Infosecurity

JadePuffer Returns With ENCFORGE: A Ransomware Built to Wipe AI Models, Not Just Data

Published

1 day ago

July 21, 2026

The Return of a First-of-Its-Kind Threat

Late last year, security researchers watched something unprecedented: a ransomware campaign orchestrated entirely by a large language model (LLM). The operator, tracked as JadePuffer, used a Langflow instance as its beachhead and let an AI agent call the shots. Now it’s back — and this time, it brought a weapon tailor-made for the machine learning stack.

On July 20, the Sysdig Threat Research Team (TRT) published a detailed breakdown of JadePuffer’s second act. The group re-entered the same vulnerable Langflow server it compromised in its earlier campaign. Inside, it staged a new payload called ENCFORGE: a UPX-packed Go ransomware binary that targets roughly 180 file extensions spanning the modern ML pipeline.

This is not opportunistic spray-and-pray malware. The targeting is surgical.

ENCFORGE’s Hit List: PyTorch, TensorFlow, HuggingFace, and More

Sysdig’s analysis reveals that ENCFORGE explicitly hunts for the artifacts that data scientists and ML engineers spend weeks — sometimes months — building. The binary’s extension list includes:

PyTorch and TensorFlow checkpoints — the saved state of a model mid-training.
HuggingFace SafeTensors weights — the serialized parameters of popular transformer models.
llama.cpp GGUF quantized models — the compressed, deployable versions of LLMs like Llama and Mistral.
FAISS vector indices — the searchable embeddings that power retrieval-augmented generation (RAG) pipelines.
Apache Parquet and TFRecord training datasets — the formatted data that feeds the training loop.
NumPy arrays — the raw numerical backbone of nearly every scientific Python workload.

The binary also includes a --include command-line flag, letting operators append custom extensions per campaign. The help text inside ENCFORGE actually names LoRA fine-tune adapters and legacy GGML weights as examples. The attackers know the ML stack intimately — or at least, they’ve studied it closely enough to know exactly where it hurts.

The Real Cost: Rebuilding, Not Ransom

Here’s the twist that makes JadePuffer genuinely dangerous. Most ransomware groups demand payment in exchange for a decryption key. But ENCFORGE carries no data-exfiltration capability. There is no leak site. No double-extortion playbook.

The threat is the destruction itself.

Sysdig estimates that rebuilding a production-grade model from scratch — after the last clean backup — costs between $75,000 and $500,000 in cloud GPU time and engineering labor. That gap between the backup snapshot and the attack often represents weeks or months of training runs, hyperparameter tuning, and data curation. If the training data sat on the same host as the encrypted model, recovery is blocked entirely until that data is reconstructed.

ENCFORGE sweeps every model variant on shared storage in a single pass. One encryption run can wipe out an entire team’s work for a quarter.

Container Escape in Under Six Minutes

The entry point is familiar but still effective. JadePuffer again exploited CVE-2025-3248, a missing-authentication flaw in Langflow’s code validation endpoint. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog back in May 2025.

Once inside the Langflow container, the AI agent ran through reconnaissance and credential harvesting — the same routine seen in the first campaign. When it discovered a mounted Docker socket, it pivoted to fetch the ransomware payload from its command-and-control (C2) server.

That fetch failed inside the container. So the operator — still working through the Langflow RCE channel — rebuilt the delivery mechanism on the fly.

Over five minutes and 24 seconds, the agent iterated through six Python scripts. It converged on a working pipeline that used the mounted Docker socket to spawn a privileged escape container, copied the locker across the namespace boundary via the host’s procfs, and then ran the encryption pass on the host filesystem — completely outside the original container’s isolation.

ENCFORGE itself uses AES-256-CTR with an RSA-2048 key exchange. It kills processes holding file locks before encrypting, then self-deletes after execution. Clean, precise, and hard to trace.

What This Means for AI Teams

JadePuffer’s return signals a shift in how ransomware groups think about targets. Traditional encryption attacks hit databases, documents, and financial records. But the ML stack — checkpoints, weights, vector indices — is becoming just as valuable, and far harder to replace.

