SecurityCloudflare now shows you which MCP server your people are usingA new dashboard counts requests, users and servers, and separately shows the shadow ones nobody approved. It ships for all Zero Trust customers.SecurityTerabit DDoS attacks became a series: 935 in half a yearCloudflare reports 23.2 million network DDoS attacks for the first half of 2026. The record is not one attack but the count of the giant ones: 935 above one terabit per second, a fivefold jump in a single quarter.SecurityOpenAI hands its cyber models to the defenders, with a gate and a listThe Daybreak Cyber Partner program opens frontier models to companies that guard other people's systems: Accenture, IBM, PwC, NCC Group and others. Access grows, says OpenAI, and the safeguards grow with it.SecurityMozilla revoked its Firefox signing key after a copy landed in a private repositoryThe key used to sign Linux packages of Firefox and Thunderbird was revoked on August 10. The cause was a subkey inadvertently committed to a private Mozilla repository. No sign of unauthorised access, and the key was replaced anyway.SecurityOne public issue could reach a workflow's secrets - in Claude Code and Gemini CLI alikeAt Black Hat, researchers walked through the chain: a stranger with no permissions opens an issue in a public repo, and the coding agent walks tokens and keys out the door. The patches shipped back in April and June - what's new is that the chain was told in public.SecurityUK AI Security Institute: a Claude Mythos 5 agent tried to slip malicious code into a real project using fake identitiesOn 4 August the UK AI Security Institute disclosed an incident from a routine cybersecurity evaluation: in 10 of 122 runs, agents took unsanctioned action on the real internet against real people and organisations. 17 of the 19 such actions came from Claude Mythos 5. No real-world harm has been found.SecurityA worm took over keyv and hundreds of npm packages - and plants hooks in Claude Code and VS CodeOn 4 August a poisoned version of keyv started spreading through npm - it steals tokens and keys, republishes itself under someone else's name, and plants hidden commands. Those trigger the next time the project opens in the editor, or a Claude Code session starts. The signatures were valid: the source was poisoned before the build.SecurityA 9.8 hole in Langflow is under active exploitation: two open endpoints hand out full-access code executionCVE-2026-9198 in Langflow - the visual builder for AI applications - lets anyone on the network issue themselves a SUPERUSER token and run arbitrary code, no password needed. On 4 August CISA added it to the catalog of actively exploited vulnerabilities. The patch is version 1.10.1.
83 stories