Latest from todayAI tools help hacker break in for $25 per targetMajor retailers were hit by sophisticated attacks performed on the cheap.By Maxwell CooterSep 25, 20262 minsCyberattacksCybercrimeRetail Industry Documentation placeholder domain used in ClickFix attacksBy Maxwell CooterSep 25, 20262 minsCybercrimeMalwareSecurity GitLab issue email’s only security is obscurityBy Shweta SharmaSep 25, 20265 minsCode SecurityCommunications SecurityEmail SecurityWordPress patches a critical severity security vulnerabilityBy Evan Schuman Sep 24, 20267 minsInternet SecurityNetwork SecurityVulnerabilities Microsoft integrates SOC capabilities with Defender for enterprisesBy Gyana Swain Sep 24, 20265 minsEndpoint ProtectionSecurity Operations CenterWindows Security On-prem VeloCloud Orchestrator under attack, only some versions patchedBy Shweta Sharma Sep 24, 20264 minsNetwork SecuritySecurity Check Point hacked: The security software protecting your network has become a prime attack targetBy Taryn Plumb Sep 23, 20267 minsNetwork SecuritySecurityVulnerabilities F5 fixes actively exploited zero-day flaw in BIG-IP APMBy Lucian Constantin Sep 23, 20263 minsNetwork SecurityVulnerabilitiesZero-Day Vulnerabilities GitHub App keys can still enable takeovers long after they are forgottenBy Shweta Sharma Sep 23, 20265 minsCode SecurityIdentity and Access ManagementSecurity Microsoft’s EvilTokens takedown sheds light on state of AI-powered cybercrime Surreptitiously gaining persistent access to compromised Microsoft 365/Entra ID accounts, the group also offered an AI-powered chatbot to facilitate BEC scams. By John Leyden Sep 22, 2026 4 mins Cybercrime Phishing Social Engineering Z.ai disables coding assistant feature after flaw exposed enterprise code upload risk Z.ai’s default-enabled workflow sent entire local repositories to cloud infrastructure, raising fresh concerns over how AI tools handle sensitive source code. By Gyana Swain Sep 22, 2026 4 mins Artificial Intelligence Data and Information Security Development Tools Beware these fake websites selling subscriptions to AI assistants Over 100 websites abusing legitimate Google sign-in processes are ripping off customers who think they are getting a great deal on reputable AI services. By Shweta Sharma Sep 22, 2026 3 mins Artificial Intelligence Cybercrime Fraud Gemini broke into 3 companies, but Google kept it quiet because ‘no damage was done’ An agentic cybersecurity incident in May impacted OpenAI, Google, Anthropic and Meta; everyone reported it except Google. By Evan Schuman Sep 21, 2026 7 mins Artificial Intelligence Cybercrime Hacking After spending billions, OpenAI still has gaps in its cybersecurity Two separate groups of researchers found holes in OpenAI’s identity systems and agent controls. By Gyana Swain Sep 21, 2026 5 mins Artificial Intelligence Development Tools Identity and Access Management New npm malware finds a way around install script defenses A malicious npm package reached over 2 million weekly downloads by hiding its payload in a routine library function rather than an install script. By Shweta Sharma Sep 21, 2026 3 mins Code Security Cybercrime Malware CISA is ending its monthly vulnerability bulletin Does its claim of conforming to BOD requirements ring true? By Maxwell Cooter Sep 18, 2026 2 mins Government Markets Vulnerabilities A zero-click RCE flaw in AI coding agents could have exposed enterprise systems By exploiting how AI coding agents retrieve and verify plugins, researchers were able to execute malicious code even when the agent was told to use a trusted, approved version. By Anirban Ghoshal Sep 18, 2026 6 mins Code Editors Development Tools Vulnerabilities GhostCode attackers abuse device codes to take over Microsoft 365 accounts A new phishing kit abuses a legitimate Microsoft device authorization flow to steal authentication tokens, register attacker-controlled devices and gain persistent access to a victim’s Microsoft 365 environments. By Shweta Sharma Sep 18, 2026 4 mins Authentication Multifactor Authentication Phishing Cisco patches max-severity ISE flaw, the second critical zero-day this week Under active exploitation, the 10.0 Identity Services Engine vulnerability can give attackers root privileges without