Latest from todayOpenAI ‘temporarily slows’ scaling efforts, also promises zero data retention for select frontier model customers Analysts said the moves may be nothing more than positioning the company for its IPO, but that both changes are welcome news nonetheless.By Evan SchumanAug 19, 20266 minsArtificial IntelligencePrivacySecurity Snowflake flaw slips past AI checks, gets exploited by another AIBy Shweta SharmaAug 19, 20264 minsArtificial IntelligenceSecurityVulnerabilities Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of itBy Evan SchumanAug 18, 20267 minsArtificial IntelligenceSecurityVulnerabilitiesCritical GitLab flaw allows attackers to delete and modify public reposBy Lucian Constantin Aug 18, 20263 minsSecuritySoftware DevelopmentVulnerabilities New malware turns Microsoft cloud into its control centerBy Shweta Sharma Aug 18, 20264 minsCybercrimeMalwareSecurity OpenAI president’s blog pushing agentic AI most notable for what it did not say By Evan Schuman Aug 17, 20266 minsArtificial IntelligenceSecurity Zhipu says new coding AI developed advanced cyber skills faster than expectedBy Gyana Swain Aug 17, 20265 minsArtificial IntelligenceDevelopment ToolsSecurity New macOS malware turns stolen browsers into attacker-controlled sessionsBy Shweta Sharma Aug 17, 20264 minsEndpoint ProtectionMacOS SecurityMalware Salesforce, ServiceNow data targeted in ‘City-Forum’ attacksBy Maxwell Cooter Aug 14, 20262 minsApplication SecurityCyberattacksData Breach US dominance of agentic AI at the heart of new NIST initiative The standards body is soliciting industry views on agentic security risks while ‘cementing US dominance at the technological frontier.’ By John E. Dunn Feb 19, 2026 4 mins Artificial Intelligence Security Six flaws found hiding in OpenClaw’s plumbing Researchers say an AI-powered code scanner traced untrusted data across layers of OpenClaw, exposing exploitable weaknesses including SSRF, authentication bypass, and path traversal. By Shweta Sharma Feb 19, 2026 3 mins Artificial Intelligence Generative AI Security Hackers can turn Grok, Copilot into covert command-and-control channels, researchers warn Permissive AI access and limited monitoring could allow malware to hide within trusted enterprise traffic, thereby accelerating adaptive, AI-driven attacks. By Prasanth Aby Thomas Feb 19, 2026 4 mins Artificial Intelligence Generative AI Security Notepad++ author says fixes make update mechanism ‘effectively unexploitable’ Hardening had to be done after a threat actor compromised updates with a custom backdoor. By Howard Solomon Feb 18, 2026 5 mins Cybercrime Devops Software Deployment Chinese hackers exploited zero-day Dell RecoverPoint flaw for 1.5 years A suspected Chinese espionage group exploited hardcoded admin credentials in Dell RecoverPoint for Virtual Machines to deploy web shells and maintain persistence in enterprise VMware environments. By Lucian Constantin Feb 18, 2026 4 mins Security Vulnerabilities Zero-Day Vulnerabilities Flaws in four popular VS Code extensions left 128 million installs open to attack Three of the four vulnerabilities remained unpatched months after OX Security reported them to the maintainers. By Gyana Swain Feb 18, 2026 4 mins Security Vulnerabilities Keenadu: Android malware that comes preinstalled and can’t be removed by users Keenadu infiltrated devices by posing as legitimate system components, prompting calls for tighter controls on firmware integrity across manufacturing and supply‑chain pipelines. By Shweta Sharma Feb 18, 2026 4 mins Endpoint Protection Malware Mobile Security Cyber attacks enabled by basic failings, Palo Alto analysis finds Time to exploit drops to 72 minutes as AI automation accelerates cyberattacks. By John E. Dunn Feb 17, 2026 4 mins Artificial Intelligence Cyberattacks Cybercrime ZeroDayRAT spyware targets Android and iOS devices via commercial toolkit Researchers said the openly available spyware enables surveillance, credential theft, and financial targeting across a wide range of mobile OS versions. By Shweta Sharma Feb 17, 2026 4 mins Endpoint Protection Mobile Security Security Exploit available for new Chrome zero-day vulnerability, says Google Use after