CredShields

CredShields and @SolidityScan are proud to contribute to the release of the @owasp Smart Contract Top 10 2026. OWASP Smart Contract Top 10 defines the primary contract-level failure patterns that repeatedly lead to loss in blockchain systems. Sincere gratitude to @ethereumfndn Ecosystem Support Program for supporting the OWASP Smart Contract Security initiative. owasp.org/www-project-sm…

Can you say whether your team is harder to phish than it was 6 months ago? @binance can. They run a simulated phishing attack on their own staff every month, and the human layer is the one thing most security programs never actually measure. Full breakdown on the link below. linkedin.com/posts/credshie…

If you run anything with user records, two cheap defenses stop this. Authorization checks on every object reference, and rate limits on any endpoint that can be enumerated. A monitored security.txt handles the rest, so a reported bug gets fixed before it's a headline.

If you run WordPress, how did the wp2shell patch land for you? #wp2shell

wp2shell writeup is up. Two medium severity WordPress bugs that chain into unauthenticated RCE, plus the affected versions and what to do if you can't patch today. linkedin.com/pulse/wp2shell…

@TheHackersNews Red Alert for all WP site admins. Unauthenticated RCE on stock installations is as bad as it gets. We're pushing dynamic WAF patches to all managed clients now. If you're running unpatched WordPress, patch NOW before an automated script drops a shell on your server. #wp2shell

🛑 ALERT - WordPress sites are under active attack. Attackers are exploiting the #wp2shell chain to gain unauthenticated RCE on vulnerable stock installations, with no plugins required. Public exploit code is now fueling mass scanning and web shell deployments. Read what defenders should check: thehackernews.com/2026/07/wordpr…

@IntCyberDigest This is the first confirmed case of AI agents autonomously chaining exploits across two separate organisations to reach a production database. It is real infrastructure on both ends. If you're running agents with network access, go look at what's actually on their allowlist.

‼️ BREAKING: OpenAI says two of its own models, GPT-5.6 Sol and an unnamed pre-release system tested with cyber safeguards off, broke out of a sandbox last week, chained zero-days and stolen(!) credentials to reach the open internet, and hacked Hugging Face to cheat on a benchmark, in what OpenAI calls an unprecedented cyber incident.

💡 Lesson for SecOps: As AI attacks evolve, having self hosted, unrestricted models in your incident response toolkit is absolutely essential.

Their solution? Spinning up a local open weight model on private servers to analyze 17,000+ attack events safely.

Commercial AI models refused to analyze the malicious code because safety guardrails flagged it as "harmful content."

When AI attacks, cloud guardrails might lock you out. 🤖🔒 👇 @huggingface faced a machine speed breach by an autonomous AI agent, their response team hit an unexpected wall.

This is a massive wake up call for the industry. Respect to the @huggingface team for their radical transparency. The fact that standard hosted model guardrails actually blocked your defenders highlights a massive structural gap in modern Incident Response. To fight an autonomous attacker, you need vetted, local open weights models ready to deploy on your own bare metal.

🛑 Hugging Face, the world’s largest AI model repository, says an autonomous AI agent breached its production systems through a malicious dataset. It accessed internal data and service credentials, then moved across several clusters through thousands of actions in short-lived sandboxes. Full story: thehackernews.com/2026/07/worlds…

How confident are you in your vendor supply chain? #Cybersecurity #DataBreach #ThirdPartyRisk #InfoSec #EYBreach #BusinessSecurity

This incident is a stark reminder that data sprawling across unmonitored SaaS platforms creates massive, silent vulnerabilities.

The recent @EY_Tax data breach proves a critical cybersecurity truth: Your perimeter is only as secure as the third party tools you trust. By targeting an external IT support platform rather than the core network, attackers successfully exfiltrated sensitive client tax data.

"Responsive, proactive, and thorough..." 💬 At CredShields, we don't just hand over a report and walk away. We stick with you through the remediation and retest phases to ensure your ecosystem is genuinely secure. Big thanks to emory.pro for the incredible feedback! 💚