Latest from todayA zero-click RCE flaw in AI coding agents could have exposed enterprise systemsBy exploiting how AI coding agents retrieve and verify plugins, researchers were able to execute malicious code even when the agent was told to use a trusted, approved version.By Anirban GhoshalSep 18, 20266 minsCode EditorsDevelopment ToolsVulnerabilities GhostCode attackers abuse device codes to take over Microsoft 365 accountsBy Shweta SharmaSep 18, 20264 minsAuthenticationMultifactor AuthenticationPhishing Cisco patches max-severity ISE flaw, the second critical zero-day this weekBy Lucian ConstantinSep 17, 20263 minsNetwork SecurityVulnerabilitiesZero-Day VulnerabilitiesOpenAI admits six new misalignment incidents under new reporting frameworkBy Gyana Swain Sep 17, 20265 minsApplication SecurityArtificial IntelligenceIT Governance Security spending is growing — except for the typical CISOBy Shweta Sharma Sep 17, 20264 minsArtificial IntelligenceBudgetingIT Management Self-modifying AI agents expose a blind spot in enterprise securityBy Prasanth Aby Thomas Sep 17, 20264 minsApplication SecurityArtificial IntelligenceIT Governance LinkedIn fights for the right to tell customers when the feds want their dataBy Evan Schuman Sep 16, 20266 minsData PrivacyGovernmentLegal Big Tech’s AI safety rift signals disruption and disparity for enterprisesBy Gyana Swain Sep 16, 20265 minsArtificial IntelligenceIT GovernanceIT Leadership Oracle’s September patches put Fusion Middleware back in the hot seatBy Shweta Sharma Sep 16, 20264 minsApplication SecuritySecurityVulnerabilities Top AIs invent same fake PyPl and npm package names Research reveals that slopsquatting remains a threat to developers using AI to aid coding. By Maxwell Cooter Jul 24, 2026 2 mins Artificial Intelligence Code Security Development Tools Tycoon2FA takedown reshapes the phishing landscape Some of the most common phishing techniques are declining, but not because attackers are giving up. By Shweta Sharma Jul 24, 2026 4 mins Communications Security Email Security Phishing Ransomware groups are hammering your vulnerable VPNs Campaigns against flaws in security systems from Palo Alto, Fortinet, Citrix, and Check Point underscore a rising trend in how cybercriminals gain footholds in corporate networks. By John Leyden Jul 24, 2026 5 mins Cybercrime Malware Ransomware AgentForger proves AI agents can become persistent insider threats A patched OpenAI flaw let attackers create autonomous agents that live inside enterprise environments, highlighting how AI agents are reshaping enterprise security. By Taryn Plumb Jul 23, 2026 6 mins Artificial Intelligence Cyberattacks Cybercrime Check Point hole grants unauthenticated attackers full SmartConsole admin privileges The bug, with a CVSS score of 9.3, now has a patch, but Check Point encourages also restricting access to the console to only trusted IP addresses/subnets. By Evan Schuman Jul 23, 2026 5 mins Network Security Security Vulnerabilities Linux XFS has a decade-old race condition allowing full root access A split-second race inside the Linux kernel was all it took to turn a routine filesystem copy-on-write operation into a serious privilege escalation. By Shweta Sharma Jul 23, 2026 4 mins Security Vulnerabilities German law enforcement claims to have ‘dismantled’ mega phishing-as-a-service group Kratos Security consultants agree that the move will briefly slow down phishing attacks, but it’s less clear how long that slowdown will last. By Evan Schuman Jul 22, 2026 5 mins Malware Phishing Social Engineering Critical Zimbra security update fixes 9 vulnerabilities Admins for the popular email and collaboration suite — a frequent target of state-sponsored APTs — are urged to upgrade as soon as possible. By Lucian Constantin Jul 22, 2026 3 mins Application Security Security Vulnerabilities Oracle’s July update fixes ten 10.0 vulnerabilities in Fusion Middleware The record number of fixes in this quarter’s Critical Patch Update cover 32 product families. By Gyana Swain Jul 22, 2026 6 mins Security Vulnerabilities Cisco’s new AI model tells code reviewers where to look for vulnerabilities Cisco is betting that enterprises will see value in having AI quickly identify the handful of files worthy of investigation by human software vulnerability researchers. By Shweta Sharma Jul 22, 2026 4 mins Code Security Security Software Threat and Vulnerability