free memory hole lets a remote attacker execute code inside a sandbox. By Howard Solomon Feb 16, 2026 4 mins Browser Security Endpoint Protection Zero-Day Vulnerabilities Open source maintainers being targeted by AI agent as part of ‘reputation farming’ AI agent OSS activity opens the door to future supply chain attacks, says security company. By John E. Dunn Feb 16, 2026 4 mins Artificial Intelligence Open Source Risk Management Leaky Chrome extensions with 37M installs caught divulging your browsing history Hundreds of popular add‑ons used encrypted, URL‑sized payloads to send search queries, referrers, and timestamps to outside servers, in some cases tied to data brokers and unknown operators. By Shweta Sharma Feb 16, 2026 3 mins Browser Security Endpoint Protection Security Critical BeyondTrust RS vulnerability exploited in active attacks Researchers have detected attacks that compromised Bomgar appliances, many of which have reached end of life, creating problems for enterprises seeking to patch. By Lucian Constantin Feb 13, 2026 3 mins Cyberattacks Network Security Vulnerabilities South Korea fines Louis Vuitton, Christian Dior, Tiffany $25M for SaaS security failures Vishing involved in two of three breaches against Korean subsidiaries of prominent luxury brands impacting more than 5 million customers in total. By Jihyun Lee (이지현) Feb 13, 2026 3 mins Cyberattacks Cybercrime Data Breach Researchers unearth 30-year-old vulnerability in libpng library The widely used open-source library has been patched to defend against a heap buffer overflow flaw that’s been in the code since its inception. By John Leyden Feb 13, 2026 3 mins Open Source Security Vulnerabilities Battling bots face off in cybersecurity arena Wiz creates an environment to test AI agents’ ability to identify cybersecurity problems. By Maxwell Cooter Feb 13, 2026 2 mins APIs Cloud Security Zero-Day Vulnerabilities Four new reasons why Windows LNK files cannot be trusted By putting conflicting metadata in LNK files, a researcher found four new ways to spoof targets, hide arguments, and run unintended programs in Windows Explorer. By Shweta Sharma Feb 13, 2026 4 mins Endpoint Protection Security Windows Security Google fears massive attempt to clone Gemini AI through model extraction The company identified over 100,000 prompts it suspects were intended to extract proprietary reasoning capabilities. By Gyana Swain Feb 13, 2026 6 mins Data and Information Security Generative AI Intellectual Property Hackers turn bossware against the bosses A threat actor is using Net Monitor for Employees and SimpleHelp to launch ransomware and cryptocurrency attacks. By Howard Solomon Feb 12, 2026 6 mins Hacking Malware Ransomware ‘Dead’ Outlook add-in hijacked to phish 4,000 Microsoft Office Store users The first ever known malicious add-in bypassed a weak vetting process with a simple URL hack. By John E. Dunn Feb 12, 2026 4 mins Communications Security Email Security Phishing Phishing campaign chains old Office flaw with fileless XWorm RAT to evade detection The campaign exploits an Office vulnerability to deliver the modular XWorm RAT, chaining HTA, PowerShell, and in-memory .NET execution to sidestep detection and expand post-compromise control. By Shweta Sharma Feb 12, 2026 4 mins Malware Phishing Security Palo Alto closes privileged access gap with $25B CyberArk acquisition Embedding CyberArk’s PAM into its core platform, Palo Alto is sharpening its Zero Trust posture and intensifying competition in the identity security market. By Nidhi Singal Feb 12, 2026 5 mins Identity and Access Management Security SSHStalker botnet brute-forces its way onto 7,000 Linux machines Researchers say the victims are systems with weak SSH password authentication. By Howard Solomon Feb 11, 2026 7 mins Botnets Cyberattacks Cybercrime Companies are using ‘Summarize with AI’ to manipulate enterprise chatbots Hidden code behind the button embeds biased prompts in AI memory, Microsoft research finds. By John E. Dunn Feb 11, 2026 5 mins Business Chatbots Enterprise North Korean actors blend ClickFix with new macOS backdoors in Crypto campaign The campaign used a compromised Telegram account, a fake Zoom meeting, and