Latest from todayOkta bets on identity to control AI agents, but is identity enough?Identity provider Okta is investing heavily to secure the agents enterprise, but even authenticated agents can do harm, leaving room for debate in the hotly contested agentic AI security space.By Maria KorolovSep 23, 20265 minsIdentity and Access ManagementMarketsTechnology Industry AI malware just removed the human from the attack loopBy Taryn PlumbSep 22, 20266 minsArtificial IntelligenceCybercrimeMalware Microsoft’s EvilTokens takedown sheds light on state of AI-powered cybercrimeBy John LeydenSep 22, 20264 minsCybercrimePhishingSocial EngineeringZ.ai disables coding assistant feature after flaw exposed enterprise code upload riskBy Gyana Swain Sep 22, 20264 minsArtificial IntelligenceData and Information SecurityDevelopment Tools Beware these fake websites selling subscriptions to AI assistantsBy Shweta Sharma Sep 22, 20263 minsArtificial IntelligenceCybercrimeFraud Gemini broke into 3 companies, but Google kept it quiet because ‘no damage was done’By Evan Schuman Sep 21, 20267 minsArtificial IntelligenceCybercrimeHacking After spending billions, OpenAI still has gaps in its cybersecurityBy Gyana Swain Sep 21, 20265 minsArtificial IntelligenceDevelopment ToolsIdentity and Access Management New npm malware finds a way around install script defensesBy Shweta Sharma Sep 21, 20263 minsCode SecurityCybercrimeMalware CISA is ending its monthly vulnerability bulletinBy Maxwell Cooter Sep 18, 20262 minsGovernmentMarketsVulnerabilities GitHub already has an EDR. You just have to listen to it The same GitHub event stream that organizations often treat as audit data can be used as behavioral telemetry to detect software supply-chain attacks. By Shweta Sharma Aug 11, 2026 4 mins Security Security Software Threat and Vulnerability Management OpenAI launches GPT-5.6-Cyber as AI narrows vulnerability response window GPT-5.6-Cyber responded to 95% of advanced cyber requests in an OpenAI refusal-rate test and has been used to uncover previously unknown vulnerabilities in Google’s V8 engine. By Prasanth Aby Thomas Aug 11, 2026 4 mins Artificial Intelligence Security Software Threat and Vulnerability Management The future of AI security research isn’t autonomous, it’s human-amplified HTTP Terminator generated, evaluated, and weaponized thousands of HTTP desync hypotheses, and surfaced a new technique that neither the AI or its human operator would have found alone. By Taryn Plumb Aug 10, 2026 6 mins Cybercrime Hacking Vulnerabilities OpenAI says Astra could reach ‘critical’ cyber capability, tightens safeguards Tests show the upcoming model may be able to find and exploit vulnerabilities or carry out attacks on its own, prompting stricter controls and external testing. By Gyana Swain Aug 10, 2026 5 mins Artificial Intelligence Generative AI Security One-click flaw in Atlassian Rovo exposed enterprise data via prompt injection attack Researchers found that a crafted link could inject malicious instructions into Atlassian Rovo and potentially turn its broad enterprise access and autonomous agents into a data-exfiltration tool. By Shweta Sharma Aug 10, 2026 4 mins Artificial Intelligence Security Vulnerabilities Trojanized AI skills gain 1.7M installs in agent-targeted attack Typosquatting on popular AI services Paperclip and Browser Use, the malicious skills cracked skills.sh’s trending list, instructing agents to install a credential stealer from GitHub instead. By Lucian Constantin Aug 7, 2026 6 mins Artificial Intelligence Cyberattacks Security Moonshot’s Kimi AI model has also escaped from a test environment Frontier finds another AI model has followed OpenAI in breaking out of sandbox. By Maxwell Cooter Aug 7, 2026 2 mins Artificial Intelligence IT Governance IT Leadership Snowflake attacker pleads guilty to hack of 165 companies’ data Connor Riley Moucka faces between 2 and 30 years in prison for the hacks. By Maxwell Cooter Aug 7, 2026 2 mins Cyberattacks Cybercrime Data Breach Human oversight is still critical as AI patching tools miss security risks 1Password researchers found LLM-generated fixes often overlooked root causes, architectural context, and long-term security implications in complex vulnerability patches. By Shweta Sharma Aug 7, 2026 3 mins Artificial Intelligence Security Vulnerabilities NatJack exploits put NAT security assumptions to the test at