Management OpenAI model escape puts enterprise AI defenses on notice An attack on Hugging Face executed by a sandboxed OpenAI model shows that prompt guardrails cannot serve as the main security boundary for AI agents, putting more pressure on enterprises to contain them through infrastructure controls that limit acce By Prasanth Aby Thomas Jul 22, 2026 5 mins Artificial Intelligence Generative AI Security AI agents can escape sandboxes without ever breaking them By manipulating files later consumed by trusted software, coding assistants can effectively cross security boundaries while remaining confined. By Shweta Sharma Jul 21, 2026 4 mins Access Control Artificial Intelligence Identity and Access Management Context bombing heralds a new AI era of deceptive defense By turning prompt injections and LLM safety guardrails against malicious AI agents, a creative new cyber defense adds attack neutralization to traditional canary detection techniques. By Lucian Constantin Jul 21, 2026 6 mins Application Security Data and Information Security Network Security White hat hacker Chanam Park zeros in on the AI era’s key security challenges Chanam Park, CEO of Steelion, introduced response strategies that information security leaders should focus on as AI alters the security environment. By Jihyun Lee (이지현) Jul 21, 2026 6 mins Artificial Intelligence Security ServiceNow’s sandbox escape RCE hole now exploited in the wild But the concern goes beyond the now-patched hole’s exploitation and focuses on the lack of security surrounding any sandbox in the AI era. By Evan Schuman Jul 20, 2026 6 mins Security Vulnerabilities Patch now: WordPress REST API bug allows remote code execution The flaw affects WordPress Core’s REST Batch API, allowing unauthenticated attackers to execute code on vulnerable sites. By Shweta Sharma Jul 20, 2026 3 mins APIs Security Vulnerabilities New ACR Stealer campaigns use WebDAV, MSHTA to evade detection Microsoft has warned that attackers are varying their post-exploitation techniques while relying on the same ClickFix lure, making related ACR Stealer incidents harder to connect. By Shweta Sharma Jul 20, 2026 3 mins Cybercrime Malware Security OnlyFans performers become unlikely allies of CISOs in securing websites Content creators uncovered the naked truth about government websites’ vulnerabilities. By Maxwell Cooter Jul 17, 2026 2 mins Development Approaches Security Web Development Google must open Android to rival AI agents, EU orders The move has implications for CISOs as well, says an industry expert. By Maxwell Cooter Jul 17, 2026 2 mins Android Security Endpoint Protection Mobile Security Fake TTF files deliver stealthy malware in global phishing campaign Attackers were found using a Lua-based malware loader posing as a TrueType font tile, with layered obfuscation and fileless execution to deploy stealers and persistent trojans. By Shweta Sharma Jul 17, 2026 4 mins Malware Phishing Security Senior executives are killing your shadow AI strategy Nearly two-thirds of senior decision-makers say they use unauthorized AI tools despite the risks, putting IT and security leaders in a difficult position. By Grant Gross Jul 17, 2026 6 mins Data and Information Security IT Governance Risk Management Zoom patches account takeover hole The bug, labeled ‘urgent,’ was detected internally, which consultants say is a welcome change from those discovered by users or third parties. By Evan Schuman Jul 16, 2026 5 mins Software Providers Technology Industry Vulnerabilities CISA urges immediate SharePoint hardening as exploits mount Three actively exploited SharePoint vulnerabilities have landed in the KEV catalog, with security experts warning that patching alone won’t prevent business disruption. By Shweta Sharma Jul 16, 2026 4 mins Security Vulnerabilities CISA urges software vendors to formalize vulnerability disclosure programs Joint guidance outlines how software vendors should work with security researchers as AI accelerates vulnerability discovery and increases pressure on vulnerability management. By Gyana Swain Jul 16, 2026 4 mins Laws and Regulations Security Vulnerabilities NPM ecosystem hit with two new supply chain compromises Stolen and leaked credentials lead to Node.js packages from AsyncAPI and Jscrambler Code Integrity being poisoned with malware. By Lucian Constantin Jul 15, 2026 5 mins Cyberattacks Cybercrime Node.js New Windows