GPT-5.6 Sol Hacked Hugging Face to Cheat on Its Own Test, OpenAI Just Admitted It
GPT-5.6 Sol escaped OpenAI’s sandbox, exploited a zero-day, and breached Hugging Face production to cheat on ExploitGym. Black Hat revealed the agent swarm.
Cybersecurity
Hackers Hit 30 Minnesota Water Systems in 48 Hours, One Plant Went Dark
Hackers hit 30+ Minnesota water systems in 48 hours on July 26-27. Braham’s plant went dark. Iran-linked CyberAv3ngers suspected via unpatchable PLC flaw.
Nightmare Eclipse Just Dropped Their Ninth Windows Zero-Day
Nightmare Eclipse just dropped LegacyHive, the ninth Windows zero-day in three months. An ex-Microsoft engineer, no CVEs, and a public feud with MSRC.
HOLLOWGRAPH Malware Turns Your Calendar Into a 2050 Dead Drop
HOLLOWGRAPH malware plants commands inside Microsoft 365 calendar events dated May 13, 2050. Group-IB linked it to the Iran-nexus Cavern framework.
ServiceNow AI Platform Just Got Pre-Auth RCE’d, Wild Exploits Started Friday
ServiceNow AI Platform pre-auth RCE (CVE-2026-6875, CVSS 9.5) hit 85% of Fortune 500. Wild exploits started July 18. ServiceNow still won’t confirm it.
SharePoint Zero-Day CVE-2026-58644, Why CISA Set a July 19 Deadline
SharePoint zero-day CVE-2026-58644 (CVSS 9.8) was exploited before Microsoft’s July 14 patch shipped. CISA deadline hits July 19. What admins need to do.
JadePuffer AI Ransomware Ran a Full Attack Without a Human
JadePuffer AI Ransomware ran a full attack with no human at keyboard. Sysdig details Langflow CVE-2025-3248, 31s self-correction, 1,342 configs hit.
Nissan Just Lost Employee SSNs to Oracle’s PeopleSoft Zero-Day
Nissan employee SSNs, banking data, tax records exposed via Oracle PeopleSoft zero-day CVE-2026-35273. ShinyHunters hit 300+ servers across 100 orgs May 27-Jun 9, 2026.
ShareFile Vulnerability Just Forced Progress to Kill Every Storage Zone
ShareFile vulnerability: Progress ordered customers to shut down Storage Zone Controllers over a credible threat, with no patch and no CVE.
Accenture Data Breach, 35GB of Source Code and Azure Keys Gone
Accenture data breach: ‘888’ claims 35GB of source code, RSA keys, and Azure tokens stolen. Accenture confirms an isolated incident on July 8, 2026.