Black Hat NatJack attack class exposes design flaw across decades of network infrastructure. By Sean Michael Kerner Aug 6, 2026 7 mins Network Security Security Meta joins OpenAI, Anthropic in latest AI test breach Third disclosure in weeks raises fresh concerns over how frontier AI models are contained during cyber evaluations. By Gyana Swain Aug 6, 2026 6 mins Artificial Intelligence Cyberattacks Security Attackers hid malware inside Oracle Database after SQL injection breach Attackers chained SQL injection with Oracle’s embedded Java capabilities to hide a custom post-exploitation toolkit inside the database and gain SYSTEM-level access to the underlying Windows server. By Shweta Sharma Aug 6, 2026 4 mins Data Breach Malware Vulnerabilities Evidence points to cybercriminals stepping up their AI game Reports from Cisco Talos and CrowdStrike provide real-world insights into how AI is evolving attackers’ tradecraft and becoming part of their day-to-day operations. By John Leyden Aug 6, 2026 6 mins Artificial Intelligence Cyberattacks Cybercrime Enterprise passkey security under threat from malware Trusted workflows can be misused to take over passkey-protected accounts if an attacker can first breach enterprise defenses and plant malware, researchers found; analysts say the issue is flaws in passkeys’ supporting processes. By Evan Schuman Aug 5, 2026 6 mins Cyberattacks Cybercrime Identity and Access Management Critical Paperclip bugs expose AI agent trust failures Misplaced identity and authorization assumptions could lead to remote code execution, data exposure, and developer-machine compromise in affected Paperclip deployments. By Shweta Sharma Aug 5, 2026 4 mins Artificial Intelligence Security Vulnerabilities OpenAI, Anthropic AI agents resorted to deception in new cybersecurity incidents The incidents follow recent security evaluation breaches involving Hugging Face and Modal. By Gyana Swain Aug 5, 2026 5 mins Artificial Intelligence Cyberattacks Security AI threat report: Rogue agents, workflow attacks A roundup of the latest noteworthy AI-assisted attacks, threats, risks, and vulnerabilities, and what they portend for cyber defense. By CSO Staff Aug 5, 2026 5 mins Application Security Artificial Intelligence Security Ruby on Rails critical bug puts every image upload under scrutiny The vulnerability abuses Active Storage, allowing unauthenticated attackers to read sensitive files and potentially take over applications. By Taryn Plumb Aug 4, 2026 7 mins Development Approaches Vulnerabilities Web Development ChainDrop credential stealing worm infects over 400 npm packages The Shai Hulud variant’s blast radius includes several highly popular packages thus far.. Security teams are urged to perform full audits of all developer machines. By Lucian Constantin Aug 4, 2026 5 mins Cyberattacks Cybercrime Malware Critical Azure Cosmos DB flaw threatened cross-tenant database takeover A critical Gremlin API vulnerability exposed a path to any Cosmos DB instance, including Microsoft’s own services, before the company redesigned the platform. By Gyana Swain Aug 4, 2026 5 mins Cloud Security Security Vulnerabilities The top new cybersecurity products at Black Hat USA 2026 AI agents dominated this year’s show floor, but vendors also unveiled new capabilities for exposure management, cyber resilience, threat intelligence, and autonomous security operations. By Shweta Sharma Aug 4, 2026 6 mins Artificial Intelligence Black Hat Security Google ADK flaws reveal what happens when AI agents trust the wrong message The flaws show how agentic workflows can turn trusted repository signals into privilege-escalation paths that conventional identity and CI/CD controls may not reveal. By Prasanth Aby Thomas Aug 4, 2026 5 mins Artificial Intelligence Security Vulnerabilities Attackers are crafting malicious AI instruction files to turn your agents into quiet criminal helpers Repositories with poisoned configuration files for AI agents are part of a larger trend that sees software supply chain attacks getting creative about initial access and malicious code execution. By Lucian Constantin Aug 4, 2026 8 mins Artificial Intelligence Cyberattacks Cybercrime Zero Networks targets AI agent security gaps with network-level ‘Least Agency’ controls The company has introduced a capability that applies OWASP’s emerging Least Agency principle by using identity and