Latest from todayAI agent authorization risks remain a gap in new NIST-CISA token security guidanceStronger monitoring, shorter-lived tokens, and tighter controls over how tokens are used after authentication are needed as AI agents complicate who and what enterprises can trust inside their systems.By Prasanth Aby ThomasSep 16, 20265 minsAPIsAccess ControlSingle Sign-on Hundreds of OpenAI agents attack RubyGems platformBy Evan SchumanSep 15, 20266 minsCyberattacksCybercrimeRuby Critical Cisco Secure Email Gateway zero-day gives attackers root accessBy Lucian ConstantinSep 15, 20263 minsCommunications SecurityEmail SecurityNetwork SecurityExposed Vite servers are being probed for AWS and Azure credentialsBy Shweta Sharma Sep 15, 20264 minsCode SecurityDevelopment ToolsSecurity Exaforce extends its AI security tool to monitor more than just ClaudeBy Shweta Sharma Sep 15, 20265 minsArtificial IntelligenceIdentity and Access ManagementSecurity Software Threat actors are coming for your AI assets to operationalize their use of AIBy Lucian Constantin Sep 15, 20266 minsAdvanced Persistent ThreatsCyberattacksCybercrime A maximum severity GitLab flaw could turn your CI/CD server into an attacker’s treasure troveBy Taryn Plumb Sep 14, 20265 minsCI/CDDevopsGitLab Update your firewall rules: Teams and Copilot are changing addressBy Maxwell Cooter Sep 11, 20262 minsApplication SecurityNetwork SecuritySecurity ConnectWise patches critical ScreenConnect authentication failure after five daysBy Maxwell Cooter Sep 11, 20262 minsNetwork SecurityRemote Access SecurityZero-Day Vulnerabilities New CitrixBleed-like NetScaler flaw sees exploit attempts in the wild Citrix NetScaler received patches for another memory leak vulnerability similar to CitrixBleed, as well as memory overflow, file read and denial-of-service issues By Lucian Constantin Jul 3, 2026 4 mins Network Security Security Vulnerabilities Argo CD flaw shows why GitOps infrastructure should be treated as tier zero The unpatched vulnerability could give attackers a pathway from a compromised pod to broader control over Kubernetes deployments. By Prasanth Aby Thomas Jul 2, 2026 4 mins Development Tools Security Vulnerabilities Sandbox bypass flaws in Cursor IDE highlight prompt injection as an RCE vector The two vulnerabilities reveal a native flaw in LLMs and AI-assisted IDEs affecting more than just Cursor. By Lucian Constantin Jul 1, 2026 5 mins Artificial Intelligence Development Tools Vulnerabilities Malicious Chromium extension spoofs Perplexity AI to hijack browser searches Researchers say attackers are extending AI-themed social engineering from phishing campaigns to browser extensions. By Gyana Swain Jun 30, 2026 5 mins Browser Security Endpoint Protection Security Hackers exploit critical PTC Windchill PLM software flaw The popular product lifecycle management platform is under active exploitation for an RCE vulnerability that could put intellectual property in jeopardy. By Lucian Constantin Jun 26, 2026 3 mins Manufacturing Industry Security Vulnerabilities Malware authors subvert AI detection systems MacOS code prompts LLM models to reject automated security analysis. By Maxwell Cooter Jun 26, 2026 2 mins Anti Malware Cybercrime Malware Cyberattacks pose a ‘threat to life’ in Australia The nation’s security intelligence chief has warned of the threat posed by state-sponsored activity. By Maxwell Cooter Jun 26, 2026 2 mins Critical Infrastructure Cyberattacks Cybercrime Proposed US law would make AI risk reporting a legal obligation The bill seeks to close oversight gaps by forcing developers to disclose dangerous model behavior and security threats. By Gyana Swain Jun 26, 2026 5 mins Incident Response Laws and Regulations Security Practices GDPR at 10: Landmark data protections, increasing business burden While the enforcement of the GDPR is becoming significantly stricter in Europe, Europe’s data protection rules are facing their next test — this time from AI. By Manfred Bremmer Jun 26, 2026 5 mins Compliance Government Laws and Regulations Be on the lookout for Mistic, a new backdoor used by ransomware broker The malware program has been deployed across multiple sectors since April, helping to provide initial access sold to ransomware gangs. By Lucian Constantin Jun 24, 2026 4 mins Cybercrime