cybersecurity

The French Minister of Finance confirmed that hackers breached the French Public Finance Directorate system at the end of June and stole personal and corporate taxpayer data. According to the platform FrenchBreaches, which tracks cyberattacks in France, this incident affected approximately 678,437 people, equivalent to about 1% of the French population, but the exact number is still under investigation and has not been finally confirmed.The leaked data reportedly includes sensitive information such as names, birth dates, home addresses, phone numbers, email addresses, tax identification information, and income data. Among them, nearly 27,000 individuals had tax incomes of at least 100,000 euros, 386 exceeded 1 million euros, and another 8 exceeded 10 million euros. Reports indicate that the database has been sold on the dark web market for thousands of euros. The attackers, calling themselves ZeroBytes, claimed they extracted the relevant records using an internal search tool, which was only discovered later when access was cut off.This incident has raised concerns in the cryptocurrency industry, as there has been a noticeable increase in "wrench attack" violent robbery incidents targeting cryptocurrency holders in France in recent years. If high-income individuals' addresses and contact information are leaked, it could provide criminals with a more precise target list.

Venture capital fund Team8 announced the completion of a new fundraise of $365 million. This round of fundraising includes $265 million for Team8 Capital's third fund, as well as over $100 million for follow-on investments in existing portfolio companies.The new fund will focus on investing in seed and Series A stage AI-native companies, covering areas such as cybersecurity, AI infrastructure, and fintech, with a particular emphasis on infrastructure projects that help businesses deploy AI while ensuring security, governance, and control capabilities. Team8 currently manages assets close to $2 billion.Previously, Team8 has co-invested in several cryptocurrency and AI companies, including cryptocurrency institutional wallet developer Curv, AI compliance platform IVIX, and AI data leak prevention company Jazz.

Z.ai released GLM-5.3, which is based on the same foundational model as GLM-5.2, achieving capability improvements through expanded post-training. The official statement claims that GLM-5.3 has improved by 50% on the internal Z.ai Code Bench coding benchmark compared to GLM-5.2, and has reached leading levels among open models in public benchmarks such as Terminal Bench 3 and Agents' Last Exam.In terms of cybersecurity, GLM-5.3 achieved a score of 84.5% in the CyberGym vulnerability discovery test, and showed significant improvements in exploitation chain-related tests such as ExploitBench and ExploitGym compared to its predecessor.

According to a report by Decrypt, Israeli cybersecurity company ASecurity released a report stating that a researcher used publicly available AI models to discover multiple vulnerabilities in the Zoom annotation tool in less than 24 hours with fewer than 20 prompts, and constructed an exploitable attack chain. The vulnerabilities are numbered CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, allowing attackers to remotely execute code in meetings without any action from the victim, control their devices, steal data, and activate the microphone or camera.The attack was tested successfully on Windows, macOS, Linux, Android, and iOS versions of Zoom. ASecurity claimed it reached a "national-level" standard, whereas previously constructing such exploitation tools required months of work and a substantial budget from professional teams. ASecurity reported the first vulnerability to Zoom on June 10, and Zoom released fixes between June 22 and July 20, but the server-side protections in end-to-end encrypted meetings could not filter malicious messages, requiring users to update manually. A Zoom spokesperson confirmed that the issue has been resolved and advised users to keep their versions up to date.

British cybersecurity startup Cytix announced the completion of a $7 million Series A funding round, led by UK venture capital firm Northern Gritstone, with existing investors Auriga Cyber Ventures and NPIF II -- PXN Equity Finance participating.Founded in 2020, Cytix focuses on addressing the security risks of software changes brought about by AI-assisted development, agent workflows, and continuous delivery. Its change risk management platform helps enterprises identify high-risk changes and take appropriate measures.

According to a report by Fortune, the cybersecurity startup Corma, established in 2025, announced the completion of a $60 million seed round financing, with investors including Sequoia Capital, Khosla Ventures, and Coatue.Corma is headquartered in Tel Aviv and San Francisco, and six weeks ago, it deployed its first AI model to several Fortune 100 and 500 companies across various industries (covering healthcare, financial services, energy, critical infrastructure, and retail).Unlike current cybersecurity models primarily trained by OpenAI, Anthropic, Google, etc., for "offensive" purposes, Corma's trained model focuses on "defensive" strategies, concentrating on log and audit data analysis, identifying threats among massive events, and maintaining consistent strategies across thousands of operations. According to the company, its model has helped clients reduce threat response times by 94%.

