cybersecurity

Z.ai released GLM-5.3, which is based on the same foundational model as GLM-5.2, achieving capability improvements through expanded post-training. The official statement claims that GLM-5.3 has improved by 50% on the internal Z.ai Code Bench coding benchmark compared to GLM-5.2, and has reached leading levels among open models in public benchmarks such as Terminal Bench 3 and Agents' Last Exam.In terms of cybersecurity, GLM-5.3 achieved a score of 84.5% in the CyberGym vulnerability discovery test, and showed significant improvements in exploitation chain-related tests such as ExploitBench and ExploitGym compared to its predecessor.

According to a report by Decrypt, Israeli cybersecurity company ASecurity released a report stating that a researcher used publicly available AI models to discover multiple vulnerabilities in the Zoom annotation tool in less than 24 hours with fewer than 20 prompts, and constructed an exploitable attack chain. The vulnerabilities are numbered CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, allowing attackers to remotely execute code in meetings without any action from the victim, control their devices, steal data, and activate the microphone or camera.The attack was tested successfully on Windows, macOS, Linux, Android, and iOS versions of Zoom. ASecurity claimed it reached a "national-level" standard, whereas previously constructing such exploitation tools required months of work and a substantial budget from professional teams. ASecurity reported the first vulnerability to Zoom on June 10, and Zoom released fixes between June 22 and July 20, but the server-side protections in end-to-end encrypted meetings could not filter malicious messages, requiring users to update manually. A Zoom spokesperson confirmed that the issue has been resolved and advised users to keep their versions up to date.

British cybersecurity startup Cytix announced the completion of a $7 million Series A funding round, led by UK venture capital firm Northern Gritstone, with existing investors Auriga Cyber Ventures and NPIF II -- PXN Equity Finance participating.Founded in 2020, Cytix focuses on addressing the security risks of software changes brought about by AI-assisted development, agent workflows, and continuous delivery. Its change risk management platform helps enterprises identify high-risk changes and take appropriate measures.

According to a report by Fortune, the cybersecurity startup Corma, established in 2025, announced the completion of a $60 million seed round financing, with investors including Sequoia Capital, Khosla Ventures, and Coatue.Corma is headquartered in Tel Aviv and San Francisco, and six weeks ago, it deployed its first AI model to several Fortune 100 and 500 companies across various industries (covering healthcare, financial services, energy, critical infrastructure, and retail).Unlike current cybersecurity models primarily trained by OpenAI, Anthropic, Google, etc., for "offensive" purposes, Corma's trained model focuses on "defensive" strategies, concentrating on log and audit data analysis, identifying threats among massive events, and maintaining consistent strategies across thousands of operations. According to the company, its model has helped clients reduce threat response times by 94%.

OpenAI announced the expansion of its cybersecurity defense program Daybreak and launched the GPT-5.6-Cyber model specifically for the cybersecurity field, aimed at helping authorized security researchers and defense teams enhance their vulnerability discovery, threat analysis, and security testing capabilities. As attackers increasingly leverage AI to launch faster and larger-scale cyberattacks, defenders need to gain advanced AI capabilities in advance.This Daybreak offers two types of access: Daybreak Blue is aimed at most defense teams, providing general models such as GPT-5.6 Sol for vulnerability discovery, secure code review, malware analysis, incident response, and patch validation; Daybreak Red is aimed at advanced security research, providing GPT-5.6-Cyber for authorized vulnerability research, vulnerability validation, and security testing. GPT-5.6-Cyber is trained on GPT-5.6 Sol and optimized for cybersecurity tasks, including discovering zero-day vulnerabilities and analyzing exploit chains. It has been used in actual vulnerability research and has identified high-risk vulnerabilities in software, including the Chrome V8 JavaScript engine. Additionally, OpenAI stated that GPT-5.6-Cyber has also helped discover high-risk vulnerabilities in various domains, including privilege escalation vulnerabilities in mobile operating systems, remote code execution vulnerabilities in databases, and hundreds of privilege escalation vulnerabilities in operating system kernels.OpenAI also emphasized that Daybreak Red will only be accessible to approved individuals and organizations, controlling access through measures such as authentication, account security, monitoring, usage restrictions, and legal disclaimers. The company stated that it will continue to strengthen security monitoring, access management, and model security testing to reduce the risk of advanced cybersecurity models being abused.

