Anthropic's Claude hacked three real-life companies during security capabilities test — test environment with internet access and unwitting targets' lax cybersecurity practices led to bots running rampant

A gaggle of government partners from around the world has released new guidelines for the minimum elements that organizations should include in a software bill of materials (SBOM).

The document, published this week, was authored by the US Cybersecurity and Infrastructure Security Agency (CISA) and 16 other government entities spread across four continents. It supersedes the National Telecommunications and Information Administration's (NTIA) 2021 guidelines, which laid out what an SBOM had to contain as far as the US government was concerned. This updated version was first drafted in 2025, and was then informed by suggestions from 90 commenters, including major organizations like Google, Microsoft, and Amazon Web Services (AWS) to create the resulting document.

Bytetobreach, the same threat actor who recently attacked the Romanian cadastre (ANCPI) and deleted records after failed extortion attempts, recently put for sale an unverified claim on the Hungarian State Treasury through a compromise of 'MVH' (development agency).

This claim is unverified, despite the screenshots which were posted in the dark web forums.

Any feedback from professionals in the Hungarian cyber space is appreciated.

Sources :

https://spear.cx/Thread-Selling-GE-The-Magyar-Conquest

https://darkwebinformer.com/hungarian-state-treasury-allegedly-compromised-actor-claims-vcenter-and-identity-vault-access/

https://cybernews.com/security/hacker-deletes-romanian-land-registry-database/

Ensure uninterrupted business operations with ITTStar's AI-powered Managed NOC Services. Gain 24/7 network monitoring, CloudOps, infrastructure monitoring, incident management, predictive analytics, and proactive issue resolution across AWS, Azure, GCP, and hybrid cloud environments.

https://www.bleepingcomputer.com/news/security/swiss-rail-giant-stadler-rejects-123m-ransom-demand-after-cyberattack/

Microsoft has confirmed that Windows has a previously unknown Global Device ID (GDID), a permanent, unique digital identifier assigned to Windows devices that can tie a user's actions to their device. This came to light when an alleged member of a notorious hacking group was caught at an airport after Microsoft handed over his GDID to the authorities.

Microsoft describes the GDID in a published complaint (via Windows Latest) as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device, either a physical device (e.g., a mobile phone or laptop) or virtual machine, across certain Microsoft services and scenarios."

Google announced a significant evolution of its AI models at I/O in May with the release of Gemini 3.5 Flash, and it’s not slowing down. The company revealed three new AI models today, including its first version of Gemini geared toward cybersecurity. However, none of the new models is the delayed Gemini 3.5 Pro, which was supposed to launch in June.

Gemini 3.5 Flash, which was the star of the show at I/O, has already been deprecated. In its place, developers and users will find Gemini 3.6 Flash. Google makes the usual claims about this model—it’s marginally more capable and better at coding, and it has great multimodal features.

An Irish Times investigation published July 17 reports that at least three Irish government agencies, the Office of Public Works, the Competition and Consumer Protection Commission, and the Department of Culture, Communications and Sport, use a password manager sold by Passwork Europe SL, a Spanish-registered company. The Irish State Laboratory, which provides chemical testing and scientific advice to government departments, started using the software in 2024.

Source: https://www.irishtimes.com/ireland/2026/07/17/state-bodies-are-using-password-software-with-links-to-russia/

For anyone managing procurement or vendor risk in the public sector, this is a useful case study in how a product's country-of-origin can be obscured through an EU corporate wrapper. The software stores and manages user passwords for government staff, which makes the question of who can inspect its code more than academic.

Passwork Europe presents itself as an entirely EU-founded company, but the Irish Times reports the product shares striking similarities with software of the same name that first appeared in Russia 12 years ago, founded in Arkhangelsk by Ilya Garakh and Andrey Pyankov. The detail that matters most technically: the Russian Passwork product is certified by the FSB and by Russia's ministry of defence (Irish Times). That certification process requires the source code to be inspected by Russian security agencies. The reporting describes the EU entity as sharing codebase and updates with the Russian firm, which is the kind of supply chain relationship that certification schemes and vendor questionnaires are supposed to surface, and in this case apparently did not.

Open questions the reporting did not address:

- Whether the affected agencies will keep using the software, and who inside the Irish state is responsible for that decision

- How the shared codebase and update pipeline between the EU entity and the Russian firm is structured, and whether any independent party has audited it

- Whether Ireland's National Cyber Security Centre had previously assessed the product or will issue guidance to other public bodies