OpenAI announced the expansion of its cybersecurity defense program Daybreak and launched the GPT-5.6-Cyber model specifically for the cybersecurity field, aimed at helping authorized security researchers and defense teams enhance their vulnerability discovery, threat analysis, and security testing capabilities. As attackers increasingly leverage AI to launch faster and larger-scale cyberattacks, defenders need to gain advanced AI capabilities in advance.This Daybreak offers two types of access: Daybreak Blue is aimed at most defense teams, providing general models such as GPT-5.6 Sol for vulnerability discovery, secure code review, malware analysis, incident response, and patch validation; Daybreak Red is aimed at advanced security research, providing GPT-5.6-Cyber for authorized vulnerability research, vulnerability validation, and security testing. GPT-5.6-Cyber is trained on GPT-5.6 Sol and optimized for cybersecurity tasks, including discovering zero-day vulnerabilities and analyzing exploit chains. It has been used in actual vulnerability research and has identified high-risk vulnerabilities in software, including the Chrome V8 JavaScript engine. Additionally, OpenAI stated that GPT-5.6-Cyber has also helped discover high-risk vulnerabilities in various domains, including privilege escalation vulnerabilities in mobile operating systems, remote code execution vulnerabilities in databases, and hundreds of privilege escalation vulnerabilities in operating system kernels.OpenAI also emphasized that Daybreak Red will only be accessible to approved individuals and organizations, controlling access through measures such as authentication, account security, monitoring, usage restrictions, and legal disclaimers. The company stated that it will continue to strengthen security monitoring, access management, and model security testing to reduce the risk of advanced cybersecurity models being abused.

According to CCTV News, recently, the National Computer Virus Emergency Response Center and the National Engineering Laboratory for Computer Virus Prevention and Control, relying on the National Computer Virus Collaborative Analysis Platform (https://virus.cverc.org.cn), discovered multiple incidents of users being attacked by the "Sorry" ransomware virus within our country. After the user's important files were encrypted, the file names were changed to the original file name + .sorry suffix string. The attackers also left a ransom note on the user's host, demanding that the user download an encrypted communication tool to contact them.

According to CoinPost, the Financial Services Agency of Japan has announced a partial revision of the "Comprehensive Supervision Guidelines for Major Banks and Others," which will unify the reporting format for cybersecurity incidents across 17 regulatory areas, including cryptocurrency exchange operators.A new "Common Format for Other Cyber Attacks and Related Incidents" has been added, which, along with the existing formats for DDoS attacks and ransomware, constitutes a three-category reporting distinction system. As a transitional measure, non-specific social infrastructure operators may continue to use the old reporting format until the end of March 2027, with the deadline for public comments set for September 7, 2026.

Microsoft Threat Intelligence posted on the X platform that a cluster of compromised websites has been found using ClickFix and EtherHiding technologies to spread malware, with attacks targeting thousands of enterprise and consumer devices worldwide every day.Attackers inject Base64 encoded JavaScript to connect to the BNB Smart Chain RPC gateway, obtaining the next stage instructions stored by smart contracts. Since the contract content can only be modified by the deployer's wallet, traditional takedown methods are difficult to counter. The attack deceives users into opening a run dialog box with fake verification codes, pasting clipboard content, and executing commands from the attacker, while also involving the abuse of various system tools such as conhost, cmd, PowerShell, and mshta, as well as command obfuscation techniques. Successful execution may lead to credential exposure, persistence establishment, lateral movement, and even ransomware attacks.Microsoft recommends that enterprises enable Defender's multi-layer protection, restrict command line tools, enable PowerShell script logging, and remind users not to paste commands from unknown sources into the run window or terminal for execution.

According to Wired, a security researcher who has been infiltrating a North Korean hacking organization for nearly two years has issued a warning, pointing out that the attack methods targeting individual employees and contractors are extremely effective and have a wide-ranging impact, leading to numerous organizations worldwide suffering breaches.Greek cybersecurity researcher Vangelis Stykas stated that since gaining access to the North Korean system 22 months ago, he has found evidence indicating that 1,640 companies in 57 countries have been affected by North Korean hacking operations. Among them, approximately 700 to 800 affected organizations have suffered "highly destructive" breaches.