AI-assisted deception to trick victims into executing terminal commands leading to a macOS infection chain. By Shweta Sharma Feb 11, 2026 4 mins Endpoint Protection MacOS Security Malware EU clears Google’s $32B Wiz acquisition, intensifying cloud security competition This allows Google to fold one of the fastest-growing cloud security platforms into its stack, strengthening its position in the AI-driven hyperscaler race. By Prasanth Aby Thomas Feb 11, 2026 4 mins Cloud Security Security Security Software February 2026 Patch Tuesday: Six new and actively exploited Microsoft vulnerabilities addressed SAP patched critical vulnerabilities in its products too. By Howard Solomon Feb 10, 2026 8 mins Security Vulnerabilities BeyondTrust fixes critical RCE flaw in remote access tools Enterprises are urged to patch self-hosted versions of both Remote Support and Privileged Remote Access due to a 9.9-severity vulnerability that could lead to system compromise. By Lucian Constantin Feb 10, 2026 3 mins Network Security Remote Access Security Vulnerabilities SolarWinds WHD zero-days from January are under attack Analysis of real-world incidents reveals that attackers are chaining multiple flaws to compromise the ticketing and support application. By John E. Dunn Feb 10, 2026 4 mins IT Management Vulnerabilities Zero-Day Vulnerabilities Windows shortcut weaponized in Phorpiex-linked ransomware campaign Researchers revealed a Phorpiex-distributed phishing campaign using malicious LNK files to deploy Global Group ransomware designed to operate entirely offline. By Shweta Sharma Feb 10, 2026 4 mins Cybercrime Malware Ransomware Single prompt breaks AI safety in 15 major language models The GRP‑Obliteration technique reveals that even mild prompts can reshape internal safety mechanisms, raising oversight concerns as enterprises increasingly fine‑tune open‑weight models with privileged training access. By Gyana Swain Feb 10, 2026 6 mins Artificial Intelligence Generative AI Security 69% of CISOs open to career move — including leaving role entirely Behind those numbers are executives who are frustrated with an ever-expanding job without the budget and authority to match. By Evan Schuman Feb 10, 2026 6 mins C-Suite CSO and CISO Careers Anthropic’s DXT poses “critical RCE vulnerability” by running with full system privileges Anthropic didn’t dispute the security report, but suggested it would only be caused by user error, where users deliberately installed the tools and granted the appropriate permissions. By Evan Schuman Feb 9, 2026 8 mins Artificial Intelligence Security Vulnerabilities OpenClaw integrates VirusTotal malware scanning as security firms flag enterprise risks The AI agent platform has added a Google-owned threat intelligence service to the ClawHub marketplace, following the discovery of 341 malicious skills and shadow IT deployments. By Gyana Swain Feb 9, 2026 5 mins Artificial Intelligence Security Security Software DKnife targets network gateways in long running AitM campaign Active since at least 2019, the China-linked framework operates at network gateways to inspect and manipulate in-transit traffic, allowing attackers to redirect updates, disrupt security tooling, and deliver backdoors. By Shweta Sharma Feb 9, 2026 4 mins Network Security Security Six more vulnerabilities found in n8n automation platform Four of the holes, which allow remote code execution and command injection, are rated as critical. By Howard Solomon Feb 6, 2026 5 mins Development Tools Security Vulnerabilities Claude AI finds 500 high-severity software vulnerabilities Anthropic is reporting the flaws to developers — but only after having humans verify them. By Maxwell Cooter Feb 6, 2026 2 mins Generative AI Vulnerabilities Zero-Day Vulnerabilities Pretend Disk Format: PDFs harbor new dangers Virtual Hard Disks masquerading as PDF files are allowing hackers to sneak remote-access software through enterprise defenses. By Maxwell Cooter Feb 6, 2026 2 mins Cybercrime Malware Windows Security CISA gives federal agencies 18 months to purge unsupported edge devices The directive targets firewalls, routers, and VPNs that are no longer receiving vendor patches, as nation-state