authentication. By Lucian Constantin Sep 17, 2026 3 mins Network Security Vulnerabilities Zero-Day Vulnerabilities OpenAI admits six new misalignment incidents under new reporting framework Agents’ misbehaviors included prompt injection, covert communication, and credential searches. By Gyana Swain Sep 17, 2026 5 mins Application Security Artificial Intelligence IT Governance Security spending is growing — except for the typical CISO AI is becoming the biggest destination for new security dollars, but spending remains uneven and strongest among organizations with mature AI governance. By Shweta Sharma Sep 17, 2026 4 mins Artificial Intelligence Budgeting IT Management Self-modifying AI agents expose a blind spot in enterprise security Hosting open-weight AI models locally can offer enterprises more control — unless an AI agent decides to change the model that powers it. By Prasanth Aby Thomas Sep 17, 2026 4 mins Application Security Artificial Intelligence IT Governance LinkedIn fights for the right to tell customers when the feds want their data The company argues that users deserve ‘meaningful limits and independent oversight’ over US government subpoenas, to protect their privacy. By Evan Schuman Sep 16, 2026 6 mins Data Privacy Government Legal Big Tech’s AI safety rift signals disruption and disparity for enterprises Diverging safety approaches could fragment access and complicate enterprise AI strategy. By Gyana Swain Sep 16, 2026 5 mins Artificial Intelligence IT Governance IT Leadership Oracle’s September patches put Fusion Middleware back in the hot seat The security update addresses 673 patches across 17 product families, including five CVSS 10.0 flaws and 13 rated 9.9 in Fusion Middleware. By Shweta Sharma Sep 16, 2026 4 mins Application Security Security Vulnerabilities AI agent authorization risks remain a gap in new NIST-CISA token security guidance Stronger monitoring, shorter-lived tokens, and tighter controls over how tokens are used after authentication are needed as AI agents complicate who and what enterprises can trust inside their systems. By Prasanth Aby Thomas Sep 16, 2026 5 mins APIs Access Control Single Sign-on Hundreds of OpenAI agents attack RubyGems platform Analyst argues that OpenAI’s depiction of the agents as ‘benign’ may pose a greater threat than the attack itself, generating SOC AI alert fatigue. By Evan Schuman Sep 15, 2026 6 mins Cyberattacks Cybercrime Ruby Critical Cisco Secure Email Gateway zero-day gives attackers root access ‘A root-level, unauthenticated RCE in an email gateway is about as good a foothold as an attacker gets.’ By Lucian Constantin Sep 15, 2026 3 mins Communications Security Email Security Network Security Exposed Vite servers are being probed for AWS and Azure credentials Attackers are scanning internet-exposed Vite development servers for environment files, cloud credentials and infrastructure configuration. By Shweta Sharma Sep 15, 2026 4 mins Code Security Development Tools Security Exaforce extends its AI security tool to monitor more than just Claude The new offering correlates AI-agent activity with endpoint, identity, cloud, SaaS and code data to help security teams detect and respond to threats. By Shweta Sharma Sep 15, 2026 5 mins Artificial Intelligence Identity and Access Management Security Software Threat actors are coming for your AI assets to operationalize their use of AI Threat groups are leveraging stolen AI credentials and victim cloud environments to launch distillation attacks and build AI-powered exploitation and post-exploitation pipelines. By Lucian Constantin Sep 15, 2026 6 mins Advanced Persistent Threats Cyberattacks Cybercrime A maximum severity GitLab flaw could turn your CI/CD server into an attacker’s treasure trove The vulnerability impacts self-managed CE and EE instances and provides an unauthenticated path to arbitrary file reads. It’s already being probed in the wild. By Taryn Plumb Sep 14, 2026 5 mins CI/CD Devops GitLab Update your firewall rules: Teams and Copilot are changing address Two popular Microsoft services will be redirected to new URLs, causing problems for enterprises if their firewalls and gateways don’t follow along. By Maxwell Cooter Sep 11, 2026 2 mins Application Security Network