Malware Ransomware Scattered Spider duo convicted over $38M Transport for London attack Two members of the cybercrime collective have pled guilty to compromising TfL’s network and disrupting in-station and online services. By John Leyden Jun 24, 2026 4 mins Cybercrime Ransomware Security Attackers exploit Cisco Unified CM flaw weeks after patch release New activity targets CVE‑2026‑20230, an SSRF bug that can allow unauthenticated file writes and potential root‑level access on vulnerable systems. By Gyana Swain Jun 24, 2026 4 mins Security Vulnerabilities How a malicious AI agent skill passed security checks and reached 26,000 users AIR says static scanning failed to detect a skill that redirected to a controlled domain and later altered its payload. By Prasanth Aby Thomas Jun 24, 2026 5 mins Artificial Intelligence Security Vulnerabilities Meta pauses employee monitoring program after data protections fail Poor data protection allowed employees to view everyone’s data, creating a trust issue. By Evan Schuman Jun 23, 2026 5 mins Data Breach Security Vulnerabilities Hole in widely-used FFmpeg codec could crash media servers or enable RCE Research from JFrog into the software supply chain vulnerability points to the need for better visibility into applications, including SBOMs. By Howard Solomon Jun 23, 2026 8 mins Open Source Security Vulnerabilities Trump sets post-quantum crypto deadlines, launches broader federal quantum initiative New executive orders direct agencies to accelerate quantum-resistant encryption efforts and lay the groundwork for contractor compliance as the White House warns adversaries are already collecting encrypted data for future decryption. By Cynthia Brumfield Jun 23, 2026 8 mins Encryption Government Government IT Unpatched SharePoint servers opened the door to multiple attackers, Microsoft finds Separate actors exploited the same exposure, creating overlapping intrusions that obscured detection and response. By Gyana Swain Jun 23, 2026 5 mins Cybercrime Malware Ransomware OpenAI rolls out AI-led push to fix open-source software flaws ‘Patch the Planet’ pairs automated analysis with expert review to uncover and remediate vulnerabilities in core infrastructure projects. By Prasanth Aby Thomas Jun 23, 2026 5 mins Open Source Security Vulnerabilities Change your cyber risk strategy to meet AI threats, Five Eyes countries warn CSOs ‘The urgency is clear,’ says the statement from cyber security agencies, but some experts say the advice is too general and too late. By Howard Solomon Jun 22, 2026 7 mins Artificial Intelligence Risk Management Security GitHub Actions hardens checkout security to block ‘pwn request’ attacks After years of trying to educate developers to use pull_request_target securely, the platform finally implements stronger defaults. By John E. Dunn Jun 22, 2026 4 mins Code Security GitHub Version Control Systems AWS Continuum offers devs help with securing code Continuum is a new service intended to hep developers and security teams secure their own code and that of others too, with a goal of automating remediation. By Anirban Ghoshal Jun 22, 2026 5 mins Artificial Intelligence Code Security Security Klue breach exposed Salesforce CRM data through stolen OAuth tokens Cybersecurity firms were among those caught up in the breach. By Gyana Swain Jun 22, 2026 5 mins Cyberattacks Cybercrime Data Breach Anatomy of a retail ransomware attack: Tabletop simulates modern mayhem methods An “Enter the War Room” incident response exercise sheds light on the rising access vectors and disruption and reputation-damaging activities attackers employ today. By John Leyden Jun 22, 2026 5 mins IT Skills and Training Incident Response Ransomware Threat actor adds advanced ‘EDR killer’ tools to ransomware-as-a-service platform Traditional EDR defense is under threat after a criminal group added a sophisticated capability to shut it down, warns ESET. By John E. Dunn Jun 19, 2026 4 mins Cybercrime Malware Ransomware Microsoft broke some OLE automations with latest Windows update Third-party applications can no longer open Office documents for you. By Maxwell Cooter Jun 19, 2026 2 mins Endpoint Protection Security Windows Security Microsoft says web-enabled AI agents can trigger host-level RCE Microsoft’s AutoJack research