For teams running Langflow, securing Langflow instances against known CVEs is the obvious first step. But the deeper lesson is about defense-in-depth for ML infrastructure. Container escape via a mounted Docker socket is a classic vector, yet it still works because many data science environments prioritize flexibility over isolation.

Organizations should consider AI model backup strategies that separate training data and model artifacts from the compute environment. Immutable storage and air-gapped snapshots can close the gap between the last clean copy and the attack. And monitoring for unusual container spawns or procfs access should be part of any ML-specific detection rule set.

JadePuffer isn’t going away. The group proved it can adapt, rebuild delivery chains in minutes, and target the most expensive assets in the modern AI stack. The question is whether the industry will adapt fast enough to keep up.

Infosecurity

Kenya Investigates Cyberattack on President’s Website After Hackers Demand Bitcoin Ransom

Published

5 hours ago

July 22, 2026

Social Media Admin

Attackers Target Presidential Site with Anti-Government Message

Kenyan authorities are investigating a cyberattack that temporarily took over President William Ruto’s official website over the weekend. The homepage was replaced with a message demanding a ransom of five bitcoins — roughly $330,000 — in exchange for not releasing what the hackers claimed was sensitive information about the president.

The defacement occurred on Saturday. By Monday, local media reported that access to the site had been restored. The attackers’ identity remains unknown, and there is no verified evidence that they obtained or leaked any classified government data.

Government Response: ‘No Evidence of Data Exfiltration’

Information, Communications and the Digital Economy Cabinet Secretary William Kabogo confirmed the incident over the weekend. He stated that cybersecurity teams are actively investigating the breach.

“As a precautionary measure, access to the Presidential website was temporarily restricted to facilitate containment, forensic analysis and restoration efforts,” Kabogo said in a statement.

He added that authorities found no signs of unauthorized access to sensitive data, data exfiltration, or information loss. “Government systems and digital services remain secure and operational,” Kabogo emphasized.

Screenshots circulating on social media showed the defaced page included a cryptocurrency wallet address and a threat that this was the attackers’ “third” warning to the president before they would publish data. Officials have not confirmed that claim, and no leak has materialized.

Not the First Cyber Incident Targeting Kenyan Government Sites

This attack follows a pattern of digital intrusions into Kenyan government infrastructure. In November 2025, a coordinated cyberattack disrupted multiple government websites, including those of the presidency and ministries for interior, health, education, energy, labor, and water.

During that incident, attackers defaced several ministry pages with white supremacist slogans, including “We will rise again,” “White power worldwide,” and the neo-Nazi code “14:88 Heil Hitler.” The perpetrators behind that attack were never publicly identified.

The repeated targeting of high-profile government portals raises questions about the overall cybersecurity posture of Kenya’s digital infrastructure. While officials insist core systems remain secure, the frequency of these incidents suggests persistent vulnerabilities.

What the Bitcoin Ransom Demand Reveals

Demanding five bitcoins — a sum that fluctuates with the cryptocurrency market but currently sits around $330,000 — is a relatively modest ask compared to some ransomware attacks targeting large corporations or critical infrastructure. This could indicate the attackers are less sophisticated actors, or that their primary goal was disruption and attention rather than financial gain.

The defacement itself, replacing the homepage with a political message, is a classic hacktivist tactic. It aims to embarrass the government and broadcast a grievance, not necessarily to steal data or extort money long-term.

Still, the inclusion of a ransom demand and a threat to leak information adds a layer of potential extortion. If the attackers do possess compromising material — a claim that remains unverified — the situation could escalate quickly.

Broader Implications for Kenya’s Cybersecurity

The attack on the president’s website is the latest in a string of digital breaches affecting Kenyan government systems. It underscores the need for stronger cybersecurity measures across public-sector digital assets.

Kenya has been investing in digital transformation, including e-government services and online portals for everything from tax filings to business registration. But with increased digitization comes increased risk. High-profile hacks erode public trust and can disrupt essential services.

Experts argue that the government must prioritize proactive security measures: regular penetration testing, employee training on phishing and social engineering, and rapid incident response protocols. The fact that the presidential website was restored within 48 hours is a positive sign, but prevention is always better than remediation.

For now, the investigation continues. Authorities are likely tracing the cryptocurrency wallet address and analyzing server logs for clues. But without attribution, the attackers remain a ghost in the machine — and a warning that no website is truly safe.