Security Security ConnectWise patches critical ScreenConnect authentication failure after five days The company seeks to reassure users after revealing a new vulnerability. By Maxwell Cooter Sep 11, 2026 2 mins Network Security Remote Access Security Zero-Day Vulnerabilities India’s STPI serves TerminalFix-style attack via fake Cloudflare check A government organization providing cloud infrastructure to Indian companies is inadvertently distributing malware. By Gyana Swain Sep 11, 2026 5 mins Cyberattacks Government Government IT Anthropic finds evidence of a fourth AI escaping from containment After plowing through four million more chat transcripts, though, it hasn’t found any further incidents. By Maxwell Cooter Sep 11, 2026 2 mins Artificial Intelligence Cyberattacks Cybercrime How AI and cybersecurity are reshaping ServiceNow With AI putting the squeeze on SaaS providers, ITSM incumbent ServiceNow is embracing a consumption-based shift and an expansion play centered on cyber. By John E. Dunn Sep 11, 2026 7 mins Artificial Intelligence Security Infrastructure Technology Industry Attackers use passkey-themed scams to hijack Microsoft 365 accounts Microsoft says threat actors posing as IT helpdesk staff are tricking employees into phishing and device-code attacks that lead to persistent cloud access. By Shweta Sharma Sep 11, 2026 4 mins Cybercrime Security Social Engineering Google’s Early Access is creating a blind spot for malicious apps Bitdefender found that some seemingly ordinary utilities requested unusual permissions or exhibited behavior that could pose a serious security risk if installed on an employee’s Android device. By Shweta Sharma Sep 11, 2026 4 mins Endpoint Protection Mobile Security Security Attackers are weaponizing the gap between Chromium fixes and Chrome patches The ‘BlueMoon’ attack chains three high-severity Chrome and Windows flaws, raising concerns that sophisticated exploitation is becoming faster and more reusable. By Taryn Plumb Sep 10, 2026 5 mins Browser Security Endpoint Protection Vulnerabilities AI workflows may be creating a dangerous new authorization blind spot Researchers warn that trusted AI agents can act as proxies for privileged accounts when user permissions are not enforced downstream. By Gyana Swain Sep 10, 2026 5 mins Access Control Authentication Identity and Access Management Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways By compromising BIG-IP APM systems, attackers may gain access to credentials, SSO tokens and trusted pathways into downstream applications. By Shweta Sharma Sep 10, 2026 4 mins Cybercrime Malware Security MikroTik patches flaws currently being exploited to take over routers MikroTrick chains together two of six patched vulnerabilities to obtain root privileges on MikroTik devices with SSH exposed to the internet, of which they are more than 120,000. By Lucian Constantin Sep 9, 2026 4 mins Network Security Security Vulnerabilities ChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channel Cross-account task execution exposed Gmail data without user awareness, raising new concerns for enterprise AI security. By Gyana Swain Sep 9, 2026 5 mins Artificial Intelligence Data Breach IT Governance ShinyHunters claims Florida DMV breach, puts data on the clock The ransomware group claims it breached the state’s DAVID database and has threatened to publish the allegedly stolen records after a September 11 deadline. By Shweta Sharma Sep 9, 2026 4 mins Cybercrime Malware Ransomware September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows Microsoft also patched other bugs that analysts deem wormable, Adobe and Cisco issued critical updates, and SAP patched a critical vulnerability in NetWeaver and S/4HANA. By Howard Solomon Sep 8, 2026 9 mins Security Vulnerabilities Zero-Day Vulnerabilities Cisco bundles fixes for multiple vulnerabilities, some critical, into one patch The patch addresses two critical vulnerabilities and five other high-severity bugs impact Cisco’s carrier-grade routing OS, with potential paths to RCE and unauthorized access. By Taryn Plumb Sep 8, 2026 6 mins Network Security Security Vulnerabilities Adobe Commerce max-severity bug comes under active attack Attackers are exploiting the critical