Latest from todayChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channelCross-account task execution exposed Gmail data without user awareness, raising new concerns for enterprise AI security.By Gyana SwainSep 9, 20265 minsArtificial IntelligenceData BreachIT Governance ShinyHunters claims Florida DMV breach, puts data on the clockBy Shweta SharmaSep 9, 20264 minsCybercrimeMalwareRansomware September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in WindowsBy Howard SolomonSep 8, 20269 minsSecurityVulnerabilitiesZero-Day VulnerabilitiesCisco bundles fixes for multiple vulnerabilities, some critical, into one patchBy Taryn Plumb Sep 8, 20266 minsNetwork SecuritySecurityVulnerabilities Adobe Commerce max-severity bug comes under active attackBy Shweta Sharma Sep 8, 20264 minsSecurityVulnerabilitiesZero-Day Vulnerabilities BigBear 2.0 phishing campaign hijacks Microsoft 365 sessions after MFABy Prasanth Aby Thomas Sep 8, 20265 minsCybercrimePhishingSecurity Sam Altman calls GPT-6 Astra rollout ‘messy’ as enterprise users wait for accessBy Gyana Swain Sep 7, 20265 minsArtificial IntelligenceGenerative AIIT Governance Back-to-back N-able bugs send admins on a patching spreeBy Shweta Sharma Sep 7, 20264 minsNetwork SecurityRemote Access SecurityZero-Day Vulnerabilities New CISO appointments 2026By CSO staff Sep 7, 202625 minsC-SuiteCSO and CISOIT Governance Security experts caution MFA alone can no longer stop threat actors Current campaigns are allowing even novice attackers to scoop up authentication tokens with increasing frequency, bypassing what used to be considered foolproof protection. By Howard Solomon May 25, 2026 8 mins Access Control Authentication Multifactor Authentication Project Glasswing has uncovered 10,000 vulnerabilities: Anthropic This means organizations that still treat patching as a quarterly exercise are operating with materially more risk than they were even a short time ago, says an analyst. By Paul Barker May 25, 2026 7 mins Artificial Intelligence Security Vulnerabilities AI security needs a shift from models to systems, researchers argue Traditional guardrails fall short as agentic AI behaves more like an operating environment than software. By Gyana Swain May 25, 2026 5 mins Artificial Intelligence Security As AI speeds coding, CVE Lite CLI keeps security deliberately AI-free The OWASP-backed tool scans JavaScript and TypeScript lockfiles locally, aiming to help developers catch and remediate dependency risks before CI failures. By Shweta Sharma May 25, 2026 6 mins Artificial Intelligence Development Tools Security Google leaks details for Chromium bug that can turn browsers into bots Reported over three years ago and allegedly still not properly fixed, the vulnerability enables attacks to execute JavaScript across browser restarts. By Lucian Constantin May 22, 2026 4 mins Browser Security Endpoint Protection Security FBI warns of Kali Oauth stealers A new phishing attack platform endangers Microsoft environments. By Maxwell Cooter May 22, 2026 2 mins Cybercrime Phishing Social Engineering Police take down VPN service (this time with a good reason) But not all attempts to crack down on VPN operators are as welcome. By Maxwell Cooter May 22, 2026 2 mins Government Laws and Regulations Markets Microsoft says it’s making AI ‘safe for work’ in your browser Early adopters can now test a new version of the Edge for Business browser with added agentic AI. By Maxwell Cooter May 22, 2026 2 mins Artificial Intelligence Browser Security Endpoint Protection Google folds CodeMender into agent ecosystem amid push for AI-led AppSec Expansion beyond autonomous patching reflects growing emphasis on orchestration, governance, and enterprise trust. By Shweta Sharma May 22, 2026 4 mins Application Security Artificial Intelligence Security Critical vulnerability in Cisco Secure Workload rated at maximum severity The easily exploited hole could give an unauthenticated threat actor site admin privileges, even across tenant boundaries. By Howard Solomon May 21, 2026 4 mins Network Security Security Vulnerabilities Microsoft patches two zero-day flaws in Defender CISA has added the Microsoft Malware Protection Engine and Microsoft Defender Antimalware Platform vulnerabilities to its KEV catalog, suggesting exploitation in the wild. By Lucian Constantin May 21, 2026 3 mins Endpoint Protection Windows Security Zero-Day Vulnerabilities Unpatched ChromaDB flaw leaves servers open to remote code execution The ChromaToast vulnerability can be exploited by forcing the ChromaDB API server to fetch and load maliciously crafted AI models before authentication is checked. By Lucian Constantin May 21, 2026 5 mins Security Vulnerabilities Microsoft releases open-source tools to operationalize AI agent