network-level controls to contain compromised AI agents. By Shweta Sharma Aug 3, 2026 4 mins Artificial Intelligence Security Security Software DefCon security conference bans smart glasses with recording capabilities Smart eyewear users will be strictly monitored. By Maxwell Cooter Jul 31, 2026 2 mins Data Privacy Data and Information Security Privacy Google adds to confusion with new names for threat actors There’s yet another taxonomy for cybersecurity researchers to remember. By Maxwell Cooter Jul 31, 2026 2 mins Anti Malware Security Security Software Broadcom patches vulnerabilities all over VMware Three of the five security issues are critical. By Maxwell Cooter Jul 31, 2026 2 mins Cloud Security Security Microsoft almost gave away the keys to everyone’s Azure Cosmos DBs Microsoft spent eight months fixing a cloud database bug uncovered by Wiz. By Maxwell Cooter Jul 31, 2026 2 mins Cloud Security Security JetBrains says a crafted HTTP request could break TeamCity The company has patched a critical pre-authentication flaw in TeamCity that could let attackers execute arbitrary commands, expose credentials, and compromise supply chains on self-hosted servers. By Shweta Sharma Jul 31, 2026 3 mins Security Vulnerabilities After OpenAI, Anthropic finds Claude breached three organizations during cyber tests Anthropic says a review triggered by OpenAI’s recent disclosure found three real-world intrusions caused by a misconfigured AI testing environment. By Gyana Swain Jul 31, 2026 6 mins Artificial Intelligence Cyberattacks IT Governance Copilot worm can spread through Microsoft Word docs Although there are a few ways to mitigate the risk, the only way to block it is to get AI to differentiate instructions from data, which is impossible today. By Evan Schuman Jul 30, 2026 10 mins Cyberattacks Cybercrime Vulnerabilities A coordinated attack hit 30+ Minnesota water systems. Who did it, and what does a Rockwell notice add to the picture? Investigators are chasing two open questions in the coordinated attack on Minnesota water systems: who was behind it, and whether a shared vulnerability in widely used industrial controllers made dozens of small utilities exploitable at once. By Cynthia Brumfield Jul 30, 2026 8 mins Critical Infrastructure Security AI agents gain access to financial workflows amid growing governance gaps A Pathlock report found that 53% of organizations cannot fully verify what AI agents do across business systems, even as they gain authority over finance, HR, procurement, and supply chain workflows. By Shweta Sharma Jul 30, 2026 3 mins Application Security Artificial Intelligence IT Governance Critical Ruflo flaw lets attackers hijack AI agents through exposed MCP bridge Researchers say an unauthenticated vulnerability enables code execution, credential theft, AI memory poisoning, and persistent compromise. By Gyana Swain Jul 30, 2026 5 mins Artificial Intelligence Security Vulnerabilities Russian hackers turn Exchange flaw into ‘half-click’ mailbox takeover The OWAReaper implant can establish server-side mailbox permissions that remain after credentials are changed and affected devices are rebuilt. By Prasanth Aby Thomas Jul 30, 2026 4 mins Security Vulnerabilities A Scattered Spider member was indicted. Microsoft’s GDID went to trial. Investigators’ use of a little-known Windows device identifier to take down an alleged cybercriminal has raised privacy and transparency concerns about Microsoft telemetry. By John Leyden Jul 30, 2026 6 mins Cybercrime Privacy Windows Security CISA unveils a six-step blueprint for isolating critical infrastructure during cyberattacks A new guide from CISA and allied cybersecurity agencies says organizations should build dedicated isolation points into operational technology to contain attacks and continue delivering essential services. By Taryn Plumb Jul 29, 2026 7 mins Critical Infrastructure Cyberattacks Cybercrime Mythos takes its first shot at post-quantum cryptography Anthropic’s Mythos AI model has helped discover two new cryptanalytic attacks, one against the NIST post-quantum digital signature candidate Hawk, and one against a weakened version of AES; neither threatens deployed technology. By Shweta Sharma Jul 29, 2026 4 mins Artificial Intelligence Data and Information Security Encryption OpenAI rogue AI agent’s attack expanded beyond Hugging Face Technical disclosures from Hugging