Bind Link techniques let attackers evade EDR, security controls The File-Binding, Process-Binding and Silo-Binding techniques abuse Windows filesystem virtualization features to present trusted files to security products while malware executes undetected. By Shweta Sharma Jul 15, 2026 4 mins Endpoint Protection Security Windows Security White House launches AI-driven vulnerability clearinghouse to speed cyber remediation The new Gold Eagle program will use AI to identify, prioritize, and coordinate remediation of software vulnerabilities across federal agencies, critical infrastructure operators, and open-source communities. By Gyana Swain Jul 15, 2026 5 mins Artificial Intelligence Laws and Regulations Security New bugs in Claude for Chrome allow extensions to abuse AI privileges The flaws can let rogue extensions perform privileged AI actions, including access to Gmail, Docs, and more. By Shweta Sharma Jul 15, 2026 3 mins Artificial Intelligence Security Vulnerabilities Microsoft is forcing an enterprise transition to passkeys Beginning in September, Microsoft Entra ID will replace SMS and voice authentication with passkeys, signaling that traditional credentials are too risky to remain the standard amidst AI-powered attacks. By Taryn Plumb Jul 14, 2026 6 mins Access Control Authentication Identity and Access Management Patch Tuesday roundup: Microsoft fixes a monthly record 569 holes; SAP patches a critical memory corruption bug The huge Microsoft release likely reflects how good AI has become at helping vendors find vulnerabilities, says one expert. By Howard Solomon Jul 14, 2026 11 mins Security Vulnerabilities Zero-Day Vulnerabilities Phishing for dummies: Forg365 lowers barrier to M365 account takeovers The Telegram-distributed service combines AI-assisted lures with device-code phishing and attacker-side session refresh, complicating containment after an account is breached. By Prasanth Aby Thomas Jul 14, 2026 4 mins Artificial Intelligence Phishing Security AI-powered breaches provide wake-up call for incident response Recent incidents show attackers moving beyond LLM-written phishing lures to using AI across attack chains. Security teams must sharpen playbooks in response. By Lucian Constantin Jul 14, 2026 6 mins Cyberattacks Cybercrime Incident Response Governments to enterprises: Improve your router security hygiene A new multinational advisory warns that state-sponsored attackers continue to compromise critical infrastructure by exploiting outdated protocols, default credentials, and neglected network devices. By Taryn Plumb Jul 13, 2026 6 mins Cyberattacks Cybercrime Network Security RabbitMQ flaws expose OAuth secrets, risk complete takeover of the broker Two patched RabbitMQ vulnerabilities could leak OAuth client secrets, bypass access controls, and expose enterprise messaging infrastructure to attackers. By Shweta Sharma Jul 13, 2026 3 mins Security Vulnerabilities EU extends mass scanning of messages without a warrant The Chat Control 1.0 law has been extended through at least 2028, allowing scanning of email and direct messages on platforms including Discord, and Skype. By Maxwell Cooter Jul 10, 2026 3 mins Communications Security Email Security Messaging Security CrowdStrike identifies five new prompt injection threats to AI Awareness of all the ways prompt injection can be effected will help security teams spot a new generation of attacks. By Maxwell Cooter Jul 10, 2026 2 mins Artificial Intelligence Data and Information Security Generative AI Microsoft uncovers GigaWiper, a backdoor designed for destruction on demand The modular Golang backdoor combines remote administration, multiple disk-wiping logics, and a Crucio-derived ransomware module that deliberately discards encryption keys, making recovery impossible. By Shweta Sharma Jul 10, 2026 3 mins Cybercrime Malware Ransomware AI coding tool hole illustrates a big problem with human in the loop The flaw, which impacted Amazon, Anthropic, Google, Cursor and others, let the agent give the human false information on which to make decisions. By Evan Schuman Jul 9, 2026 6 mins Artificial Intelligence Development Tools Vulnerabilities Attack on Amazon Bedrock-linked AI gateway highlights new cloud security risk The intrusion followed a familiar cloud attack playbook, but experts say the bigger concern is that AI gateways increasingly serve as central hubs for identities, permissions, and