TIA · HYDRA
Cyber Signal
A daily cut from public sources. You don't subscribe to it. It just gets published.
No account. No email address. No tracking.
A daily cut from public sources. You don't subscribe to it. It just gets published.
No account. No email address. No tracking.
no item today reports exploitation in practice
records parsed from the source feeds — before the time window and de-duplication
The digest hands us counts, not the discarded items — so this shows how many and why, not which.
The reader takes the last 30 hours. The previous cut went out late, so today’s window overlaps most of yesterday’s — and anything already published was removed by de-duplication. Funnel: 5 → 2 → 2.
This is not a quiet day in security. It is a trace of when our own instrument ran. We are not taking a day off and we are not padding the gap — the date stays, because an empty day is a measurement too.
Today’s lowest-scoring item cleared the threshold by exactly zero points (20 out of 20): “Anthropic is cutting Claude Code's current weekly limits by 17%”. We are leaving it in — it is more honest than anything we could replace it with.
July brought 4,084 new advisories for malicious npm packages. Other months run around 731 — July is a spike, not a trend.
All 8,189 of them, across seven months, are rated critical. Not one carries a computed CVSS score — there is nothing to score in a malicious package. It is not a flaw in the code, it is intent. Triage them by severity and every one is a tie.
But reach is distributed extremely unevenly. Of the 354 packages we could resolve, 67% have no dependents at all — their reach is zero. Among the rest the median multiplier is 1.95×, and 7% multiply thirtyfold or more. Highest measured case: engine.io has 118 direct dependents and reaches 15,865 through the tree. An average severity cannot see that spread at all.
Dependencies: a deps.dev v3alpha dependentCount measurement, SINGLE provider, no cross-check, window 2026-07. The package version is picked by a rule frozen BEFORE the run and BLIND to the measured value — the earlier method took the maximum across six versions, i.e. selected on the quantity it was meant to measure, and overstated the tail twofold. Amplification is undefined for packages with no dependents; those are reported separately as zero reach, not as a missing value. And advisories capture a fraction of malicious packages — this is the advisory denominator, not the malware denominator.
Nineteen collection days, no gaps, 183 published items. One at a time these were separate vulnerabilities. In order, they show the target moving — away from the thing that answers, toward the thing that runs it.
The previous edition ended with the agent as the path rather than the actor. This period gives that path an address. Ray, MLflow and LiteLLM are not models — they are the plumbing that trains, serves and routes them, and all three appear in this record within three weeks as an exploited flaw or a compromised release. What they have in common is not that they are “AI”. It is where they sit: inside build and training environments, holding the access those environments need. In the MLflow case the reported outcome was explicit — cloud credentials and secrets.
Set against that, the offensive story stayed unproven: analysis published on 27 August found that AI accelerates malware development without improving its success rate. So the risk this period actually recorded is not what AI can attack. It is what runs AI, being attacked.
Three names is a count we made by reading our own record, not an independent taxonomy — another reader could add to it or take from it. Of 425 items that crossed the reporting threshold across these nineteen days, 183 were published; the remaining 242 are kept in the record but appeared on no daily page. And the scoring rubric changed once inside the period, on 16 August, while the first two days carry no recorded configuration at all. That is why the arc above carries no scores: even within this period they are not strictly comparable.
Nineteen days, nineteen pages, nothing overwritten.
Attention classes are how much attention we gave an item. They are not severity verdicts.
Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada,…
Anthropic is permanently increasing Claude Code's standard weekly usage limits by 25% for Pro, Max, Team, and seat-based…