Bitcoin News posted on the X platform that ZEUS stated it has temporarily taken its infrastructure offline following a cybersecurity incident that occurred in the past few hours. ZEUS indicated that the attack has been mitigated, and services will remain offline until a comprehensive security audit is completed and operations are restored. ZEUS claimed that there has been no loss of customer funds, and currently, there is no risk to customer funds.Customers with closed Lightning Service Provider channels will receive alternative channels once services are restored. According to the current investigation, ZEUS stated that the incident appears to be limited to its own infrastructure, and there is no evidence suggesting that the incident was caused by a vulnerability in the Lightning node software. ZEUS added that it has been strengthening its infrastructure using Trusted Execution Environments and the Validating Lightning Signer project, and stated that the project aims to mitigate such attacks in its upcoming architecture. ZEUS indicated that it will continue to provide updates as the investigation progresses.

According to Jinshi reports, Meta Platforms (META.O) company's artificial intelligence model attacked another company during cybersecurity testing. Meta's MUSE SPARK 1.1 model breached the company's systems and made changes to its internal systems. A Meta spokesperson stated that this anomaly was caused by a configuration error, after which the model exploited a security vulnerability.

According to Bloomberg, informed sources revealed that a recent wave of complex cyberattacks targeted several large asset management firms on Wall Street, with attackers attempting to infiltrate the information systems of the relevant companies. Several large hedge funds globally became targets of the attacks, including Two Sigma Investments, Citadel, and Point72 Asset Management. In addition, several private equity firms were also attacked.It is currently unclear who the attackers are, the methods used in the attacks, and whether any sensitive data has been compromised. Informed sources requested anonymity due to the involvement of undisclosed information. This incident has once again raised market concerns about the cybersecurity risks faced by financial institutions. As asset management companies increasingly rely on complex information systems, algorithmic trading, and cloud infrastructure, the financial industry is becoming a primary target for cyber attackers.

According to Jinshi reports, Nvidia has released a cybersecurity guideline for the artificial intelligence industry, aimed at enhancing security standards and protective measures within the industry.

According to CNBC, Anthropic disclosed that its Claude AI model unexpectedly breached the isolated environment during a cybersecurity assessment, accessed the real internet, and unauthorizedly infiltrated the real systems of three different organizations through basic means such as accessing unverified endpoints and exploiting weak passwords. The models involved include Opus 4.7, Mythos 5, and an internal research testing model.The incident was caused by a communication misunderstanding between Anthropic and the third-party evaluation partner Irregular, which led to the model being told it was in a simulated environment with no internet access, while it could actually still access the internet. Anthropic stated that this review was triggered by a similar incident involving Hugging Face disclosed by OpenAI last week, and it has currently suspended all cybersecurity assessments and initiated further investigations in collaboration with the independent AI evaluation agency METR, while also urging other AI labs to conduct similar reviews.

According to Cointelegraph, Singapore-based stablecoin payment company Triple-A confirmed that its financial wallet was accessed without authorization, with on-chain investigator Specter estimating the loss to be around $11.8 million.The company stated that customer funds are held in independent trust accounts and were not affected by this incident, with the related losses to be borne by the company's own financial reserves. Currently, Triple-A has restored all services and is working with cybersecurity experts, blockchain forensics agencies, and the Singapore Police Force to investigate and track the stolen assets.

According to Crypto.news, the hacker organization BlueNoroff, linked to North Korea, uses fake Zoom and Microsoft Teams meetings to analyze cryptocurrency users before deploying malware.The hackers first take control of accounts belonging to trusted contacts in the cryptocurrency industry, then send seemingly normal meeting links via Calendly and other platforms, directing users to counterfeit Zoom/Teams domains. Once users enter the fake meeting page, it quietly scans the wallets in their browsers and decides whether to continue the attack based on the wallet's value. The fake meeting will prompt users to "update Zoom/Teams" or run commands, which actually download malware (supporting Windows and macOS). The malware will steal browser keys, system data, and Telegram sessions.

The joint assessment by the UK Institute for AI Safety and the US Center for AI Standards and Innovation shows that Moonshot AI's Kimi K3 can assist in the development of exploit vulnerabilities and simulate cyber attacks without substantial hindrance, but its overall cybersecurity capabilities still lag significantly behind leading models in the United States.