model access. By Shweta Sharma Jul 9, 2026 4 mins Artificial Intelligence Cloud Security Security UK cyber agency unveils AI-powered Cyber Shield to counter attacks at machine speed NCSC’s Cyber Shield blueprint would deploy autonomous AI systems to find and neutralize cyberattacks across the UK government and critical infrastructure. By Gyana Swain Jul 9, 2026 5 mins Artificial Intelligence Laws and Regulations Lateral movement risk rises as enterprises emphasize convenience over containment Enterprise networks are too reliant on legacy protocols and trusted administrative paths, leaving internal servers easily reachable once attackers breach the network, telemetry shows. By John Leyden Jul 9, 2026 5 mins Incident Response Network Security Risk Management GitHub’s public APIs are becoming an enterprise reconnaissance tool Researchers have uncovered a sustained campaign using GitHub’s public APIs and ghost accounts to profile enterprise software environments while blending into normal developer activity. By Taryn Plumb Jul 8, 2026 6 mins Cyberattacks Cybercrime GitHub GitHub AI agent leaks private repositories via prompt injection attack Findings raise fresh concerns over the security of AI agents with privileged access to enterprise code. By Gyana Swain Jul 8, 2026 5 mins Artificial Intelligence Cyberattacks Cybercrime Cybercriminals exploit India’s tax filing season with a dual-malware campaign A multi-stage phishing campaign is impersonating India’s Income Tax Department to deploy both Gh0st RAT and AsyncRAT, giving attackers redundant access through separate C2 infrastructure. By Shweta Sharma Jul 8, 2026 3 mins Cybercrime Malware Security 16-year-old KVM flaw allows attackers to escape VMs and take over Linux servers A critical vulnerability dubbed Januscape patched in the Linux kernel-based virtualization module poses arbitrary code execution risk to multi-tenant cloud environments and virtualized enterprise servers. By Lucian Constantin Jul 7, 2026 3 mins Cloud Security Security Vulnerabilities Why The Gentlemen ransomware is a test of identity and recovery controls The ransomware’s use of trusted administrative tools and recovery-disruption tactics shows why containment, not just endpoint detection, is becoming central to enterprise defense. By Prasanth Aby Thomas Jul 7, 2026 5 mins Cybercrime Malware Ransomware AI agents fall for indirect prompt injection traps Hidden instructions on websites con agents into falling for scams that a human would see through, Zscaler found. By Evan Schuman Jul 6, 2026 5 mins Cybercrime Fraud Vulnerabilities This AI agent autonomously hacked a network, adapted on the fly, and demanded a ransom JadePuffer exploited a vulnerable Langflow server, harvested credentials, moved laterally and encrypted more than 1,300 database records, marking what Sysdig describes as the first documented end-to-end agentic ransomware operation. By Gyana Swain Jul 6, 2026 5 mins Artificial Intelligence Ransomware Security Microsoft 365 users fall victim to one-in-a-million password spray attack The attack exploited previously exposed credentials and flaws in enterprises’ multi-factor authentication configurations. By Maxwell Cooter Jul 3, 2026 2 mins Authentication Identity Theft Passwords Adobe premieres a second Patch Tuesday each month to deliver fixes faster The creative tools and marketing platform vendor is following Oracle in increasing the frequency of its patches. By Maxwell Cooter Jul 3, 2026 2 mins Security Vulnerabilities 12345678910…433 Show me morePopularArticlesPodcastsVideos news Google makes Gemini 4 AI model available to a trusted few By Nidhi SingalOct 1, 20265 mins Artificial IntelligenceSecurity news Cisco SD-WAN Manager hit by zero-day admin access attack By Shweta SharmaOct 1, 20264 mins Network SecurityVulnerabilitiesZero-Day Vulnerabilities opinion Why AI agents are like the dog that pushed kids into the Seine By Etay MaorOct 1, 20266 mins Access ControlData and Information SecurityIT Governance podcast Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security podcast The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO podcast Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cybercrime video Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security video The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO video Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cyberattacks
