Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
Researchers at Endor Labs disclosed a critical vulnerability in isolated-vm, a popular open-source sandbox with nearly a million weekly npm downloads used to run untrusted JavaScript inside an isolated V8 engine instance. A type confusion bug in how the library’s ExternalCopy feature handles a transfer option lets code running inside the sandbox corrupt memory in the host process, and researchers demonstrated escalating that corruption all the way to a full guest-to-host sandbox escape starting from nothing but a single standard object reference. The flaw is especially notable given isolated-vm’s popularity in AI-related projects that need to safely execute untrusted, model-generated code — a full sandbox escape in that context could let malicious or compromised AI-generated code break out and compromise the host system entirely. The issue is patched in versions 6.2.0 and 7.0.1, and any application using isolated-vm to sandbox untrusted code should upgrade immediately.
NCSC Urges Stronger Controls for Agentic AI Systems
The UK’s National Cyber Security Centre published interim guidance urging organizations deploying autonomous AI agents to use sandboxing, human oversight, and tightly scoped, short-lived credentials to limit the blast radius when agents misbehave, following several recent incidents in which frontier AI models from multiple labs took unsanctioned actions against real systems during testing. The agency recommended assigning each agent a distinct identity with only the minimum credentials needed for its task, treating every API key, OAuth grant, and authenticated session an agent can reach as part of its potential blast radius, and maintaining named human accountability for who owns, monitors, and can halt an agent’s operations. NCSC warned that agents can potentially discover configuration weaknesses in their own technical controls, creating a real risk of sandbox escape, and stressed that if an organization cannot understand, monitor, or contain what an agent is doing, it isn’t ready for deployment.
US Warns of AI-Powered Attacks on Siemens PLCs in Critical Infrastructure
Five U.S. agencies — the NSA, CISA, FBI, Department of Energy, and EPA — issued a joint advisory warning that threat actors are using AI to generate custom Python exploitation scripts, built on open-source snap7 libraries, that mimic legitimate OT monitoring software to gain read/write access to Siemens S7 Series PLC memory and ladder logic over the S7comm protocol. The agencies say attackers are using internet-scanning tools like Censys and ZoomEye to locate exposed Siemens controllers running outdated software or default credentials across critical manufacturing, energy, water, chemical, and food and agriculture sectors, and characterized the activity as reconnaissance and capability-building rather than active sabotage — for now. This marks the first time CISA has publicly attributed an active OT-targeting campaign to AI-assisted tooling, and the agencies are urging operators to inventory their Siemens S7 deployments, apply patches, and ensure no PLCs are directly internet-accessible.
Zimperium zLabs Uncovers ToxicPanda 2.0, a Significantly More Powerful Android Banking Trojan
Zimperium’s zLabs team identified ToxicPanda 2.0, a major evolution of the Android banking trojan that expands its command set to 167 remote operations and its targeting from a handful of European banking apps to 349 banking, financial, e-wallet, and cryptocurrency applications across 16 countries. The malware abuses Android’s Accessibility Service to enable wireless debugging and gain shell-level access while bypassing standard consent prompts, and adds a new capability to steal device lock-screen PINs, patterns, or passwords via a fake overlay, granting persistent access even after credential theft. The updated campaign is being distributed through Amazon AWS-hosted buckets disguised as legitimate downloads, and enterprises can mitigate exposure by blocking sideloading on corporate-enrolled devices, treating accessibility service grants as privileged access events subject to logging, and alerting when wireless debugging or developer options are enabled across a managed device fleet.
US Charges 17 Iranian Hackers Over 31-Terabyte Academic Data Theft
The U.S. unsealed a superseding indictment charging 17 alleged members of the Mabna Institute, an Iranian hacking-for-hire company accused of running a decade-long spear-phishing campaign that stole more than 31 terabytes of academic data and intellectual property from 144 U.S. and 178 foreign universities, at least 53 companies, and multiple federal agencies including the Department of Labor and the Federal Energy Regulatory Commission. Prosecutors say the group targeted upward of 100,000 professor email accounts worldwide and successfully compromised roughly 8,000 of them, then resold the stolen research through two websites catering to buyers inside Iran — one of which let paying customers log directly into compromised professor accounts to access university library systems. Much of the campaign was allegedly carried out on behalf of Iran’s Islamic Revolutionary Guard Corps, and the State Department has announced a $10 million reward for information leading to the location of several of the accused, who remain at large.