safety Rampart turns red-team findings into repeatable tests; Clarity documents and validates agent design assumptions before code is written. By Shweta Sharma May 21, 2026 3 mins Artificial Intelligence Code Security Security AI becoming an SOC imperative for curtailing emerging cyber threats Security experts urge cyber leaders to evolve their operations from reactive monitoring to autonomous, real-time protection. By John Leyden May 21, 2026 5 mins Artificial Intelligence Security Infrastructure Security Operations Center Microsoft is working on a patch for ‘YellowKey’ attack on Bitlocker, offers temporary fix Exploitation requires physical access, so enterprises should look to their device security policies. By Maxwell Cooter May 20, 2026 4 mins Encryption Windows Security Zero-Day Vulnerabilities Drupal admins rushing to patch maximum severity SQL injection vulnerability IT environments using Symfony and Twig also need to update. By Howard Solomon May 20, 2026 4 mins Security Vulnerabilities GitHub admits major source code leak after 3,800 internal repositories breached GitHub blamed the latest in a growing list of hacks claimed by TeamPCP on a poisoned VS Code extension. By John E. Dunn May 20, 2026 4 mins Code Security GitHub Version Control Systems SHub Reaper impersonates Apple, Google, and Microsoft in one MacOS attack chain The latest SHub macOS infostealer variant abandons Terminal-based ClickFix tactics for AppleScript execution, using fake Apple, Google, and Microsoft branding to steal credentials, crypto wallets, and sensitive user data. By Shweta Sharma May 20, 2026 4 mins Endpoint Protection MacOS Security Security Microsoft disrupts malware code-signing service used by ransomware gangs Cybercriminals paid between $5,000 and $9,000 to make their malware harder to detect on Windows, highlighting its effectiveness and a shift in how the cybercrime market operates. By Lucian Constantin May 19, 2026 3 mins Cybercrime Malware Windows Security Contractor’s public GitHub account exposed GovCloud and CISA credentials ‘This kind of exposure happens with alarming frequency,’ said an expert; here’s what CSOs and CIOs should do to protect employees’ and contractors’ GitHub repositories. By Howard Solomon May 19, 2026 6 mins Data and Information Security GitHub Version Control Systems AntV data visualization tool the latest to be hit by ongoing npm supply chain attacks The largest incident yet is a warning that developers should urgently check package security, say experts. By John E. Dunn May 19, 2026 4 mins Business Cyberattacks Enterprise GitHub scales back bug bounties, reminds users security is their responsibility too The cloud code repository asks security researchers to cut out the AI-generated noise and focus on reporting security problems that are its fault, not the fault of its users’. By Anirban Ghoshal May 19, 2026 5 mins Bugs GitHub Version Control Systems Internet Explorer may be dead, but its ghost still runs malware A legacy Windows scripting utility tied to Internet Explorer is still being used in modern malware campaigns, researchers say. By Shweta Sharma May 19, 2026 4 mins Cybercrime Malware Security Microsoft May security patch fails for some due to boot partition size glitch Consultants see the problem eating away at valuable patch resources because of a lack of Microsoft update hygiene. By Evan Schuman May 18, 2026 5 mins Endpoint Protection Security Windows Security AI cyberattackers are getting better faster Move over, Moore’s law: The difficulty of the cybersecurity defenses AI models can crack is doubling every four months or so — and that time interval is shrinking. By John E. Dunn May 18, 2026 5 mins Artificial Intelligence Security Security Practices New image-based prompt injection attack targets multimodal AI models Researchers say the technique can manipulate how vision-language models interpret both images and user prompts. By Gyana Swain May 18, 2026 5 mins Artificial Intelligence Cyberattacks Generative AI ‘Patched’ Windows bug resurfaces 6 years later as working SYSTEM-level exploit Elevation of privilege flaw in Cloud Filter driver reappears, raising concerns over regression vulnerabilities in Windows. By Shweta Sharma May 18, 2026 5 mins Endpoint Protection Vulnerabilities Windows Security Expired domain leads to supply chain attack on node-ipc npm package Attackers performed an email takeover attack on a dormant maintainer account and published new node-ipc versions containing credential stealing malware. By Lucian Constantin May 15, 2026 6 mins Cyberattacks Cybercrime Open Source Exchange Server zero-day vulnerability can be triggered by opening a malicious email Already being exploited, this is a ‘mitigate right now’ emergency, says one expert. By Howard