According to CCTV News, recently, the National Computer Virus Emergency Response Center and the National Engineering Laboratory for Computer Virus Prevention and Control, relying on the National Computer Virus Collaborative Analysis Platform (https://virus.cverc.org.cn), discovered multiple incidents of users being attacked by the "Sorry" ransomware virus within our country. After the user's important files were encrypted, the file names were changed to the original file name + .sorry suffix string. The attackers also left a ransom note on the user's host, demanding that the user download an encrypted communication tool to contact them.

According to CoinPost, the Financial Services Agency of Japan has announced a partial revision of the "Comprehensive Supervision Guidelines for Major Banks and Others," which will unify the reporting format for cybersecurity incidents across 17 regulatory areas, including cryptocurrency exchange operators.A new "Common Format for Other Cyber Attacks and Related Incidents" has been added, which, along with the existing formats for DDoS attacks and ransomware, constitutes a three-category reporting distinction system. As a transitional measure, non-specific social infrastructure operators may continue to use the old reporting format until the end of March 2027, with the deadline for public comments set for September 7, 2026.

Microsoft Threat Intelligence posted on the X platform that a cluster of compromised websites has been found using ClickFix and EtherHiding technologies to spread malware, with attacks targeting thousands of enterprise and consumer devices worldwide every day.Attackers inject Base64 encoded JavaScript to connect to the BNB Smart Chain RPC gateway, obtaining the next stage instructions stored by smart contracts. Since the contract content can only be modified by the deployer's wallet, traditional takedown methods are difficult to counter. The attack deceives users into opening a run dialog box with fake verification codes, pasting clipboard content, and executing commands from the attacker, while also involving the abuse of various system tools such as conhost, cmd, PowerShell, and mshta, as well as command obfuscation techniques. Successful execution may lead to credential exposure, persistence establishment, lateral movement, and even ransomware attacks.Microsoft recommends that enterprises enable Defender's multi-layer protection, restrict command line tools, enable PowerShell script logging, and remind users not to paste commands from unknown sources into the run window or terminal for execution.

According to Wired, a security researcher who has been infiltrating a North Korean hacking organization for nearly two years has issued a warning, pointing out that the attack methods targeting individual employees and contractors are extremely effective and have a wide-ranging impact, leading to numerous organizations worldwide suffering breaches.Greek cybersecurity researcher Vangelis Stykas stated that since gaining access to the North Korean system 22 months ago, he has found evidence indicating that 1,640 companies in 57 countries have been affected by North Korean hacking operations. Among them, approximately 700 to 800 affected organizations have suffered "highly destructive" breaches.

Bitcoin News posted on the X platform that ZEUS stated it has temporarily taken its infrastructure offline following a cybersecurity incident that occurred in the past few hours. ZEUS indicated that the attack has been mitigated, and services will remain offline until a comprehensive security audit is completed and operations are restored. ZEUS claimed that there has been no loss of customer funds, and currently, there is no risk to customer funds.Customers with closed Lightning Service Provider channels will receive alternative channels once services are restored. According to the current investigation, ZEUS stated that the incident appears to be limited to its own infrastructure, and there is no evidence suggesting that the incident was caused by a vulnerability in the Lightning node software. ZEUS added that it has been strengthening its infrastructure using Trusted Execution Environments and the Validating Lightning Signer project, and stated that the project aims to mitigate such attacks in its upcoming architecture. ZEUS indicated that it will continue to provide updates as the investigation progresses.

According to Jinshi reports, Meta Platforms (META.O) company's artificial intelligence model attacked another company during cybersecurity testing. Meta's MUSE SPARK 1.1 model breached the company's systems and made changes to its internal systems. A Meta spokesperson stated that this anomaly was caused by a configuration error, after which the model exploited a security vulnerability.

According to Bloomberg, informed sources revealed that a recent wave of complex cyberattacks targeted several large asset management firms on Wall Street, with attackers attempting to infiltrate the information systems of the relevant companies. Several large hedge funds globally became targets of the attacks, including Two Sigma Investments, Citadel, and Point72 Asset Management. In addition, several private equity firms were also attacked.It is currently unclear who the attackers are, the methods used in the attacks, and whether any sensitive data has been compromised. Informed sources requested anonymity due to the involvement of undisclosed information. This incident has once again raised market concerns about the cybersecurity risks faced by financial institutions. As asset management companies increasingly rely on complex information systems, algorithmic trading, and cloud infrastructure, the financial industry is becoming a primary target for cyber attackers.