Infosecurity

That Cute Kid Photo You Posted? The NCA Says AI Is Now Weaponizing It

Published

8 hours ago

July 22, 2026

Social Media Admin

Why Your Child’s Photo Could End Up in an AI Abuse Pipeline

Every parent loves sharing a milestone — the first day of school, a birthday party, a goofy grin. But the National Crime Agency (NCA) is sounding the alarm: those innocent snapshots are being scraped, fed into generative AI tools, and turned into something horrific.

In 2025, the Internet Watch Foundation (IWF) recorded 3,440 AI-generated videos of child sexual abuse — up from just 13 the year before. That’s a 26,000% annual spike. Total AI-generated abusive images and videos hit 8,029, a 14% year-on-year climb. And this is just what they found.

The NCA has launched a new campaign across Facebook, Instagram and YouTube. Their message? Think before you post.

What “Sharenting” Actually Costs

There’s a term for parents oversharing kids’ content online: sharenting. It’s not new, but the risk profile has changed. Criminals are no longer just collecting photos for creepy personal use. They’re feeding them into AI models to generate sexual abuse material — in bulk.

The IWF revealed a chilling case: a criminal gang scraped images from a UK school website, used AI to generate over 100 sexual images of those pupils, and then tried to blackmail the school. This isn’t a theoretical threat. It happened.

And the severity is rising. Two-thirds (65%) of AI-generated abusive content was classified as Category A — the most extreme category — compared to 43% of non-AI criminal videos in 2025. The tech is making it easier to produce worse material, faster.

What the NCA and IWF Want You to Do

Neither agency is telling parents to stop sharing entirely. IWF CEO Kerry Smith put it plainly: “We don’t want to say don’t share your children’s images with the people you love and trust, but we want everyone to be aware of the potential risks and make an informed decision.”

The NCA’s Tim Wright stressed prevention. His advice boils down to three steps:

Lock down your privacy settings. Who can actually see that photo? If it’s “public” or “friends of friends,” you’ve lost control.
Think about who has access. That school Facebook group, the sports club WhatsApp chat — everyone in those groups can screenshot and save.
Talk openly. Have the conversation with family, friends, schools, and clubs about consent. It’s okay to ask someone not to post a photo of your child.

If something does go wrong, Wright says: stay calm, reassure your child it’s not their fault, and report it to police or the CEOP (Child Exploitation and Online Protection Command) immediately.

Consent Isn’t a One-Time Decision

The NCA’s guidance urges parents to regularly review image consent. Ask yourself:

Am I still comfortable with how my child’s images might be used?
Have my preferences changed?
Do I want to limit or withdraw consent?

It’s a dynamic process. What felt fine at age three might feel different at age ten. And once a photo is online, you can’t truly take it back. Even if you delete it, copies may live on in group chats, in scraped datasets, or on someone’s hard drive.

This is especially urgent given the rise of deepfake nudes targeting children. The IWF recently launched a tool to help remove nude images of minors from the web, but removal is always harder than prevention.

The Bottom Line for Parents

No one is saying stop documenting childhood. But the NCA campaign is a wake-up call: the audience for those photos is bigger and more dangerous than you think. AI tools are lowering the barrier for abusers, and the consequences for kids are real and lasting.

As Kerry Smith put it: “The impact of this imagery can be devastating. The harms are very real.”

So before you hit post on that adorable bathtub shot or that first-day-of-school portrait, pause. Check your privacy settings. Ask consent. And remember: the internet never forgets — and now, neither does the AI.

Infosecurity

AI vs. WordPress: How Researchers Used OpenAI’s GPT-5.6 Sol Ultra to Chain a Critical Exploit in Hours

Published

10 hours ago

July 22, 2026

Social Media Admin

AI Crafted a WordPress Exploit That Could Have Cost a Fortune

On July 17, WordPress pushed an emergency update. Version 7.0.2 patched two Core vulnerabilities that, when chained, allowed a complete stranger to take over a site. No plugins needed. No special conditions. Just a stock WordPress install, exposed.