actors shift their tactics from endpoints to infrastructure. By Gyana Swain Feb 6, 2026 4 mins Endpoint Protection Network Security Security Zscaler extends zero-trust security to browsers with SquareX acquisition The acquisition adds browser controls to Zscaler’s Zero Trust Exchange to protect against phishing, data leakage, and AI risks. By Nidhi Singal Feb 6, 2026 5 mins Browser Security Endpoint Protection Security Four new vulnerabilities found in Ingress NGINX Two carry CVSS scores of 8.8, demanding that admins upgrade to the latest versions of the controller. By Howard Solomon Feb 5, 2026 4 mins Network Security Security Vulnerabilities New APT group breached gov and critical infrastructure orgs in 37 countries Security researchers from Palo Alto Networks believe the likely Asia-based group is expanding its activities, which include sophisticated tools and techniques. By Lucian Constantin Feb 5, 2026 5 mins Advanced Persistent Threats Cyberattacks Cybercrime Substack data breach leaks users’ email addresses and phone numbers The company has emailed affected users after a dark web source claims the data of almost 700,000 users was compromised. By John E. Dunn Feb 5, 2026 4 mins Cyberattacks Cybercrime Data Breach Attackers exploit decade‑old Windows driver flaw to shut down modern EDR defenses Attackers abused a signed but long-revoked EnCase Windows kernel driver in a BYOVD attack to terminate all security tools. By Shweta Sharma Feb 5, 2026 4 mins Endpoint Protection Vulnerabilities Windows Security Microsoft develops a new scanner to detect hidden backdoors in LLMs Microsoft’s research shows how poisoned language models can hide malicious triggers, creating new integrity risks for enterprises using third-party AI systems. By Prasanth Aby Thomas Feb 5, 2026 4 mins Artificial Intelligence Security Vulnerabilities Software supply chain risks join the OWASP top 10 list, access control still on top There were some changes to the recently updated OWASP Top 10 list, including the addition of supply chain risks. But old standbys, like broken access control, are still at the top. By Maria Korolov Feb 5, 2026 8 mins Security Software Development Vulnerabilities 1.5 million AI agents are at risk of going rogue A survey of large firms in the US and UK finds that more than half of the deployed agents are not actively monitored or secured. By Paul Barker Feb 4, 2026 6 mins Artificial Intelligence Risk Management Security Threat actors hijack web traffic after exploiting React2Shell vulnerability Researchers at Datadog Security say the hackers are pivoting to hit NGINX web servers. By Howard Solomon Feb 4, 2026 4 mins Cyberattacks Cybercrime Vulnerabilities Russian hackers exploited a critical Office bug within days of disclosure Within days of Microsoft patching a critical Office zero-day, the Russia-linked group “APT28” was already exploiting the flaw in a live campaign tracked as Operation Neusploit. By Shweta Sharma Feb 4, 2026 4 mins Malware Security Vulnerabilities Cybercriminals set sites on identities Hackers have drastically changed their tactics in recent years to rely more on identity theft and social engineering for corporate access. By Julia Mutzbauer Feb 4, 2026 2 mins Cyberattacks Cybercrime Security 1…91011121314151617…433 Show me morePopularArticlesPodcastsVideos news analysis EU Cyber Resilience Act ‘completely kills’ manual vulnerability triage By John LeydenOct 2, 20266 mins Laws and RegulationsTechnology IndustryThreat and Vulnerability Management news Google makes Gemini 4 AI model available to a trusted few By Nidhi SingalOct 1, 20265 mins Artificial IntelligenceSecurity news Cisco SD-WAN Manager hit by zero-day admin access attack By Shweta SharmaOct 1, 20264 mins Network SecurityVulnerabilitiesZero-Day Vulnerabilities podcast Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security podcast The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO podcast Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cybercrime video Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security video The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO video Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cyberattacks
