Latest from todayIndia’s STPI serves TerminalFix-style attack via fake Cloudflare checkA government organization providing cloud infrastructure to Indian companies is inadvertently distributing malware.By Gyana SwainSep 11, 20265 minsCyberattacksGovernmentGovernment IT Anthropic finds evidence of a fourth AI escaping from containmentBy Maxwell CooterSep 11, 20262 minsArtificial IntelligenceCyberattacksCybercrime How AI and cybersecurity are reshaping ServiceNowBy John E. DunnSep 11, 20267 minsArtificial IntelligenceSecurity InfrastructureTechnology IndustryAttackers use passkey-themed scams to hijack Microsoft 365 accountsBy Shweta Sharma Sep 11, 20264 minsCybercrimeSecuritySocial Engineering Google’s Early Access is creating a blind spot for malicious appsBy Shweta Sharma Sep 11, 20264 minsEndpoint ProtectionMobile SecuritySecurity Attackers are weaponizing the gap between Chromium fixes and Chrome patchesBy Taryn Plumb Sep 10, 20265 minsBrowser SecurityEndpoint ProtectionVulnerabilities AI workflows may be creating a dangerous new authorization blind spotBy Gyana Swain Sep 10, 20265 minsAccess ControlAuthenticationIdentity and Access Management Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gatewaysBy Shweta Sharma Sep 10, 20264 minsCybercrimeMalwareSecurity MikroTik patches flaws currently being exploited to take over routersBy Lucian Constantin Sep 9, 20264 minsNetwork SecuritySecurityVulnerabilities UK move to filter photos and messages triggers encryption worries for CISOs Whether or not encrypted data would be put at risk comes down to one unknown: Would this analysis happen solely on the device? By Evan Schuman Jun 10, 2026 8 mins Data and Information Security Encryption Enterprise Enterprises know AI-generated code is vulnerable; they’re shipping it anyway As AI systems discover and exploit flaws at unprecedented speed, organizations are still deploying software they know contains security weaknesses. By Taryn Plumb Jun 9, 2026 6 mins Artificial Intelligence Business Enterprise Anthropic releases Mythos-class Fable 5 model with safeguards for cyber risks Claude Fable 5 brings previously restricted Mythos-class AI capabilities to general users with automated guardrails to prevent misuse — though initial testing suggests those safeguards may cast a wider cybersecurity net than Anthropic acknowledges. By Cynthia Brumfield Jun 9, 2026 7 mins Artificial Intelligence Risk Management Technology Industry Check Point warns of ransomware-linked attacks exploiting outdated VPN protocol Organizations that delayed retiring the legacy IKEv1 VPN protocol are now facing an actively exploited authentication bypass flaw that Check Point says has already been leveraged in ransomware-linked attacks. By Shweta Sharma Jun 9, 2026 4 mins Network Security Security Vulnerabilities Security shifts to the human layer as AI scams surge Separate advisories suggest familiar scams are evolving alongside enterprise AI adoption, expanding the focus from software vulnerabilities to user behavior. By Gyana Swain Jun 9, 2026 4 mins Artificial Intelligence Cybercrime Social Engineering AI worm prototype shows attackers don’t need Mythos to take over your network University of Toronto researchers demonstrate how open-weight local LLMs can be used to autonomously exploit flaws and misconfigurations typical found in most enterprise networks, feeding off abused GPUs to fuel self-replication. By Lucian Constantin Jun 9, 2026 9 mins Artificial Intelligence Cybercrime Malware Meet Hades: The malware that lies to AI security agents Researchers have uncovered a supply-chain attack that hides in Python packages, propagates like a worm, and tricks LLM-based code analysis systems into overlooking malicious payloads. By Taryn Plumb Jun 9, 2026 5 mins Cybercrime Malware Python OpenAI’s Lockdown Mode is trying to solve the problem that it created The feature reduces the possibility of data exfiltration by slashing external capabilities, but OpenAI oddly tells enterprise CISOs ‘prompt injection is not currently a major risk.’ By Evan Schuman Jun 8, 2026 9 mins Artificial Intelligence Data and Information Security Security Attackers exploiting unpatched Cisco SD-WAN flaw The vulnerability enables authenticated attackers to take over the enterprise network management system as root and may be connected to previous UAT-8616 activity. By Lucian Constantin Jun 8, 2026 3 mins Network Security Security Vulnerabilities Protocol Buffers schemas expose remote code execution risk Researchers at Cyera found six vulnerabilities in protobuf.js, including a flaw that can turn attacker-controlled schema data into executable code and expose downstream software supply chains. By Shweta Sharma Jun 8, 2026 4 mins Security Vulnerabilities HTTP/2’s speed abused to slow webserver performance in DoS attack Researchers disclose an HTTP/2 denial-of-service technique affecting major web servers after AI-assisted analysis uncovered a flaw linked to HTTP/2 configurations. By Shweta Sharma Jun 8, 2026 4 mins Browser Security Cyberattacks DDoS Ukraine’s foreign minister offer recipe for improved resilience There may be more important projects than preparing for something that might not happen, Dmytro Kuleba told Infosecurity Europe attendees. “But if you care for your company, if you care for your country, you have to prepare for the worst.” By John Leyden Jun 8, 2026 4 mins Business Continuity Incident Response Security Practices Microsoft identifies seven new ways AI agents can be hacked The more you look at AI agents, the more it seems can go wrong with them, so Microsoft has extended its taxonomy of failure modes to help with discussion of possible fixes. By Maxwell Cooter Jun 5, 2026 2 mins Artificial Intelligence Cyberattacks Cybercrime Patching fast and slow: Ruby devs delay to defend against supply chain attack Installing the latest software updates is often advised — but sometimes it’s safer to sit back and wait. By Maxwell Cooter Jun 5, 2026 2 mins Code Security Development Tools Security Malware could drain your fuel tank as well as your bank account Automatic tank gauges are a ripe target for cyber attackers, CISA warns. By Maxwell Cooter Jun 5, 2026 2 mins Energy Industry Manufacturing Industry Markets AI tools becoming hot commodities on ransomware marketplaces Offers of weaponized and abused AI capabilities have erupted across underground ransomware forums, while criminal operators increasingly adopt vendor-like business models. By John Leyden Jun 5, 2026 5 mins Cybercrime Malware Ransomware US government report slams NIST for NVD backlog “NIST’s lack of strategic planning and decisive action have allowed the backlog of unprocessed vulnerabilities to continue growing,” says the Commerce department inspector general. By Evan Schuman Jun 4, 2026 8 mins Government Markets Vulnerabilities OpenAI responds to White House executive order on AI governance The company is willing to have its frontier AI models evaluated by federal experts before release, but it wants AI developers, not regulators, to have the final word on which models are deployed. By Gyana Swain Jun 4, 2026 5 mins Government IT Governance Markets Hugging Face Transformers RCE flaw enables stealthy compromise via AI model configs With over 2.2 billion installs, the flawed Python package offers attackers a huge blast radius, including silent access to high-value enterprise users running GPU-accelerated inference. By Lucian Constantin Jun 4, 2026 7 mins Artificial Intelligence Python Vulnerabilities Beware the ‘son of Mythos,’ security experts warn As access to vulnerability discovery tools from Anthropic and OpenAI expands, Infosecurity Europe speakers warn of the next wave of frontier AI models on the near-term horizon. By John Leyden Jun 4, 2026 4 mins Artificial Intelligence Security Software Threat and Vulnerability Management Hole in GitHub’s browser-based VSCode editor could lead to stolen token Its disclosure raises questions about what security researchers should expect from vendors, and how far in advance of its publication they should notify vendors about a bug. By Howard Solomon Jun 3, 2026 7 mins Browser Security Endpoint Protection GitHub Microsoft wants to put AI agents on a short leash At Build 2026, Microsoft unveiled a new containment framework for autonomous AI agents, expanded its MDASH vulnerability research platform, and introduced open-source governance tools, all aimed at securing the agentic software development lifecycle. By Shweta Sharma Jun 3, 2026 4 mins Artificial Intelligence Data and Information Security Security Anthropic grants Project Glasswing access to 150 more companies, with a focus on critical infrastructure As the number of vulnerabilities identified soars, analysts see a patch development bottleneck as the big problem; vendors can’t keep up now. By Evan Schuman Jun 2, 2026 7 mins Artificial Intelligence Security Two-year old Oracle WebLogic Server vulnerability is being exploited Its inclusion in the US CISA catalog of known exploited vulnerabilities is a warning to admins that patching is needed now. By Howard