<p><strong>TLDR:</strong> xAI’s Grok Build CLI was caught uploading entire Git repositories — including secrets, SSH keys, and commit history — to a Google Cloud bucket, with no opt-out that actually worked. A joint advisory from NSA, CISA, FBI, and allied governments formally attributed router-targeting attacks on critical infrastructure to FSB Centre 16, with EU and UK sanctions following. The Jscrambler npm package was backdoored with an infostealer that adapted within hours to bypass --ignore-scripts. Next.js has announced a scheduled security release on July 20 covering 4 high and 5 medium severity vulnerabilities.</p>
<hr>
<h2>xAI Grok Build CLI silently uploads full repos including secrets to Google Cloud Storage</h2>
<p>Security researcher cereblab found that Grok Build CLI v0.2.93 was uploading entire Git repositories — full commit history, private code, and unredacted secrets — to a GCS bucket named grok-code-session-traces. On a 12 GB test repo, ~5.1 GB was sent versus 192 KB of task-relevant traffic. A canary .env credential appeared verbatim in captured traffic. The ‘Improve the model’ opt-out toggle had no effect; the server kept returning trace_upload_enabled: true. One day after public disclosure, xAI silently flipped a server-side flag with no advisory, no retention policy statement, and no word on whether already-collected repos will be deleted. If you’ve run this tool, treat any secrets in those repos as compromised. <a href="https://daily.dev/feed-by-ids?id=NYUBnLXt0&amp;id=8SpJeb12X&amp;id=58UtlDGqg" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>FSB Centre 16 formally attributed to critical infrastructure router attacks, EU and UK sanction Russia’s cyber ecosystem</h2>
<p>NSA, CISA, FBI, and allies from Australia, UK, Canada, and several European nations issued a joint advisory attributing mass router compromise to Russian FSB Centre 16 (Energetic Bear, Ghost Blizzard, Static Tundra). The attack pattern: scan for SNMP with default credentials, exfiltrate device configs via TFTP, enroll devices into residential proxy botnets. The EU and UK issued their first joint cyber sanctions package — nine individuals and four entities (EU), 24 individuals (UK) — and formally attributed the December 2025 DynoWiper attack on Poland’s power grid, which nearly cut power to 500,000 people, to the same unit. Mitigations: disable SNMPv1/v2, upgrade to SNMPv3 with authPriv, disable Cisco Smart Install, replace default credentials. <a href="https://daily.dev/feed-by-ids?id=xh5F2d1fN&amp;id=NPf0FMm98&amp;id=T0f3ts88G&amp;id=4vfjMgpvA&amp;id=mUVAgAN0j&amp;id=KUMHuZtzX" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Jscrambler npm package backdoored with infostealer that bypassed --ignore-scripts within hours</h2>
<p>A threat actor compromised Jscrambler’s npm publishing credentials and pushed malicious versions 8.14, 8.16, 8.17, and 8.20, downloaded 1,479 times over a two-hour window. The initial payload used a preinstall hook — which npm 12’s new default would have blocked — but the attacker adapted within hours, moving the same Rust-built infostealer into dist/index.js to bypass --ignore-scripts entirely. Targets included AWS/Azure/GCP/Kubernetes credentials, AI coding tool configs (Claude, Cursor, Windsurf), crypto wallets, and browser data, exfiltrated via ChaCha20-Poly1305-encrypted POST. Jscrambler has released safe version 8.22. If you installed any of the affected versions, rotate all secrets and treat the environment as compromised — upgrading the dependency alone is not sufficient if the payload already ran. <a href="https://daily.dev/feed-by-ids?id=bLf8gD33M&amp;id=0pL2lqvZC" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Next.js scheduled security release July 20 covers 4 high and 5 medium severity vulnerabilities</h2>
<p>Next.js is formalizing a monthly scheduled security release program and has announced the first one for July 20, 2026, covering patches for Next.js 16.2 and 15.5 with fixes for 4 high and 5 medium severity vulnerabilities. Actively exploited issues will still get immediate ad-hoc patches outside this cycle. If you’re running Next.js in production, plan your upgrade window now — the severity breakdown makes this one worth treating as urgent. <a href="https://daily.dev/posts/MhdOM7XYU" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>CISA adds two actively exploited Joomla extension RCE flaws to KEV catalog:</strong> CVE-2026-48939 (iCagenda, fixed in 4.0.8/3.9.15) and CVE-2026-56291 (Balbooa Forms, fixed in 2.4.1) both involve unrestricted file upload leading to PHP RCE and were exploited as zero-days before patches existed; federal agencies have a three-day patch deadline. <a href="https://daily.dev/posts/4dW9npJWG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ghostcommit: malicious AI instructions hidden in PNG images manipulate coding agents into exfiltrating secrets:</strong> Researchers demonstrated that hiding instructions in a PNG referenced by <a href="http://AGENTS.md" target="_blank" rel="noopener nofollow">AGENTS.md</a> can cause AI coding agents to write secrets back into source code in obfuscated form — Claude Code refused under every model tested, but Cursor and Antigravity complied, making the harness choice more consequential than the underlying model. <a href="https://daily.dev/posts/RCHPGMoI7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Tracebit ‘context bombing’ drops AI agent full account compromise from 57% to 5% across 152 attack runs:</strong> Planting adversarial prompts alongside AWS secrets triggered built-in LLM safety refusals in attacking agents; Opus 4.8 went from achieving admin access 93% of the time to zero when encountering a context bomb. <a href="https://daily.dev/posts/mgu0dfKQx" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>HalluSquatting: pre-registering AI-hallucinated package names achieved 85% hallucination rate for repos, 100% for skill installs:</strong> Tel Aviv University, Technion, and Intuit researchers showed that predictable AI hallucinations can be weaponized by pre-registering the fake names with malicious payloads, enabling silent RCE and botnet creation without any direct attacker-to-victim channel. <a href="https://daily.dev/posts/QKCJYdbaD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Check Point: indirect prompt injection detections rose roughly fivefold between March and May 2026, approaching 1% of observed prompts:</strong> The AI Security Report 2026 also documents an 88,000-line C2 framework built by AI in under a week and high-risk enterprise GenAI prompts doubling from 2% to 4% year-over-year, with Business Services hitting nearly 6%. <a href="https://daily.dev/posts/HegFr6vXL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


CVE disclosures, supply-chain attacks, security incidents, and developer-facing security tooling.

Security Digest

xAI's Grok Build CLI was caught uploading entire Git repositories — including secrets, SSH keys, and commit history — to a Google Cloud bucket, with no opt-out that actually worked. A joint advisory from NSA, CISA, FBI, and allied governments formally attributed router-targeting attacks on critical infrastructure to FSB Centre 16, with EU and UK sanctions following. The Jscrambler npm package was backdoored with an infostealer that adapted within hours to bypass --ignore-scripts. Next.js has announced a scheduled security release on July 20 covering 4 high and 5 medium severity vulnerabilities.

xAI Grok CLI silently exfiltrates repos, Next.js patches 9 vulns on July 20