Vulnerability in Claude Extension for Chrome Exposes AI Agent to Takeover
Lax extension permissions and improper trust implementation allow attackers to inject prompts in the Claude Chrome extension. The
CYBERSECURITY INTELLIGENCE
News that matters, without the noise.
Search current cybersecurity reporting locally in this app. Search terms are not sent to AdvisoryLoom. The Professional plan adds Watchlists, structured My Intelligence, and AI briefings.
Private search: the term stays in this browser and is matched against a generic content feed.LATEST COVERAGE
Latest cybersecurity news
The Canvas Hack Is a New Kind of Ransomware Debacle
Thousands of schools around the US were paralyzed on Thursday after education tech firm Instructure shut down access
2 sources
Dirty Frag Linux Vulnerability Let Attackers Gain Root Privileges – PoC Released
Dirty Frag is a newly disclosed, CVE-pending Linux kernel local privilege escalation (LPE) vulnerability that chains two separate page-cache
Connected reporting, one intelligence threadcybersecuritynews.com · isc.sans.edu
Multiple Critical Vulnerabilities Patched in Next.js and React Server Components
Vercel has released an extensive set of security advisories for Next.js, addressing more than a dozen vulnerabilities, including
Canvas Breach Disrupts Schools & Colleges Nationwide
An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school
When prompts become shells: RCE vulnerabilities in AI agent frameworks
In this article A representative case study: Semantic Kernel CVE-2026-26030: In-Memory Vector Store CVE-2026-25592: Arbitrary file write through
Canvas login portals hacked in mass ShinyHunters extortion campaign
The ShinyHunters extortion gang has breached education technology giant Instructure again, this time exploiting another vulnerability to deface
A New Era of Security: Frontier AI Defense
For the last several months, we have had early, unbounded access to the latest frontier AI models. What
New TCLBanker malware self-spreads over WhatsApp and Outlook
A new trojan named TCLBanker, which targets 59 banking, fintech, and cryptocurrency platforms, uses a trojanized MSI installer
How to Disable Google’s Gemini in Chrome
Chrome users were caught off guard by a 4-GB Google AI model baked into Chrome, sparking privacy concerns.