Cybersecurity
ThreatsDay roundup covers AI exploits and security disclosures
The bulletin gathered reports on sanctions, model-safety problems, credential exposure, code execution and certificate plans, while presenting the list as evidence that ordinary system features can become attack paths.
- The article assembled a weekly list of security reports under the ThreatsDay banner.
- The Office of Foreign Assets Control sanctioned 10 targets linked to a Tren de Aragua ATM jackpotting scheme, and Treasury said reported losses reached $40.73 million.
- TRM Labs said seven designated wallet addresses in that case had received about $6.1 million in inflows since March 2022.
- Moonshot was said to be reviewing its AI models after Mindgard reported that Kimi K2.6 and K3 Swarm could bypass safety guardrails.
- Truffle Security said it found 543,699 unique credentials in public GitHub repositories that were still valid in July 2026, and Pillar Security said a flaw in Unsloth Studio could run Python code from a Hugging Face repository and was fixed in version 2026.6.9.
- Cloudflare said it planned to become a public certificate authority for quantum-safe certificates, and the U.S. Department of Justice said it charged Trung Nguyen Van in a cryptocurrency fraud case involving about $16 million.
The piece presented the week as a set of security findings built around ordinary functions that could be turned into attack paths. It said attackers could hide commands in public infrastructure, reuse old flaws and let automation assemble workable routes.
One item said the Office of Foreign Assets Control sanctioned 10 targets tied to a Tren de Aragua ATM jackpotting scheme, and Treasury put the reported losses at $40.73 million. TRM Labs said seven wallet addresses linked to the case had received about $6.1 million, and another item said Moonshot was reviewing its AI models after Mindgard’s report on Kimi K2.6 and K3 Swarm.
The roundup also said Truffle Security found 543,699 unique credentials in public GitHub repositories that were still valid in July 2026. In the same bulletin, Pillar Security said inspecting a model in Unsloth Studio could run Python code from a Hugging Face repository, and that the issue was fixed in version 2026.6.9.
Elsewhere, Cloudflare said it planned to issue quantum-safe certificates as a public certificate authority and to acquire Root CA key material from GlobalSign. The U.S. Department of Justice also said it had charged Trung Nguyen Van in a cryptocurrency fraud case involving about $16 million.
Named in this story
People
- Trung Nguyen Van
- was charged in the cryptocurrency fraud case
Companies
- TRM Labs
- said the wallet addresses had received about $6.1 million
- Moonshot
- was said to be reviewing its AI models
- Mindgard
- reported the guardrail-bypass findings
- Truffle Security
- said it found valid credentials in public GitHub repositories
- GitHub
- hosted the public repositories in the credential study
- Pillar Security
- reported the Unsloth Studio flaw
- Hugging Face
- hosted the repository used in the exploit path
- Cloudflare
- said it planned to issue quantum-safe certificates
- GlobalSign
- would supply Root CA key material
Organisations
- Tren de Aragua
- was linked to the ATM jackpotting operation
Governments and agencies
- U.S. Department of the Treasury
- set the sanctions and loss estimate in the ATM jackpotting case
- Office of Foreign Assets Control
- sanctioned 10 targets linked to the scheme
- U.S. Department of Justice
- said it charged Trung Nguyen Van
Products and systems
- Kimi K2.6
- was one of the models said to bypass safety guardrails
- K3 Swarm
- was another model said to bypass safety guardrails
- Unsloth
- had the Studio component with the code-execution issue
How the source tells it
The source read like a weekly bulletin with mild caution and newsletter-style urgency, while most substantive claims were attributed to named researchers or agencies.
- caution opening contrast between ordinary system functions and attack paths
- urgency weekly bulletin framing and subscription prompt