Security

Autonomous agents attack Azure using compromised identities, destroying resources

Microsoft says Jadepuffer, an autonomous agentic AI attacker first reported in July, is now targeting Azure resources; exposed credentials may have provided a way in.

NetScaler admins told to patch critical zero-days in ADC and Gateway now

Citrix published patches for two critical flaws and six lesser ones on Sunday; “Monday will be too late” to patch, said one expert.

Stolen AI credentials feed growing LLM proxy economy

More than 80,000 proxy servers have been observed cloaking the origin of traffic to frontier models, likely using AI credentials harvested via information stealers, phishing campaigns, and supply-chain attacks.

AI tools help hacker break in for $25 per target

Major retailers were hit by sophisticated attacks performed on the cheap.

SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise

GitLab issue email’s only security is obscurity

A long-lived token embedded in GitLab’s issue-creating email address means anyone with the address, not just the project owner, can push code and trigger CI/CD jobs subject to the account’s existing permissions.

Fixing Flock: The controls needed now that misuse patterns are clear

The privacy landmines in a data product are not always obvious at launch. Once they become visible, a company has to move fast.

WordPress patches a critical severity security vulnerability

The hole, which allows an unauthenticated attacker to perform remote code execution, is especially dangerous because many enterprises are not aware of all of their WordPress sites.

Microsoft integrates SOC capabilities with Defender for enterprises

The preview hands E5 and E7 customers SOC tools that once cost extra, and puts a price on everything else.

On-prem VeloCloud Orchestrator under attack, only some versions patched

Attackers are actively exploiting a critical VeloCloud Orchestrator flaw that exposes the SD-WAN management system and edge devices it controls, while fixes for some affected versions remain pending.