Solomon Jun 2, 2026 6 mins Cyberattacks Cybercrime Vulnerabilities HP Poly VoIP vulnerability sets the stage for executive voice deepfakes The remote code execution flaw enables root access and voice attacks on HP Poly VoIP phones, including eavesdropping and the ability to collect audio to generate deepfakes. By Lucian Constantin Jun 2, 2026 4 mins Security Vulnerabilities Trump revives parts of canceled AI order with cybersecurity-focused directive Less than two weeks after canceling a broader AI executive order, the White House issued a directive focused on cybersecurity, critical infrastructure, and cooperation on advanced AI systems. By Cynthia Brumfield Jun 2, 2026 8 mins Government Government IT Laws and Regulations Infected Red Hat npm packages expose developer credentials Researchers have uncovered a new Shai-Hulud malware variant that now also gathers Google Cloud and Azure identities, an addition to its previous credential-snatching behavior. By Shweta Sharma Jun 2, 2026 4 mins Cybercrime Malware Security Attackers exploit Palo Alto GlobalProtect flaw days after disclosure The credential-less authentication bypass offers attackers a stealthy route into enterprise networks without malware, phishing, or stolen credentials. By Gyana Swain Jun 2, 2026 5 mins Security Vulnerabilities Attack targeting OpenAI Codex users exposes AI software supply chain risks The incident highlights how attackers can hide malicious code in software packages that differ from the source code available for review. By Prasanth Aby Thomas Jun 2, 2026 4 mins Artificial Intelligence Development Tools Vulnerabilities Oracle’s first monthly patch release fixes 35 flaws, including 11 rated ‘critical’ New Critical Security Patch Update (CSPU) addresses urgent vulnerabilities ahead of quarterly updates. By John E. Dunn Jun 1, 2026 3 mins Open Source Security Vulnerabilities Flowise’s MCP implementation can run ghost commands A 9.9-severity vulnerability in Flowise’s MCP stdio implementation can allow attackers to achieve remote code execution in self-hosted deployments. By Shweta Sharma Jun 1, 2026 4 mins Artificial Intelligence Security Vulnerabilities Russia-aligned crime group Greyvibe extensively uses AI in attacks WithSecure concludes that the Greyvibe group used LLMs to generate custom malware, backend infrastructure and phishing lures in order to target organizations in Ukraine as part of Russian intelligence gathering efforts. By Lucian Constantin May 29, 2026 4 mins Cybercrime Generative AI Malware Microsoft and security researcher’s dueling posts about cybersecurity disclosures get nasty They pit ‘do not tell the attackers what they don’t know’ against the slow response time after disclosure by many vendors. By Evan Schuman May 29, 2026 7 mins Security Vulnerabilities DNS-AID will make AI agents easier to discover, says Linux Foundation The proposed DNS extension underscores the importance of communication with and between AI agents. By Maxwell Cooter May 29, 2026 2 mins Artificial Intelligence Identity and Access Management Security Certifiably random: Swiss researchers claim perfect random number source The randomness in quantum physics is imperfect and needs amplification to be considered truly random, the researchers say. By Maxwell Cooter May 29, 2026 2 mins Communications Security Data and Information Security Encryption Notepad++ vulnerabilities could enable arbitrary code execution on Windows systems Two flaws in the widely used open-source editor can be triggered through manipulated configuration files, prompting security updates from the project’s maintainers. By Gyana Swain May 29, 2026 4 mins Security Vulnerabilities The Gentlemen are coming for your files, and then your network Microsoft’s analysis of the Gentlemen ransomware reveals a Go-based encryptor capable of spreading across networks, helping operators expand attacks beyond the initially compromised system. By Shweta Sharma May 29, 2026 4 mins Cybercrime Malware Ransomware GDPR set the tone for regulatory action — and the AI fine pushback to come With just 60% of fines paid to date and AI laws on the horizon, the EU’s landmark data protection law has raised the bar for cybersecurity and exposed weaknesses regulations have in court. By John Leyden May 29, 2026 6 mins GDPR Government Laws and Regulations IBM and Red Hat want to become the ‘security clearinghouse’ for open source applications in the enterprise The $5 billion Project Lightwell initiative combines AI systems with 20,000 engineers to deliver validated fixes