shows how a malicious webpage rendered by an AI browsing agent can reach local MCP services and execute arbitrary processes on the underlying system. By Shweta Sharma Jun 19, 2026 4 mins Artificial Intelligence Security Vulnerabilities M365 Copilot SearchLeak: Your prompt injection attack surface just got bigger Although not the first of its kind, researchers’ POC attack against Microsoft’s M365 Copilot Enterprise underscores parameter-to-prompt (P2P) injections as a potentially broad threat. By Lucian Constantin Jun 19, 2026 6 mins Artificial Intelligence Security Vulnerabilities Oracle releases 245 new security patches, all rated ‘high-priority security’ The updates apply to multiple products and also include fixes for third-party components By Evan Schuman Jun 18, 2026 6 mins Security Security Software Threat and Vulnerability Management Attackers abuse Google Ads, GitLab, and Claude to deliver malware Researchers tracked a seven-week campaign that leveraged trusted platforms and AI-generated trust to trick users into executing malicious commands and exposing enterprise credentials. By Nidhi Singal Jun 18, 2026 6 mins Artificial Intelligence Cybercrime Malware FortiBleed campaign exposes 75,000 Fortinet firewalls worldwide Researchers say threat actors harvested FortiGate credentials at scale, exposing organizations in 194 countries to potential long-term network compromise. By Shweta Sharma Jun 18, 2026 4 mins Cyberattacks Cybercrime Network Security Estonia plans government IDs giving AI agents rights and responsibilities What if AI agents had a government-issued ID letting others know what they are authorized to do? By Peter Sayer Jun 17, 2026 3 mins Government Government IT Identity Management Solutions Google’s Vertex AI SDK could allow RCE through bucket squatting Google reportedly patched a flaw in the Vertex AI SDK for Python that could allow attackers to hijack model uploads and trigger remote code execution across tenants. By Shweta Sharma Jun 17, 2026 3 mins Artificial Intelligence Cloud Security Vulnerabilities Microsoft says you don’t need another email security tool; experts say, not so fast New benchmark claims Microsoft Defender catches nearly all malicious email on its own, with integrated third-party tools improving detections by less than 1%, but security experts say these numbers may oversimplify the real risk. By Taryn Plumb Jun 16, 2026 6 mins Communications Security Email Security Network Security China-linked hackers target US, Canada research using legacy REDCap exploits Attackers hijacked REDCap upgrade processes to plant malware and spy on academic, healthcare, and defense research networks. By Shweta Sharma Jun 16, 2026 3 mins Cyberattacks Cybercrime Security Cisco patches SD-WAN flaw amid evidence of active exploitation Cisco’s advisory renews attention on SD-WAN management systems that control how enterprises connect sites to cloud environments and critical applications. By Prasanth Aby Thomas Jun 16, 2026 5 mins Network Security Security Vulnerabilities Langflow RCE under active attack months after a patch was shipped Actively exploited CVE-2026-5027 lets attackers write files to arbitrary locations on vulnerable Langflow servers, creating a path to remote code execution and full system compromise. By Shweta Sharma Jun 15, 2026 4 mins Artificial Intelligence Security Vulnerabilities Attackers can turn AI agent guardrails into denial-of-service weapons Researchers say a single poisoned document could slow AI agent systems by up to 148× and turn AI safety controls into an enterprise weak spot. By Gyana Swain Jun 15, 2026 5 mins Artificial Intelligence Cyberattacks DDoS GreatXML zero-day BitLocker bypass doesn’t seem to work, yet Researcher’s feud with Microsoft continues to escalate with new Windows zero-day flaw that an experience vulnerability expert says doesn’t work as advertised. By Lucian Constantin Jun 12, 2026 5 mins Endpoint Protection Windows Security Zero-Day Vulnerabilities Warrantless wiretaps cut off for a week following US Congress vote The Foreign Intelligence Surveillance Act’s warrantless wiretap provision has been suspended for the first time since 2008. By Maxwell Cooter Jun 12, 2026 2 mins Communications Security Government Markets French government’s secure messaging system breached Intruders