patching and assess systems for indicators of compromise. Enterprise-facing vulnerabilities like this often become targets for both cybercriminal and nation-state actors.
Read More

AI-Powered Ransomware Toolkit Automates Attack Operations

Ransomware
Researchers have uncovered an AI-assisted ransomware toolkit capable of automating endpoint detection evasion, Active Directory discovery, and attack planning activities. The toolkit reduces the technical expertise required to conduct sophisticated ransomware campaigns, potentially expanding the pool of capable attackers. Security analysts warn that AI-driven automation could accelerate attack timelines and increase operational scale. While human operators still direct campaigns, AI is becoming a force multiplier for ransomware groups. The discovery highlights how cybercriminals are increasingly adopting AI to improve offensive capabilities.
Read More

China Conducts Dual-Track Cyber Campaign Against Czech and Taiwan Targets

Nation-State/APT
Researchers report that Chinese state-linked threat actors are conducting coordinated cyber campaigns targeting organizations in the Czech Republic and Taiwan. The operations combine traditional espionage techniques with broader intelligence collection and influence activities. Government agencies, technology companies, and strategically important organizations appear to be primary targets. Analysts say the dual-track approach demonstrates a sophisticated strategy that blends cyber espionage with geopolitical objectives. The activity reflects the continued use of cyber operations as a tool of statecraft and strategic competition.
Read More

DriveSurge Campaign Hijacks Thousands of Websites

Malware
A malware campaign known as DriveSurge has compromised thousands of websites and is using ClickFix and FakeUpdate-style lures to infect visitors. Victims are tricked into downloading malware disguised as browser updates or technical support fixes. Researchers say the campaign leverages trusted websites to improve credibility and increase infection success rates. Once installed, the malware can steal credentials, deploy additional payloads, and establish long-term persistence. The operation demonstrates the enduring effectiveness of social engineering combined with compromised web infrastructure.
Read More

OpenAI Upgrades GPT-5.5 and Retires Legacy ChatGPT Models

Threat Intelligence
OpenAI has announced upgrades to GPT-5.5 while outlining plans to retire several legacy ChatGPT models. The updated model delivers improvements in reasoning, coding assistance, and security-related analysis capabilities. Organizations using AI-powered development and security tools may need to review workflows as older models are phased out. The move reflects the rapid pace of advancement in large language model technology and growing competition among AI providers. Experts expect increasingly capable AI systems to play a larger role in cybersecurity, software development, and enterprise operations.
Read More