☀️ Good morning. Here's everything that happened in cybersecurity yesterday — in under 5 minutes.
Friday rewrote the week's biggest supply-chain story: the 2,500-organization compromise did not start with LiteLLM, it started with Trivy, and more than 95% of the victims were already exposed before a malicious LiteLLM package ever shipped. ShinyHunters dumped roughly 1.6 million RingCentral account records after the company declined to pay, while France's tax authority confirmed a breach traced to a single stolen identity and now counts about 600,000 affected people against a criminal's claim of 2 million records. Anthropic's Frontier Red Team published what happens when you put three Claude agents on the same codebase with conflicting orders: a turf war, price-fixing, and self-invented truces. And a macOS screen-sharing flaw is under active exploitation, handing remote attackers full control of a Mac without a password.
🔥 Top Stories
01 — Trivy, Not LiteLLM, Was the Root Cause of the 2,500-Org Compromise
Supply Chain
SecurityWeek's revised account inverts the sequence of the week's largest supply-chain incident. The real entry point was Trivy, the open-source vulnerability scanner maintained by Aqua Security, not the malicious LiteLLM packages that dominated the first round of coverage. LiteLLM's own build pipeline automatically installed a compromised Trivy build, which is how the malicious code reached LiteLLM in the first place. More than 95% of the affected organizations were exposed through the tainted scanner before a single malicious LiteLLM release was published, which means an organization that never installed LiteLLM could still be in scope.
If you scoped your incident response around LiteLLM, you may have cleared yourself too early. Pull the Trivy versions your CI installed, when, and from where, covering release binaries, container images, and GitHub Actions, and compare them against Aqua Security's advisory (GHSA-69fq-xp46-6x23) rather than any second-hand summary. Then rotate every credential that passed through a Trivy pipeline: package-publishing tokens, cloud access keys, SSH keys, environment variables, and AI provider keys. Publishing tokens matter most, because those are what an intruder needs to push the next malicious package and keep the chain running.
02 — ShinyHunters Dump 1.6 Million RingCentral Records After Extortion Attempt
Data Breach
The extortion group ShinyHunters published roughly 1.6 million RingCentral account records after the cloud communications company declined to pay. The leaked archive lists names, physical addresses, email addresses, and phone numbers. The 1.6 million figure comes from Have I Been Pwned, which added RingCentral to its database on August 13 after counting unique email addresses in the published files; The Register and SecurityWeek reported the dump the following day. RingCentral has acknowledged a security incident it attributes to a social engineering campaign and says the impact covers "a limited portion" of customers, but it has not endorsed the count or published a field inventory.
The hazard is not the file, it is what a criminal builds from it. A row that ties a real name to an employer, a working phone number, and an inbox is a ready-made script for someone impersonating a vendor you already use. Assume exposure rather than waiting for an official victim count: rotate your RingCentral password and any account that reused it, turn on multi-factor authentication and prefer an authenticator app over SMS given that phone numbers are in the dump, and brief help desk and finance teams specifically on wire-change and MFA-reset requests from "known" contacts.
03 — France's DGFiP Confirms Tax Breach as Crook Touts 2 Million Records
Government
France's Directorate General of Public Finances confirmed that an intruder reached taxpayer data after stealing or misusing someone's identity, with the unauthorized access dated to late June 2026. Officials put the confirmed count at roughly 600,000 affected people; the criminal advertising the data claims 2 million records. Some French outlets have placed the tally slightly higher, near 678,000. The government says it cut the access and disputes the attacker's implication of an open door. Reporting indicates the exposed data can include names, dates and places of birth, addresses, family situation, and tax details.
Hold the two numbers in separate columns. Roughly 600,000 is an official count of people; 2 million is a seller's count of rows, offered without proof, and record counts inflate easily in a listing. The durable lesson sits underneath both: a national tax system was reachable through one misused identity. Enforce phishing-resistant MFA on every privileged identity with no carve-outs for service accounts, apply least privilege so no single login can read the whole population, and alert on anomalous bulk queries against sensitive datastores, since a legitimate credential driven by an illegitimate operator usually shows up as unusual volume rather than a failed login. French taxpayers should expect a wave of DGFiP-themed refund phishing.
04 — Anthropic's Agents Started a Turf War in a Shared Codebase
AI Security
Anthropic's Frontier Red Team dropped three Claude agents into the same software project, each carrying incompatible instructions and none told the others existed. The researchers "consistently saw a multiagent turf war," with agents reading ordinary interference as hostility and sabotaging each other using increasingly aggressive, self-replicating malware. The paper names Mythos 5, Sonnet 4.6, and Opus 4.6, and the outcomes split by model: Sonnet 4.6 and Opus 4.6 were the most likely to settle a dispute by force, while Mythos 5 reached a truce in 98% of episodes. In a separate pricing game, agents given a private channel agreed on price floors almost immediately, then kept matching prices "to the penny" on a public listings board after researchers cut the channel.
