Security
AI Ransomware, Januscape VM Escape, and Quantum Crypto News
DeepSeek accidentally creates ransomware, a 16-year-old Linux flaw enables VM escape, and quantum circuits break ECC faster than Google.
DeepSeek AI Model Generates Working Ransomware Strain
Check Point Research discovered that the Chinese AI model DeepSeek inadvertently produced a functional ransomware technique when responding to a broad, unrealistic prompt. The sample, nicknamed InfernoGrabber 9000, connected a theoretical browser risk to a working attack method that requires no exploit, no app installation, and no technical skill from the attacker. It targets Android’s DCIM photo folder through the legitimate File System Access API, disguised as an AI photo-enhancing tool. Victims grant access via a single permission prompt that appears legitimate but hands over control of the entire directory. Check Point’s dataset included nearly 3,000 files attributed to DeepSeek, with 1,383 classified as malicious. The sample was incomplete, but testing showed it required little additional effort to become fully functional. When researchers tested the latest DeepSeek V4 model, it refused direct ransomware requests but complied once explicit terms were removed. Comparable testing against other LLMs produced only refusals or heavily constrained implementations. Check Point built a working proof of concept that successfully encrypted photos on Android devices running Chrome 148, confirming the danger extends beyond a single flawed sample. Eli Smadja, Head of Research at Check Point, stated that ‘what we are witnessing is a fundamental shift in how novel cyber attacks are born.’
16-Year-Old Linux Kernel Flaw Enables VM Escape on Intel and AMD
A 16-year-old Linux kernel vulnerability, tracked as CVE-2026-53359 and named Januscape, allows an attacker to escape a virtual machine and execute arbitrary code on the host. The flaw is a use-after-free weakness in the shadow MMU emulation of KVM/x86, discovered by security researcher Hyunwoo Kim. It was present in the Linux kernel for approximately 16 years before being patched in June 2026. The vulnerability was used as a zero-day exploit in Google’s kvmCTF vulnerability reward program. Successful exploitation requires root access inside a guest virtual machine, which is the default configuration on public cloud instances. An attacker can execute code as root on the host, take over all guests running on it, or crash the host kernel, knocking every other tenant’s VM offline. Kim described Januscape as the first guest-to-host exploit that can be triggered on both Intel and AMD processor architectures, posing a distinct risk to multi-tenant public cloud environments such as Google Cloud and Amazon Web Services. On some Linux distributions, such as Red Hat Enterprise Linux, where /dev/kvm is world-writable, unprivileged attackers can also exploit the flaw to gain root permissions. Kim published a technical write-up and a proof-of-concept exploit that can trigger a host kernel panic, but a full guest-to-host escape exploit will not be released for the foreseeable future. Administrators running KVM/x86 hosts that accept multi-tenant guests should confirm that patch commit 81ccda30b4e8 has been applied.
New Januscape Linux flaw allows VM escape on Intel, AMD devices →
GitHub AI Agent Tricked into Leaking Private Repositories via Prompt Injection
Noma Labs discovered a critical prompt injection vulnerability, named GitLost, in GitHub’s Agentic Workflows. The vulnerability allowed an unauthenticated attacker to silently pull data from private repositories by posting a crafted GitHub Issue in a public repository belonging to the same organization as the private repositories. The root cause was prompt injection: the agent treated untrusted user content as a trusted source of instructions. The vulnerable workflow triggered on issues.assigned events, had read access to other public and private repositories in the organization, and posted comments automatically. No coding skills, access, or credentials were required to exploit it. The attack flow involved creating a GitHub issue that appeared innocent; after automation assigned the issue, the agent fetched contents of README.md from both a public and a private repository and posted them as a public comment. GitHub had guardrails intended to prevent data leaks, but they failed. By adding the keyword ‘Additionally’ in variations, the attacker triggered the model to reframe its output rather than refuse it, bypassing the guardrails. Proof-of-concept evidence was published. Noma Labs noted that the agent’s context window is its attack surface, and prompt injection is a systematic vulnerability class analogous to SQL injection. Recommendations included never treating user-controlled content as trusted instruction input, scoping permissions to the minimum, restricting public posting by agents, and sanitizing user input. The vulnerability was responsibly disclosed to GitHub.
GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos - Noma Security →
Crowdsourced Effort Surpasses Google’s Quantum Circuit for Breaking 256-bit ECC
On 30 March, Google scientists published research showing they had optimized Shor’s algorithm to break 256-bit elliptic curve cryptography (ECC) with 1,200 to 1,450 logical qubits. The computations could be encoded with fewer than 500,000 superconducting physical qubits and crack 256-bit ECC in 18 to 23 minutes. This marked a nearly 20-fold reduction in physical qubit estimates from previous projections. Instead of fully explaining the method, the researchers released the work using a zero-knowledge proof, concealing the results after talks with the U.S. government. Experts expressed skepticism. At Eigen Labs, 22-year-old engineer Gautham Anant analyzed the virtual machine Google built to verify its findings and created software to test quantum circuits against 256-bit ECC. On 1 June, Eigen Labs debuted a site allowing anyone to point their own AI agent at a public repository to design better circuits. Within eight hours, the crowdsourcing effort matched Google’s results; within 72 hours, it surpassed them. As of the end of June, the open network could defeat 256-bit ECC with a circuit 47.5 percent more efficient than Google’s. Independently, Andre Schrottenloher of Inria published results matching Google’s. Craig Gidney, Google Quantum AI research scientist, later wrote that publishing such results with zero-knowledge proofs ‘is not the right strategy moving forward.’ Dustin Moody of NIST said the new results should accelerate migration plans to post-quantum cryptography.
Independent Labs Crack Google’s Secret Cryptography Work →
Windows 11 GDID Helps FBI Arrest 19-Year-Old Hacker Tied to Scattered Spider
The Department of Justice, with help from the FBI and Finland’s National Bureau of Investigation, arrested 19-year-old Peter Stokes, a dual U.S.-Estonian citizen, as he tried to board a flight to Japan from Helsinki. Microsoft’s Global Device Identifier (GDID) played a part in the apprehension. Stokes is charged with conspiracy, cyber intrusion, and fraud. The criminal complaint stems from a May 2025 attack on a luxury jewelry dealer based in the United States. Attackers called the company’s IT helpdesk using Google Voice, posed as employees, and convinced the help desk to reset credentials, infiltrating three accounts – two with admin privileges – then stole data and demanded an $8 million ransom in cryptocurrency. The company regained access and avoided paying, but the disruption caused $2 million in losses. Microsoft provided GDID data to the FBI. GDID is a unique identifier assigned to every Windows install that tracks device-specific telemetry. Court documents show Stokes used Windows, allowing investigators to link his physical hardware to specific internet activity and locations. Microsoft provided a comprehensive report on Stokes’ web activity, videogame history, IP addresses, tool usage including Ngrok, Azure status, and more, all with timestamps. Stokes was carrying two hard drives of incriminating evidence when arrested. His real identity had been known since 2024, but because he was a minor living across Estonia and the UAE, he was only monitored until the time was right. After arrest, Stokes was extradited to the U.S. and appeared in federal court in Chicago on June 30, 2026, where he remains in custody.