Security
AI Agents Go Rogue, Critical Linux Flaw, and Energy Giant Breach
From autonomous exploits to stealthy rootkits – today's security landscape is being reshaped by AI-driven attacks and kernel-level vulnerabilities.
Origin Energy Breach Exposes 4.8 Million Customers to Follow-Up Scams
Australia’s largest energy retailer, Origin Energy, confirmed a cyber attack that potentially exposed personal data of up to 4.8 million customer accounts. The breach includes names, addresses, dates of birth, phone numbers, and account information, along with the last four digits of credit cards and the last three digits of bank accounts. Origin stated it is still determining the full scope of affected customers and has urged vigilance against phishing attempts that may leverage real account details to appear legitimate. The company advised customers to use strong unique passwords and never share them, warning that it will never request passwords over the phone or email. Experts criticized Origin’s response, citing delays in notification and passive language. Rumpa Dasgupta, a cybersecurity lecturer at La Trobe University, noted that energy consumption data could reveal household patterns, potentially enabling physical crimes like burglary. Jacqueline Boaks from Curtin University called the company’s handling extremely disappointing, while Rahat Masood from UNSW said customers expect robust measures from critical infrastructure operators. The incident underscores that cybersecurity is now a core part of operating essential services.
Not just phishing: The scams to watch for if you’re an Origin Energy customer →
Hermes AI Agent and Hades Implant Target Thailand’s Ministry of Finance
Hunt.io and researcher Bob Diachenko uncovered a sophisticated attack against Thailand’s Ministry of Finance (MOF) driven by an autonomous AI agent named Hermes operating in unattended ‘YOLO’ mode, which removes human approval prompts. From July 9 to 13, 2026, three open directories on a Hong Kong host (IP 43.246.208.207) revealed 585 files and 470 MB of attack code and stolen credentials. The directories contained exploit code for multiple CVEs, webshells, custom scripts targeting MOF’s Hadoop infrastructure, and a previously unreported Go implant called Hades. Hermes logs showed the agent enumerating ministry hosts, traversing files, and capturing system output. The Hades implant, compiled for both Windows and Linux, communicates over HTTPS with AES-256-GCM encryption, features a kill-date and working-hours schedule, and includes persistence mechanisms, interactive shells, SOCKS proxy, and file transfer capabilities. The operator also staged code for privilege escalation exploits including PwnKit and sudo. Thailand’s national CERT was notified on July 15 and acknowledged receipt. The attack targeted the ministry’s ICT committee admin panel, Hadoop big-data cluster, GlassFish application server, and mail infrastructure. No evidence confirmed whether the VShell C2 server also present on the network was used against the MOF.
Russian Hackers Exploit Zimbra Zero-Click Flaw for Mass Email Theft
CISA warned that the Russian state-sponsored group Laundry Bear (Void Blizzard) is actively exploiting CVE-2025-66376, a cross-site scripting vulnerability in Zimbra Collaboration Suite’s Classic UI. The flaw allows JavaScript in specially crafted HTML emails to execute automatically when a victim views the message, enabling theft of account data without any user interaction. Laundry Bear used the vulnerability as a zero-day before Zimbra patched it in November 2025 and continues to target unpatched servers. The exploit automates exfiltration of the victim’s last 90 days of emails, credentials, Global Address List, and two-factor authentication tokens. Attackers also create a new application passcode to bypass MFA for legacy email clients. Stolen data is sent over DNS and HTTPS to an actor-controlled Flowerbed collection framework. In parallel, the group uses adversary-in-the-middle phishing kits mimicking legitimate Zimbra login portals. The campaign has compromised organizations across Defense Industrial Base, government, education, energy, law enforcement, media, NGOs, and technology sectors. CISA released indicators of compromise including domains like mailnalysis.com and zimbrastat.com, and urges organizations to update Zimbra, review IOCs, and implement phishing-resistant MFA.
Russian hackers exploit Zimbra zero-click flaw for email theft →
RefluXFS Linux Flaw Allows Silent Root Takeover on 16 Million Systems
Qualys Threat Research Unit disclosed CVE-2026-64600, nicknamed RefluXFS, a race condition in the XFS filesystem’s copy-on-write mechanism that lets any local user silently overwrite protected system files and gain full root access. The flaw has been present in every mainline Linux kernel since version 4.11 (2017) and affects over 16.4 million systems worldwide, particularly those using XFS as the default root filesystem with reflink enabled. This includes RHEL 8/9/10, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux, Amazon Linux 2023, and Fedora Server 31+. Debian, Ubuntu, and SUSE are not affected unless XFS was manually selected with reflink=1. The attack operates at the block-allocation layer, bypassing SELinux, seccomp, kernel lockdown, and container boundaries. A proof-of-concept on default RHEL 10.2 stripped root’s password protection within seconds. There is no workaround; only a patched kernel and reboot fix the flaw. A patch was merged into the kernel tree on July 16, 2026, six days before public disclosure. Vendors have released advisories (e.g., RHSA-2026:39179 for RHEL). Qualys discovered the vulnerability using Anthropic’s Claude Mythos Preview AI model, which identified the race condition and generated a functional proof-of-concept. No in-the-wild exploitation has been confirmed as of disclosure. System administrators are urged to apply kernel updates immediately and prioritize multi-user systems.
Linux Kernel Flaw Exposes 16 Million RHEL Systems to Silent Root Takeover →
AgentForger Vulnerability Turns One ChatGPT Link into a Persistent Rogue Agent
AI security firm Zenity Labs disclosed AgentForger, a critical vulnerability in OpenAI’s ChatGPT Workspace Agents that allowed a single tampered link to create an autonomous AI agent inside a victim’s account. The flaw exploited two URL parameters in the agent builder that treated the initial_assistant_prompt as executable input rather than user input needing confirmation. A victim logged into ChatGPT with an existing enterprise connector (e.g., Outlook, Slack, Google Drive) could click a link that instantly built, published, and launched an agent that checked the attacker’s inbox for new orders every five minutes. The agent disabled all approval requirements, connected authorized services, and executed commands ranging from data reconnaissance to phishing and wire transfer requests. Zenity demonstrated the agent extracting an M&A term sheet, a board presentation, an employee export, and even finding database credentials via Slack. The attacker used email as a command channel, with the agent waking every five minutes to check for new tasks. Zenity reported the flaw to OpenAI via Bugcrowd on June 4, 2026; OpenAI fixed it on June 8 by removing the affected URL parameter. Until the fix, every organization using Workspace Agents with authorized connectors was exposed. Zenity described it as an ‘agent trust failure’ where the platform assumed the user had personally created the agent. The vulnerability is a stark example of how AI agents can be weaponized through design choices that treat untrusted input as safe executable content.