StyleSmuggler flaw to execute code without authentication and plant stealthy backdoors on vulnerable online stores. By Shweta Sharma Sep 8, 2026 4 mins Security Vulnerabilities Zero-Day Vulnerabilities BigBear 2.0 phishing campaign hijacks Microsoft 365 sessions after MFA CloudSEK found 4,148 stolen session cookies and 1,032 plaintext passwords in an operation targeting 461 organizations across more than 40 countries. By Prasanth Aby Thomas Sep 8, 2026 5 mins Cybercrime Phishing Security Sam Altman calls GPT-6 Astra rollout ‘messy’ as enterprise users wait for access OpenAI’s latest model is being rolled out in stages after an uneven launch, raising questions for enterprises about access, governance and production readiness. By Gyana Swain Sep 7, 2026 5 mins Artificial Intelligence Generative AI IT Governance Back-to-back N-able bugs send admins on a patching spree N-able is asking admins to patch against a CVSS 10.0 zero-day in its N-central RMM platform, a day after disclosing and patching two other vulnerabilities affecting the product. By Shweta Sharma Sep 7, 2026 4 mins Network Security Remote Access Security Zero-Day Vulnerabilities New CISO appointments 2026 Keep up with news of CSO, CISO, and other senior security executive appointments. By CSO staff Sep 7, 2026 25 mins C-Suite CSO and CISO IT Governance FBI investigates breach of 153 million driving license records at IDscan.net A treasure trove of personal data is revealed to the world. By Maxwell Cooter Sep 4, 2026 2 mins Cyberattacks Data Breach Data Privacy Bidding war for defunct Spirit Airlines’ employee data will not die Former airline staff have gone to court to stop their personal data being used to train AI. By Maxwell Cooter Sep 4, 2026 2 mins Data Privacy Markets Transportation and Logistics Industry OpenAI launches GPT-6 Astra, its first model to cross a critical cybersecurity threshold The rollout comes with a safety disclosure that could reshape how CIOs think about model governance. By Gyana Swain Sep 4, 2026 5 mins Artificial Intelligence Generative AI Security OpenAI targets small utilities with $1 billion cyber defense initiative The initiative will focus on protecting small water and electricity providers as well as local governments and banks. By Cynthia Brumfield Sep 3, 2026 5 mins Artificial Intelligence Critical Infrastructure Vulnerabilities Decade-old PostgreSQL flaw turns backup account into a backdoor The flaw that had gone unnoticed since 2014 could let attackers with low-privileged replication access execute code, gain database superuser privileges, and establish persistent access. By Shweta Sharma Sep 3, 2026 4 mins Security Vulnerabilities Counterfeit installers turn routine software downloads into enterprise breaches Attackers are using spoofed websites impersonating Microsoft Edge, Kaspersky, Razer and other vendors to distribute trojanized installers that establish persistence and weaken security defenses. By Gyana Swain Sep 3, 2026 5 mins Cybercrime Malware Security AI agents help compress ransomware intrusion to under 10 hours, raising stakes for CISOs The attack exploited exposed credentials and trust relationships spanning development and cloud environments, showing how access in one system can enable more privileged actions in another. By Prasanth Aby Thomas Sep 3, 2026 5 mins Cybercrime Malware Ransomware 12345678910…433 Show me morePopularArticlesPodcastsVideos news Google makes Gemini 4 AI model available to a trusted few By Nidhi SingalOct 1, 20265 mins Artificial IntelligenceSecurity news Cisco SD-WAN Manager hit by zero-day admin access attack By Shweta SharmaOct 1, 20264 mins Network SecurityVulnerabilitiesZero-Day Vulnerabilities opinion Why AI agents are like the dog that pushed kids into the Seine By Etay MaorOct 1, 20266 mins Access ControlData and Information SecurityIT Governance podcast Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security podcast The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO podcast Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cybercrime video Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security video The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO video Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cyberattacks
