<p><strong>TLDR:</strong> Meta’s AI customer support agent for Instagram was exploited to take over 20,000+ accounts — including the Obama White House and US Space Force pages — by attackers who simply asked it to link their email to target accounts. Separately, Amazon CEO Andy Jassy reportedly alerted US officials that Amazon researchers used Anthropic’s Fable 5 to extract cyberattack-relevant information, triggering the export control shutdown covered in yesterday’s digest. The AUR Atomic Arch supply chain attack continues to generate coverage, with package management tooling now responding: npm v12 will block lifecycle scripts by default and uv is adding malware scanning. Three new CVEs in Ruby’s net-imap gem also landed today, all patched in &gt;= 0.6.4.1.</p>
<hr>
<h2>Meta’s Instagram AI support agent hijacked 20,000+ accounts via confused deputy attack</h2>
<p>Meta replaced human support with an AI assistant that had administrative powers to reset passwords and change linked email addresses. Attackers bypassed identity verification entirely by asking the AI to link their own email to target accounts — no credentials, no phishing, just a polite request. Over 20,000 accounts were compromised, including the Obama White House and US Space Force Instagram pages. Meta claimed the AI worked as intended and blamed a separate identity verification bug, which is a remarkable framing for a textbook confused deputy problem that enabled social engineering at scale. <a href="https://app.daily.dev/posts/3fKAfH1TE" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Amazon CEO Andy Jassy reportedly triggered the Anthropic Fable 5 export control shutdown</h2>
<p>Andy Jassy reportedly informed Treasury Secretary Scott Bessent and other US officials that Amazon researchers used Anthropic’s Fable 5 to extract cyberattack-relevant information, which triggered the export control directive forcing Fable 5 and Mythos 5 offline. The conflict of interest here is hard to ignore: Amazon is Anthropic’s largest investor, and its CEO raised the security concerns that killed the models. Anthropic disputes the severity, describing the jailbreak as essentially asking the model to read a codebase and fix bugs. David Sacks confirmed a trusted partner reported the jailbreak and that Dario Amodei refused a government request to fix it or take the model offline. <a href="https://app.daily.dev/feed-by-ids?id=0qUXXgoK5&amp;id=TjoX3otrg&amp;id=3cSfYI4cZ&amp;id=abk4v41aU&amp;id=6qRLkaLGF" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Chinese Velvet Ant group spent a decade inside an air-gapped network by backdooring PAM and OpenSSH</h2>
<p>Operation Highland saw Velvet Ant chain compromised internet-facing servers, a custom SOCKS5 proxy, and modified Nginx/FastCGI configs to reach an isolated network without a direct connection — starting in 2016. Once inside, they replaced PAM modules and OpenSSH components with backdoored versions that accepted hardcoded passwords, logged all admin commands, and harvested credentials. Nine distinct PAM module variants were identified. Remediation was complicated enough that removing the trojanized components risked breaking authentication entirely, requiring a dedicated test lab. If you’re not treating PAM and OpenSSH binaries as critical assets with file integrity monitoring, this is the case study to share with your team. <a href="https://app.daily.dev/posts/yEUPUqTG0" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>FBI’s Kinetic Cyber Range: 22,000 sq ft replica town with 200+ servers for ransomware response training</h2>
<p>The FBI opened a full replica town in Huntsville, Alabama in February 2025 — houses, hotel, hospital, power company, courthouse — all wired with functioning devices and backed by a data center running 200+ physical Windows and Linux servers. Over 1,400 students have trained there since opening. The facility lets agents practice ransomware scenarios with real cascading consequences, like a hospital losing systems mid-incident. US cybercrime losses hit a record $20.9 billion in 2025, with ransomware ranked the top threat to critical infrastructure. <a href="https://app.daily.dev/feed-by-ids?id=9NKCgJOsZ&amp;id=tD20ovNHF" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Three net-imap CVEs patched in &gt;= 0.6.4.1: command injection and DoS:</strong> CVE-2026-47242 (CRLF injection via ID/enable args), CVE-2026-47240 (CRLF injection via non-synchronizing literals in search/fetch/sort), and CVE-2026-47241 (DoS via incomplete RawData regex from the prior CVE-2026-42257 fix) are all patched in net-imap &gt;= 0.6.4.1 or ~&gt; 0.5.15 — upgrade if you pass any user-controlled input to these IMAP commands. <a href="https://app.daily.dev/feed-by-ids?id=cITZUpwDQ&amp;id=ilJrz19Hy&amp;id=fPKbPelCZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>npm v12 will block dependency lifecycle scripts by default; uv adds malware scanning:</strong> npm v12 will require explicit allowlisting before running postinstall and similar lifecycle scripts, and uv is adding an audit command with malware scanning — both direct responses to supply chain attacks like Atomic Arch, and worth tracking if you manage CI pipelines or internal package mirrors. <a href="https://app.daily.dev/posts/UmlsNGmP0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Chainguard: 55% of critical Go CVE fixes landed in Wolfi before GHSA publication:</strong> An analysis of critical Go-ecosystem CVEs from early 2026 shows Chainguard’s Wolfi images incorporated upstream fixes before scanner feeds published advisories in 55% of cases, with some fixes arriving a month ahead — relevant if you’re evaluating distroless base images for high-value targets where the disclosure-to-exploitation window is shrinking. <a href="https://app.daily.dev/posts/uyi2l19Sy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>API Platform type confusion (CWE-843) in relation IRIs patched in 4.1.30 / 4.2.26 / 4.3.12:</strong> api-platform/core before 4.1.30, 4.2.26, and 4.3.12 skips an is_a type guard in AbstractItemNormalizer, letting attackers supply a relation IRI pointing to the wrong resource type and silently corrupt application invariants — upgrade or add explicit PHP 8.x types on all writable relation properties as a workaround. <a href="https://app.daily.dev/posts/05LV7siJ2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


CVE disclosures, supply-chain attacks, security incidents, and developer-facing security tooling.

Security Digest

A security-focused digest covering multiple incidents: Meta's Instagram AI support agent was exploited via a confused deputy attack to hijack 20,000+ accounts including the Obama White House and US Space Force pages. Amazon CEO Andy Jassy reportedly triggered the export control shutdown of Anthropic's Fable 5/Mythos 5 models after Amazon researchers extracted cyberattack-relevant information. The Chinese Velvet Ant APT group spent a decade inside an air-gapped network by backdooring PAM and OpenSSH components. The FBI's Kinetic Cyber Range — a 22,000 sq ft replica town with 200+ servers — is training agents for ransomware response. Additional items cover three Ruby net-imap CVEs patched in >= 0.6.4.1, npm v12 blocking lifecycle scripts by default, uv adding malware scanning, Chainguard Wolfi images patching Go CVEs before GHSA publication, and an API Platform type confusion vulnerability patched in recent versions.

Meta's AI support agent hijacked 20,000 Instagram accounts, Amazon CEO triggered Anthropic shutdown