directly into enterprise software supply chains without disruptive upgrades. By Taryn Plumb May 28, 2026 6 mins Application Security Open Source Security Lack of response to critical vulnerability in Gogs is a reminder of the limits of open source projects Two months after Rapid7 discovered the hole in the Git service, the project maintainer has yet to patch the bug. By Howard Solomon May 28, 2026 5 mins Open Source Security Vulnerabilities Indian CERT urges firms to contain exploited internet-facing flaws within 12 hours The cyber agency is pushing aggressive remediation windows, continuous exposure management, and AI governance controls in what analysts say could preview future global standards. By Gyana Swain May 28, 2026 5 mins Artificial Intelligence Laws and Regulations Security GlassWorm falls, but the repo problem is far from solved CrowdStrike, Google, and the Shadowserver Foundation dismantled the GlassWorm malware operation, but experts say the broader chaos unfolding across open-source ecosystems is making isolated takedowns feel increasingly temporary. By Shweta Sharma May 28, 2026 4 mins Cybercrime Malware Security Employees are unknowingly inviting tech support impersonators into firms, says FBI The warning is a sign to CSOs that training on physical as well IT security awareness is vital to protect enterprises from data theft. By Howard Solomon May 27, 2026 8 mins Fraud Phishing Social Engineering Another IT governance headache: AI-enabled sanction evasion A new report from RUSI focuses on how AI models are enabling regimes such as North Korea and Iran to execute cyber operations while evading detection. By Paul Barker May 27, 2026 7 mins Artificial Intelligence Cybercrime IT Governance AI models more vulnerable than claimed when faced with iterative attacks Cisco researchers show how leading AI models wither under realistic multi-turn attacks, calling into question the value of vendors’ single-prompt safety benchmarks. By Lucian Constantin May 27, 2026 5 mins Artificial Intelligence Cyberattacks Risk Management FastAPI-based AI tools exposed to authentication bypass by flaw in Starlette framework Researchers who found the bug warn that its Moderate rating understates a threat reaching across LLM gateways, MCP servers and agent infrastructure. By Gyana Swain May 27, 2026 5 mins APIs Artificial Intelligence Vulnerabilities Microsoft previews automatic device isolation in Defender for Endpoint The new capability will be added to the automatic attack disruption tool, however, new research warns that the tool has to be tuned to avoid it becoming an attack vector. By Howard Solomon May 26, 2026 7 mins Cyberattacks Cybercrime Endpoint Protection GitHub Actions abused by Megalodon attack to slip malicious commits into 5,500 repos Researchers say the campaign abused compromised access tokens and deploy keys to inject malicious GitHub Actions workflows into thousands of public repositories. By Shweta Sharma May 26, 2026 3 mins Code Security GitHub Malware TrapDoor malware campaign puts developer workstations in CISO spotlight Malicious packages across npm, PyPI, and Crates.io show how poisoned developer workflows can become a route into enterprise systems. By Prasanth Aby Thomas May 26, 2026 4 mins Code Security GitHub Malware Vulnerabilities have become cyber attackers’ No. 1 door to the enterprise Your patch management strategy may need an overhaul, as flaw exploitation significantly outpaces credential abuse as the primary vector in 31,000 incidents analyzed by Verizon’s DBIR. By John Leyden May 26, 2026 7 mins Cyberattacks Patch Management Software Threat and Vulnerability Management 1…34567891011…433 Show me morePopularArticlesPodcastsVideos news Google makes Gemini 4 AI model available to a trusted few By Nidhi SingalOct 1, 20265 mins Artificial IntelligenceSecurity news Cisco SD-WAN Manager hit by zero-day admin access attack By Shweta SharmaOct 1, 20264 mins Network SecurityVulnerabilitiesZero-Day Vulnerabilities opinion Why AI agents are like the dog that pushed kids into the Seine By Etay MaorOct 1, 20266 mins Access ControlData and Information SecurityIT Governance podcast Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security podcast The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO podcast Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cybercrime video Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security video The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO video Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cyberattacks
