ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories

A threat actor called CL-CRI-1171 has operated a pay-per-install malware marketplace distributing malware via YouTube and SEO-poisoned software, targeting gamers and corporate endpoints including critical infrastructure. Separately, over 230 exposed LocalAI instances were found vulnerable to remote command execution, with confirmed root access on 23 servers and data exfiltration from a Thai military workstation.