What’s more startling? The exploit chain — dubbed WP2Shell — wasn’t discovered by a human. It was built by OpenAI’s GPT-5.6 Sol Ultra, the latest large language model available in ChatGPT Work Pro and Codex Plus plans. Security researchers at Searchlight Cyber used the model to find and assemble the attack path in just over ten hours. The total compute cost? About $25.

Exploit brokers have been known to pay up to $500,000 for a zero-day remote code execution vulnerability in WordPress Core. Suddenly, that economics equation looks very different.

Two Flaws, One Chain: The Vulnerabilities Behind WP2Shell

The first bug, tracked as CVE-2026-63030, is a critical REST API batch endpoint route confusion issue. It carries a CVSS score of 9.8 and affects WordPress Core versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2.

The second, CVE-2026-60137, is a high-severity SQL injection in the author__not_in WP_Query parameter. Its CVSS score is 5.9. It impacts versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2.

Alone, each flaw is serious. Chained together, they become devastating. An attacker can exploit the REST API confusion to bypass input sanitization, then trigger the SQL injection. From there, they can extract the admin email from a fresh installation — and then escalate to full remote code execution.

“The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins,” said Adam Kues, security researcher at Searchlight Cyber.

How GPT-5.6 Sol Ultra Built the Exploit

Searchlight Cyber’s Kues published a report on July 20 detailing the process. He started by stripping version history from a clean copy of the WordPress source code. The goal: prevent the model from cheating by recognizing known vulnerabilities.

He then adapted a prompt OpenAI had previously used to solve a complex mathematical conjecture. The model was instructed to run up to four agents for at least six hours, hunting for a pre-authentication remote code execution path.

It didn’t take long. The AI quickly flagged the REST API batch route confusion (CVE-2026-63030), recognizing that a desynchronization between validation and execution could bypass input sanitization. That opened the door to the SQL injection (CVE-2026-60137). Within minutes, the model extracted the administrator email from a clean WordPress install.

But that was just the start. The real feat came next.

From Read-Only to Full Takeover

Over the next four hours, the AI constructed a multi-stage chain that Kues described as “absurdly complex.” It used cache poisoning through fake oEmbed entries. It manipulated WordPress customize changesets to temporarily grant itself admin privileges. It triggered hooks that bypassed authentication entirely, finally uploading a backdoor plugin.

The entire automated process took just over ten hours and cost roughly $25 in compute resources. “No security researcher could have found and completed this exploit chain in 10 hours without AI,” Kues said.

For context, a human researcher would likely need weeks or months to piece together such a convoluted path. The AI did it in a single workday.

In-the-Wild Exploitation and the Economics Shift

After the vulnerabilities were publicly disclosed, other researchers released proof-of-concept exploits. On July 17, security firm PatchStack reported active exploitation of both CVEs. Companies like Hexastrike and WatchTowr also observed signs of in-the-wild attempts.

What exactly attackers are doing with the exploit remains unclear. But the window for patching is closing fast.

Kues pointed out the economic implications. With exploit brokers offering up to half a million dollars for a zero-day RCE in WordPress Core, and an off-the-shelf AI model finding one for $25, the cybersecurity landscape is shifting. “It highlights a major shift in cybersecurity economics,” he said.

WordPress Forced Automatic Updates — Here’s What to Do

WordPress took the rare step of forcing automatic updates for affected installations. That’s a strong signal of how serious the threat is.

Security administrators should manually verify that their sites are running WordPress 7.0.2 or 6.9.5. Don’t rely on auto-updates alone — check the version in your admin dashboard or via the site’s footer.

Searchlight Cyber has released a free scanning tool at wp2shell.com so administrators can safely test if their servers remain vulnerable to this AI-crafted attack.

What This Means for the Future of Security Research

This isn’t a theoretical exercise. An AI model found a critical vulnerability chain in a platform that powers over 40% of the web. It did so quickly and cheaply. The implications for both attackers and defenders are enormous.

On one hand, security researchers can use AI to discover flaws faster, potentially reducing the window between a vulnerability’s introduction and its patch. On the other hand, malicious actors could do the same — and they don’t have to follow disclosure rules.

For now, the takeaway is simple: patch your WordPress sites. The AI is already working. Don’t let your site be the next victim.