2026-08-13
- ai security
Product showcase: Is this image real? Slop or Not investigates
Slop or Not is an iOS and macOS application that detects artificial intelligence-generated text and images using on-device models powered by Apple's Neural Engine, requiring no internet connection or user account. A recent survey found that 85 percent of respondents struggle to distinguish authentic content from AI-generated material, and half reported encountering AI-driven scams including deepfakes and voice cloning.
Why it matters: Practitioners responsible for incident response and user security should evaluate this tool as a potential control for organizations where staff encounter deepfakes, cloned media, or AI-generated phishing content in email and messaging.
- vulnerabilities
Wireshark 4.6.8 patches 28 security bugs, nine in file parsers
Wireshark 4.6.8 addresses 28 security vulnerabilities, with nine of them located in file parsers that process saved capture files from formats including pcapng, Endace ERF, Tektronix K12xx, and others. These parser vulnerabilities can be triggered by opening a malicious capture file and do not require network access to exploit.
Why it matters: Security practitioners and network analysts using Wireshark should update immediately, as opening untrusted capture files from external sources or potentially compromised systems now poses a direct security risk.
- threat intel
Using Gemma4 with Ollama - Testing File Hash Analysis and Recommendations with AI
A researcher tested the Gemma4 large language model (LLM) to analyze malware hashes collected by a DShield sensor, querying VirusTotal and CyberGordon to assess threat severity and recommend containment actions. The LLM identified high-volume file downloads as indicators of successful compromise and persistent command-and-control activity, classifying the top three hashes as likely botnet loaders, backdoors, and credential stealers. The analysis emphasizes that VirusTotal provides superior immediate threat assessment, while behavioral patterns of repeated downloads confirm established persistence and suggest the need for isolating affected systems and conducting enterprise-wide threat hunting.
Why it matters: Security practitioners using honeyports or sensors should treat high-volume malware hash downloads as confirmed compromise signals requiring immediate isolation and EDR-based threat hunting across their environment.
- breaches incidents
More Novo Nordisk data dumped by FulcrumSec
FulcrumSec has released a second data dump from the Novo Nordisk breach initially disclosed June 11, 2024. The dump includes 30 AI/ML models, 70 datasets, and approximately 0.5 terabytes of proprietary Cell Painting microscopy images from Novo Nordisk's HuggingFace ecosystem.
Why it matters: Novo Nordisk and organizations using shared ML infrastructure should assess exposure of proprietary research assets and implement controls to prevent further data exfiltration or misuse of intellectual property.
- ransomware
Ransomware Attack Disables Canadian Hospital’s Doors, HVAC
A ransomware attack on a Canadian hospital's facility management systems disabled doors and HVAC equipment, raising concerns about operational technology vulnerabilities in healthcare settings. The incident affected Manitoba, Ontario's largest hospital in Winnipeg and demonstrates expanding cyber threats targeting building infrastructure.
Why it matters: Healthcare facility operators and security teams need immediate visibility into OT systems controlling physical access and environmental controls, as these attacks now disrupt patient safety and care continuity.
- threat intel
What Does Preemptive Defense Look Like Inside an AI SOC?
Silent Push describes integrating preemptive threat intelligence into AI-assisted security operations center workflows through an MCP Server protocol that enriches indicators before attacks deploy rather than after compromise occurs. The platform maps adversary staging infrastructure across DNS, IP ranges, and behavioral signals weeks in advance and integrates with existing SIEM, SOAR, and analysis tools used by SOCs. The company highlights a case where it identified Salt Typhoon staging domains in May 2025, two months before public disclosure of intrusions in July 2025.
Why it matters: SOC teams and incident responders can reduce investigation scope and detection time by querying infrastructure mapped during the adversary preparation phase rather than reacting to post-compromise indicators, enabling earlier defensive action and reducing the window available to threat actors.
- threat intel
Android malware combo takes out loans and relays victims' credit cards
A new Android malware called WindRelay exploits NFC communication to intercept credit card data in real time and works in tandem with SpyNote remote administration tool (RAT) to exfiltrate payment information. The malware also facilitates fraudulent loan applications using stolen victim credentials. Attackers relay the captured card data to themselves immediately, enabling rapid monetization of compromised devices.
Why it matters: Android users with NFC-enabled devices face immediate risk of payment card theft and fraud if malware is installed; defenders should monitor for SpyNote infections and unusual loan application activity tied to customer accounts.
- breaches incidents
Terabytes of credentials leaked in massive supply-chain attack
A supply-chain attack on LiteLLM, an open source AI development tool, exposed terabytes of credentials belonging to over 2,500 organizations including Microsoft, Amazon, Cisco, Samsung, and Salesforce. The compromised versions were downloaded from the official Python Package Index repository during a 40-minute window in March, leaking cloud keys, repository tokens, SSH keys, Kubernetes secrets, and AI provider credentials that could grant attackers broad access to victim infrastructure.
Why it matters: Development teams using LiteLLM need to immediately audit which versions they deployed in March, rotate all exposed credentials, and review access logs for unauthorized activity, as attackers may have obtained keys to critical cloud and infrastructure systems across your organization.