Claude Opus 4.6 Autonomously Discovered Over 500 Unknown Vulnerabilities

On February 5, 2026, Anthropic unveiled its latest language model, Claude Opus 4.6, featuring significantly enhanced capabilities in code analysis and vulnerability discovery. Before the model’s official launch, Anthropic’s Frontier Red Team conducted extensive testing in an isolated virtualized environment. The model was given access to standard tools, including Python, debuggers, and fuzzers, but without any specific instructions on how to use them. The model autonomously identified more than 500 previously unknown zero-day vulnerabilities in widely used open-source libraries.

Each finding was subsequently verified by a member of Anthropic’s security team or an independent security researcher, ruling out the possibility of model hallucinations.

Opus 4.6 approached code the way an experienced security researcher would. It analyzed commit histories, searched for patterns leading to issues, and understood code logic well enough to pinpoint exactly what input could break it. According to Logan Graham, head of the Frontier Red Team, the model in some cases even wrote a proof-of-concept exploit on its own to demonstrate that the discovered vulnerability was indeed exploitable.

Anthropic describes the new model as a tool designed to level the playing field between defenders and attackers. In an interview with Axios, Logan Graham stated: “It’s a race between defenders and attackers, and we want to get tools into the hands of defenders as quickly as possible.” At the same time, he acknowledged that such powerful capabilities also carry the risk of misuse. Therefore, Anthropic introduced six new security probes that monitor Opus runs in real time and enable the detection of potential abuse.

Graham even stated that he would not be surprised if AI became one of the primary, or even the main way open-source software is secured in the future. However, Anthropic also warns that existing norms for responsible vulnerability disclosure, typically a 90-day window, may not hold up against the speed and volume of bugs discovered by language models.

The discovery of more than 500 zero-day vulnerabilities by Claude Opus 4.6 is a milestone that clearly demonstrates that artificial intelligence is becoming a full-fledged tool in the cyber defense arsenal.

Russian Spy Satellites Intercepted Communications of European Satellites

Russian spy satellites Luch-1 and Luch-2 have repeatedly approached key European satellites in recent years, likely intercepting their communications.

Luch-2 alone has approached seventeen European satellites since its launch in 2023. In August 2024, Luch got so close to a German military satellite that it could easily intercept its signals.

The commander of Germany’s military space command, Michael Traut, confirmed that both satellites are suspected of conducting “signals intelligence.”

A critical issue is the fact that many European satellites transmit unencrypted control data because they were launched years ago without advanced onboard computers or encryption capabilities.

In response to these threats, the German government introduced its first national space security strategy. The European Union is also intensifying its efforts to ensure independence in outer space. European Commissioner for Defence and Space Andrius Kubilius announced the launch of the GOVSATCOM program, which currently includes eight satellites from five member states and provides secure encrypted satellite communications.

In the context of Russia’s hybrid warfare, which already includes sabotage of undersea cables and cyberattacks, space espionage represents yet another concerning dimension of security challenges.

Massive Espionage Operation “Shadow Campaigns” Targets Government Institutions in 155 Countries

In early February 2026, Unit 42, the security division of Palo Alto Networks, published a report on an extensive cyber-espionage operation called “Shadow Campaigns.” According to the researchers, an unknown state-sponsored hacking group, tracked as TGR-STA-1030 (also known as UNC6619), successfully breached the networks of at least 70 government and critical infrastructure organizations in 37 countries. Between November and December 2025, the group also conducted extensive reconnaissance activities targeting government infrastructure associated with 155 nations. This is one of the most extensive espionage operations uncovered in recent years.

The attackers’ targets included ministries of finance, commerce, and energy, law enforcement agencies, immigration offices, border guards, and diplomatic institutions. Among the confirmed victims are numerous government entities in European countries, including Czechia, Germany, Italy, and Poland.

The attackers primarily used targeted phishing emails to infiltrate networks, linking to malicious archives hosted on the Mega[.]nz service. The archives contained a malware loader called Diaoyu. Upon execution, the loader checked for the presence of five specific security products (Kaspersky, Avira, Bitdefender, Sentinel One, and Norton) and subsequently downloaded tools for communication with the C2 server.

In addition to phishing, the group actively exploited at least 15 known vulnerabilities in products from Microsoft, SAP, Atlassian, and D-Link to gain initial access to target networks. One of the most notable tools in the group’s arsenal is a previously unknown Linux rootkit called ShadowGuard, which leverages eBPF technology. This rootkit operates directly within the operating system kernel, enabling it to manipulate system functions and audit logs before security tools can record them. Researchers also noted the use of web shells such as Behinder, Godzilla, and Neo-reGeorg, which are frequently associated with Chinese hacking groups.

Although Palo Alto Networks did not explicitly attribute the operation to any specific state, the evidence clearly points to a threat actor whose profile matches Chinese state-sponsored cyber espionage.

Notepad++ Was Under Chinese Hackers’ Control for 6 Months

A Chinese state-sponsored hacking group (APT31/Zirconium/Violet Typhoon) compromised the update mechanism of the popular text editor Notepad++ for six months (June–December 2025).

The attackers gained access to the provider’s shared hosting server running the notepad-plus-plus.org website, and subsequently intercepted requests directed at the getDownloadUrl[.]php endpoint, which returns update metadata. They selectively redirected traffic from targeted users to attacker-controlled servers. Selected users thus received trojanized installers instead of legitimate updates.

The malware collected network information, system details, running processes, and current user data, then exfiltrated the data to the anonymous file-sharing service temp[.]sh.

Prior to version 8.8.9, there was no digital signature verification or certificate validation. The update package could therefore be spoofed by virtually anyone.