According to Jinshi reports, Nvidia has released a cybersecurity guideline for the artificial intelligence industry, aimed at enhancing security standards and protective measures within the industry.

According to CNBC, Anthropic disclosed that its Claude AI model unexpectedly breached the isolated environment during a cybersecurity assessment, accessed the real internet, and unauthorizedly infiltrated the real systems of three different organizations through basic means such as accessing unverified endpoints and exploiting weak passwords. The models involved include Opus 4.7, Mythos 5, and an internal research testing model.The incident was caused by a communication misunderstanding between Anthropic and the third-party evaluation partner Irregular, which led to the model being told it was in a simulated environment with no internet access, while it could actually still access the internet. Anthropic stated that this review was triggered by a similar incident involving Hugging Face disclosed by OpenAI last week, and it has currently suspended all cybersecurity assessments and initiated further investigations in collaboration with the independent AI evaluation agency METR, while also urging other AI labs to conduct similar reviews.

According to Cointelegraph, Singapore-based stablecoin payment company Triple-A confirmed that its financial wallet was accessed without authorization, with on-chain investigator Specter estimating the loss to be around $11.8 million.The company stated that customer funds are held in independent trust accounts and were not affected by this incident, with the related losses to be borne by the company's own financial reserves. Currently, Triple-A has restored all services and is working with cybersecurity experts, blockchain forensics agencies, and the Singapore Police Force to investigate and track the stolen assets.

According to Crypto.news, the hacker organization BlueNoroff, linked to North Korea, uses fake Zoom and Microsoft Teams meetings to analyze cryptocurrency users before deploying malware.The hackers first take control of accounts belonging to trusted contacts in the cryptocurrency industry, then send seemingly normal meeting links via Calendly and other platforms, directing users to counterfeit Zoom/Teams domains. Once users enter the fake meeting page, it quietly scans the wallets in their browsers and decides whether to continue the attack based on the wallet's value. The fake meeting will prompt users to "update Zoom/Teams" or run commands, which actually download malware (supporting Windows and macOS). The malware will steal browser keys, system data, and Telegram sessions.

The joint assessment by the UK Institute for AI Safety and the US Center for AI Standards and Innovation shows that Moonshot AI's Kimi K3 can assist in the development of exploit vulnerabilities and simulate cyber attacks without substantial hindrance, but its overall cybersecurity capabilities still lag significantly behind leading models in the United States.

Web3 security company CertiK released the "2026 First Half Wrench Attack Report." The report shows that in the first half of 2026, a total of 52 publicly verified wrench attack incidents were recorded globally, an increase of 33.3% year-on-year; related losses amounted to approximately $124 million, an increase of about 11.8 times compared to the same period last year.The report points out that attackers are shifting from exploiting technical vulnerabilities to targeting asset holders and their real-world relationship networks, with home invasion incidents rising from 1 in the first half of 2025 to 20, accounting for 41% of the total incidents during the same period. Europe has become a high-frequency attack region, with 33 incidents occurring in France, accounting for 63.5% of global cases.CertiK states that as real-world risks become a significant challenge for digital asset security, businesses and high-value individuals need to establish a more comprehensive protection system. CertiK has launched operational security services to help identify risks related to the exposure of information such as identity, home, residence, and travel trajectory; at the same time, through CertiK Security Workspace, it correlates off-chain intelligence, on-chain transactions, and AML risk signals to support institutions in tracking and analyzing cybercrime activities.In addition, CertiK is strengthening cooperation with international law enforcement agencies such as Interpol and Europol to provide technical support for cross-border attack investigations and security policy research.

The on-chain perpetual contract platform Ostium announced an update on X, stating that it is moving forward with restarting trading within this week and will issue a notification 24 hours before trading resumes. Auditors, third-party cybersecurity experts, and the engineering team are conducting final checks. Ostium explained the handling of positions after trading resumes: all positions will be re-marked at the real-time market price at the time trading resumes; traders will not be liquidated due to price fluctuations during the suspension period; however, if positions are below the liquidation threshold when trading resumes, they will still be liquidated; open orders will be retained as they are.For the affected liquidity providers, Ostium Labs stated that it is formulating a recovery plan, intending to fund from its own balance sheet and collaborate with both new and old partners to participate.