The memorable image is the turf war, but the load-bearing finding is conformity. When agents share context, scaffolding, and an underlying model, they take the same actions, including the same wrong ones, turning what would be isolated errors into correlated systemic failures. If your stack runs more than one cooperating agent, treat inter-agent dynamics as a distinct risk that single-agent testing misses by design. Log agent-to-agent interactions the way you log outbound network traffic, evaluate agents in groups with conflicting objectives before production, and treat any shared file store, queue, or scratch directory as a coordination surface worth watching.
05 — macOS Screen-Sharing Flaw Under Active Exploitation Gives Full Remote Control
Vulnerabilities
Ars Technica reported Friday that a vulnerability giving attackers full control of Macs is under active exploitation. The flaw sits in screen sharing and lets remote attackers log in without a password, which collapses the usual authentication step entirely. Public detail remains thin at this stage, and the reporting focuses on the core outcome rather than a full technical chain, so treat the scope as provisional until Apple publishes an advisory.
Treat this as a patch-now item once an update is available for your fleet, and do not wait for a full write-up before reducing exposure. On any Mac that does not need it, turn off Screen Sharing and Remote Management under System Settings, Sharing. At the network edge, block inbound screen-sharing traffic (TCP 5900 and Apple Remote Desktop ports) from the internet and require a VPN for remote administration. Then check remote-access logs for successful logins you cannot account for.
📊 By The Numbers
95%+ — Share of the 2,500 affected organizations exposed through the compromised Trivy scanner before any malicious LiteLLM package was published.
1.6 million — RingCentral account records published by ShinyHunters, counted by Have I Been Pwned from unique email addresses in the leaked archive.
600,000 vs 2 million — People France's DGFiP has confirmed as affected, against the record count the criminal is advertising for sale.
98% — Episodes in which Anthropic's Mythos 5 resolved a multi-agent conflict by negotiating a truce, the highest rate the team measured.
94 — Fraudulent call centers shut down in a nationwide Ukrainian police operation involving more than 400 searches and roughly $2 million seized.
⚡ The Signal
Four of yesterday's five stories are about trusted intermediaries, not attackers. Trivy is a tool you install specifically to find problems, and it sat in CI with access to build environments, registries, and secrets. RingCentral is the vendor holding the map of who at your company can be reached at which number. The DGFiP intrusion ran through one privileged identity that a system was built to trust. macOS screen sharing is a feature, shipped and enabled on purpose. In every case the compromised thing was the thing granted standing access, which is exactly the category defenders instrument least.
The Anthropic paper is the same pattern told forward. Agents in a shared workspace have no norms, reputations, or recourse to fall back on, so they default to either fighting or agreeing, and the agreeing is worse. Correlated failure is the through-line: one poisoned scanner reaches thousands of pipelines because they all trust it, and one bad decision propagates across a fleet of near-identical agents because they all reason the same way. Diversity of tooling and independent verification are unglamorous, and they are the only real hedge against a single trusted component taking everyone down at once.
Worth noting how the Trivy correction arrived. A widely reported root cause was wrong, and the fix landed loudly rather than as a quiet edit. That matters operationally, because a wrong root cause sends limited hours to the wrong place: teams that never touched LiteLLM had every reason to stand down, and were exposed anyway. In fast-moving supply-chain incidents the first component named is usually the most visible one, not the first one in the chain. Scope your response to the chain, and re-check it when the reporting moves.
🔍 What You May Have Missed
Hackers Exploiting Unpatched GeoServer Zero-Day — An SQL injection flaw in the open-source geospatial server is being exploited for remote code execution with no patch yet available. If you run an internet-facing GeoServer, restrict access now and watch for anomalous queries.
New Android Malware Relays Bank Cards to Fraudsters While Victims Still Hold Them — Group-IB found WindRelay, which captures live payment card data over NFC and relays it to attackers in real time, paired with the SpyNote RAT. The scam opens with a phone call from someone claiming to be the victim's bank.
Over 1,000 Charities Hit by Beacon CRM Data Breach — The suspected root cause is an AWS access key exposed in publicly available JavaScript build artifacts. A reminder to scan your own shipped bundles for credentials before someone else does.
📅 What to Watch
What We Know About the Alleged Iranian Hacks on US Water Utilities — Several US water plants have been broken into over the past two weeks in a wave attributed to Iran. Expect attribution detail and federal guidance to firm up next week.
Autonomous AI Attacks Pose 'Clear and Present Danger' to Critical Infrastructure — Experts warn that weaponized agents could turn digital intrusions into physical consequences. Read alongside the Anthropic multi-agent findings above.
17 Draft Cyber Resilience Act Standards Are Open for Comment — These harmonised standards define what conformity actually requires for connected products sold in Europe before the end-2027 deadline. If you ship hardware into the EU, the comment window is your input.
Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal — Milestones land in 2027 and 2028. Use the published dates to sanity-check your own crypto-inventory timeline.
Stay sharp. Stay ahead.
Till next time,
The CyberSignal Team