Weekly Cybersecurity Roundup: OpenAI Tool, North Korean Supply-Chain Activity and More

A range of cybersecurity developments this week involved data exposure, software vulnerabilities, credential attacks and emerging research into artificial intelligence-assisted security testing.

Incidents and vulnerability activity

Parcel carrier OnTrac said attackers accessed its corporate network and certain files between March 20 and 22. The company detected the intrusion the following day and brought in an external specialist to assess the impact. No ransomware operation has publicly claimed responsibility.

Adobe released fixes for vulnerabilities in Bridge, Campaign Classic and Format Plugins. The issues include flaws that could lead to arbitrary code execution, privilege escalation and unauthorized file reads. Adobe said it had not observed exploitation, although the Campaign Classic update received the company’s highest priority rating for on-premises customers.

Huntress reported an automated credential-stuffing campaign targeting SonicWall VPN and firewall accounts. The activity, which began July 25, used five DigitalOcean-hosted addresses and resulted in successful logins at approximately 30 organizations. Investigators have not seen evidence of interactive activity after the accounts were accessed.

England’s Department for Education disclosed that about 607,000 records containing email addresses and telephone numbers were obtained by attackers. The department said bank information and other highly sensitive data were not involved, and assessed the risk to affected individuals as low.

Software supply chain and research

OpenAI published the Codex Security CLI as an open-source project. Distributed through npm and GitHub, the early-stage tool can scan code repositories, preserve findings between assessments, validate remediation and connect security checks to development pipelines.

Amazon Web Services attributed compromises involving the Axios, Debug and Chalk npm packages, as well as a related cryptocurrency incident, to the North Korean group Sapphire Sleet. AWS said the operation appeared designed to exploit widely downloaded packages and used techniques such as split payloads and environment-specific execution.

A researcher also identified unauthenticated internal APIs in VE Commercial Vehicles’ My Eicher platform. The flaws exposed customer, account and vehicle information, enabled account takeover and could provide control over commercial fleets. The company addressed the main findings and later fixed additional issues.

Finally, Anthropic researchers using its Claude Mythos Preview reported improved attacks against the candidate post-quantum signature scheme HAWK and a reduced-round version of AES. The work does not undermine deployed systems, but illustrates how AI tools may accelerate cryptanalysis research.