Face, JFrog, and the Cloud Security Alliance show how the autonomous AI agent crossed multiple trust boundaries. By Gyana Swain Jul 29, 2026 5 mins Artificial Intelligence Security Vulnerabilities Ransomware report: VPNs in the crosshairs, AI attacks A roundup of recent ransomware trends, threat actor activity, and industries at risk. By CSO Staff Jul 29, 2026 4 mins Cybercrime Malware Ransomware Fortinet’s new FortiGate platform converges firewall, SASE technologies New FortiGate 1200G series with FortiSASE Outpost brings threat protection and cloud-delivered SASE to on-premises environments. By Michael Cooney Jul 28, 2026 2 mins Cloud Security Network Security Security A 13-year-old flaw is exposing tens of thousands of data center management systems Lava researchers found more than 36,000 internet-exposed baseboard management controllers vulnerable to a 13-year-old IPMI flaw, giving attackers a path beneath the operating system. By Taryn Plumb Jul 28, 2026 6 mins Business Enterprise Vulnerabilities Arista patches maximum severity vulnerability that is already being exploited The vendor said that the problematic VeloCloud Orchestrator functionality was ‘intended to be for internal use only.’ Analysts stress that intent is not enough. By Evan Schuman Jul 28, 2026 6 mins Network Security Security Vulnerabilities Infoblox joins crowded EASM market with DNS-centric approach The company is combining DNS expertise with external attack surface management and supply chain intelligence to help organizations identify exploitable internet-facing assets before attackers do. By Shweta Sharma Jul 28, 2026 3 mins Security Security Software Hugging Face breach shows why incident response needs a multi-model AI strategy Frontier AI model safety guardrails impeded Hugging Face’s analysis of attack evidence, forcing it to rely on an open-weight model for incident response instead. By Lucian Constantin Jul 28, 2026 9 mins Incident Response Security Infrastructure Security Operations Center Hackers are compromising hotel Wi-Fi gateways to hijack Microsoft 365 accounts By compromising captive Wi-Fi gateways instead of user devices, attackers can silently redirect authentication traffic and steal Microsoft 365 credentials. By Taryn Plumb Jul 27, 2026 6 mins Cyberattacks Hacking Wireless Security Microsoft unveils multi-model agentic cyber stack for security operations Building on Microsoft’s extensive threat intelligence, security telemetry, and knowledge of customer environments, Project Perception’s specialized red, blue, and green team agents execute specialized playbooks to evaluate and update your security po By Lucian Constantin Jul 27, 2026 6 mins Application Security Security Infrastructure Security Operations Center Samsung’s AI-powered glasses could be looking at your data The data leakage and privacy violation potential is obvious, but a meaningful fix is anything but. By Evan Schuman Jul 27, 2026 7 mins Compliance Data Privacy Privacy Certighost haunts Microsoft Active Directory Certificate Services The Certighost vulnerability exploits a little-known AD CS fallback mechanism to trick certificate authorities into issuing trusted credentials. By Shweta Sharma Jul 27, 2026 4 mins Security Vulnerabilities Nvidia launches Open Secure AI Alliance with over 30 other AI companies A new industry group led by Nvidia is promoting open AI models (and not OpenAI’s models) as essential to cyber defense. By Peter Sayer Jul 27, 2026 3 mins Artificial Intelligence Security 12345678910…433 Show me morePopularArticlesPodcastsVideos news Google makes Gemini 4 AI model available to a trusted few By Nidhi SingalOct 1, 20265 mins Artificial IntelligenceSecurity news Cisco SD-WAN Manager hit by zero-day admin access attack By Shweta SharmaOct 1, 20264 mins Network SecurityVulnerabilitiesZero-Day Vulnerabilities opinion Why AI agents are like the dog that pushed kids into the Seine By Etay MaorOct 1, 20266 mins Access ControlData and Information SecurityIT Governance podcast Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security podcast The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO podcast Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cybercrime video Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security video The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO video Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cyberattacks