socially engineered their way in, accessing public chat rooms but not breaking encryption. By Maxwell Cooter Jun 12, 2026 2 mins Communications Security Messaging Security Social Engineering Prompt injection breaks today’s AI agents, study warns Researchers say current AI agents fail to consistently resist prompt injection attacks, exposing enterprises to failures that conventional security testing may overlook. By Gyana Swain Jun 12, 2026 5 mins Artificial Intelligence Security Vulnerabilities Oracle PeopleSoft zero‑day fuels ShinyHunters extortion spree Attackers leveraged a critical unauthenticated RCE bug to breach higher‑ed institutions, deploy stealth remote access tools, and publish stolen data. By Shweta Sharma Jun 12, 2026 4 mins Security Vulnerabilities Zero-Day Vulnerabilities ServiceNow fixes API issue after reports of suspicious tenant activity ServiceNow says security researchers were behind activity linked to a newly patched authentication flaw, but the company continues to investigate potential exposure. By Shweta Sharma Jun 11, 2026 5 mins APIs Security Vulnerabilities China-linked recon botnet outpaces enterprise defenses Lumen links the 1,500-device JDY network to China-backed actors, warning that it rapidly maps exposed enterprise systems post-disclosure, pressuring patch timelines, and undermining IP-based defenses. By Prasanth Aby Thomas Jun 11, 2026 4 mins Botnets Cyberattacks Cybercrime GitHub finally pulls the plug on automatic install script execution for npm The change, expected in July, will likely block one of the more common attack vectors; developers are wondering what took GitHub so long, and why other repositories acted so much sooner. By Evan Schuman Jun 10, 2026 8 mins GitHub Version Control Systems Vulnerabilities CISA tells agencies to patch smarter, not harder — foreshadowing broader industry practice A new CISA directive moves federal agencies beyond severity scores and toward a risk-based patching model that prioritizes real-world exploitation, asset exposure, and attacker impact — a framework many security leaders see as the future of vulnerabi By Cynthia Brumfield Jun 10, 2026 10 mins Government IT Patch Management Software Threat and Vulnerability Management Ivanti patches critical Sentry flaws that lead to full device takeover Two vulnerabilities in the secure mobile gateway appliance allow unauthenticated attackers to bypass authentication and execute OS commands as root. By Lucian Constantin Jun 10, 2026 2 mins Network Security Technology Industry Vulnerabilities June Patch Tuesday marks a ‘new normal’ with over 200 CVEs, 32 rated ‘critical’ AI discovery is unleashing the flood of zero days and other CVEs, so enterprises should prepare for larger Patch Tuesdays in future. By John E. Dunn Jun 10, 2026 6 mins Business Intelligence Windows Security Zero-Day Vulnerabilities Microsoft feud escalates as researcher drops new Windows zero-day Exploit code for Defender bug published post-Patch Tuesday, reviving clash over uncoordinated disclosure practices. By Shweta Sharma Jun 10, 2026 4 mins Security Vulnerabilities Zero-Day Vulnerabilities Autonomous AI agents duped into leaking sensitive data in phishing test Security researchers show email-enabled agents shared AWS keys and CRM exports despite built-in safety prompts. By Prasanth Aby Thomas Jun 10, 2026 5 mins Artificial Intelligence Phishing Social Engineering 12345678910…433 Show me morePopularArticlesPodcastsVideos news Google makes Gemini 4 AI model available to a trusted few By Nidhi SingalOct 1, 20265 mins Artificial IntelligenceSecurity news Cisco SD-WAN Manager hit by zero-day admin access attack By Shweta SharmaOct 1, 20264 mins Network SecurityVulnerabilitiesZero-Day Vulnerabilities opinion Why AI agents are like the dog that pushed kids into the Seine By Etay MaorOct 1, 20266 mins Access ControlData and Information SecurityIT Governance podcast Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security podcast The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO podcast Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cybercrime video Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security video The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO video Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cyberattacks