Solomon May 15, 2026 6 mins Communications Security Email Security Zero-Day Vulnerabilities Cisco warns of an actively exploited SD-WAN flaw with max severity The authentication bypass bug (CVE-2026-20182) in Catalyst SD-WAN gives remote attackers admin access, with no workaround available. By Shweta Sharma May 15, 2026 4 mins Network Security Security Vulnerabilities AI agent finds 18-year-old remote code execution flaw in Nginx An LLM-powered system found 4 security bugs, including a critical one in the web server’s URL rewrite module. By Lucian Constantin May 14, 2026 4 mins Artificial Intelligence Security Vulnerabilities Meet Fragnesia, the third Linux kernel vulnerability in a month Called a ‘significant vulnerability,’ it’s similar to Dirty Frag; vendors are scrambling to release patches. By Howard Solomon May 14, 2026 4 mins Security Vulnerabilities FlowerStorm phishing gang adopts virtual-machine obfuscation to evade email defenses Researchers say the campaign uses a browser-based JavaScript VM to hide credential theft and intercept MFA at scale. By Gyana Swain May 14, 2026 5 mins Cybercrime Phishing Social Engineering PraisonAI vulnerability gets scanned within 4 hours of disclosure A newly disclosed authentication bypass flaw (CVE-2026-44338) in PraisonAI drew near-instant probing, exposing risks from default-insecure AI APIs. By Shweta Sharma May 14, 2026 3 mins Artificial Intelligence Security Vulnerabilities Fired employee sought AI help to hide deletion of hosting firm’s customer data Lessons learned the hard way: Criminal cases reveal holes in one company’s off-boarding processes, which allowed one person to retain access to the firm’s IT systems. By Howard Solomon May 13, 2026 7 mins Artificial Intelligence Identity and Access Management Legal Fortinet fixes two critical RCE flaws in FortiAuthenticator and FortiSandbox The company — whose recent vulnerabilities have been hit with zero-day and n-day exploits — also released three patches for flaws in FortiOS and FortiAP. By Lucian Constantin May 13, 2026 3 mins Network Security Security Vulnerabilities What happens when China’s AI catches up to Mythos? As Washington and Beijing meet this week, the gap between American and Chinese AI is narrowing — and the technology that could destabilize the world’s digital infrastructure is leaking out with potential cyber Cold War implications. By Cynthia Brumfield May 13, 2026 6 mins Application Security Cyberattacks Government Microsoft’s new AI system finds 16 Windows flaws, including four critical RCEs The agentic tool, codenamed MDASH, will open to enterprise customers in private preview in June. By Gyana Swain May 13, 2026 5 mins Endpoint Protection Vulnerabilities Windows Security Palo Alto Networks bets on identity security for autonomous AI with Idira launch The platform treats every identity as privileged, targeting risks from self-governing AI agents that legacy IAM and PAM systems struggle to control. By Nidhi Singal May 13, 2026 5 mins Identity Management Solutions Identity and Access Management Security ClickFix finds a backup plan in PySoxy proxy chains ReliaQuest observed attackers pairing ClickFix with the PySoxy proxy tool to establish redundant encrypted access paths and persistence on compromised systems. By Shweta Sharma May 13, 2026 4 mins Cyberattacks Cybercrime Malware CISA’s AI SBOM guidance pushes software supply-chain oversight into new territory The guidance gives CISOs a way to press vendors on AI transparency, but analysts say the hard part will be proving that disclosures match reality. By Prasanth Aby Thomas May 13, 2026 4 mins Artificial Intelligence IT Governance Laws and Regulations May Patch Tuesday roundup: Critical holes in Windows Netlogon, DNS, and SAP S/4HANA Admins with Dynamics 365 on-prem should also take note of a “severe” vulnerability that allows remote code execution. By Howard Solomon May 12, 2026 7 mins Business Enterprise Markets Mistral AI SDK, TanStack Router hit in npm software supply chain attack Hundreds of software packages are affected, once again threatening enterprise credentials on coders’ machines. By John E. Dunn May 12, 2026 4 mins Application Security Cyberattacks DevSecOps OpenAI introduces Daybreak cyber platform, takes on Anthropic Mythos OpenAI’s new cybersecurity platform aims to automate vulnerability detection, patch validation, and secure software development for enterprises and governments. By Nidhi Singal May 12, 2026 5 mins Artificial Intelligence Security Fake Claude Code takes the IElevator to your browser secrets Attackers are using fake Claude Code installers to deploy malware that abuses Chrome’s IElevator interface to steal protected browser data. By Shweta Sharma May 12, 2026 4 mins Cybercrime Malware Security cPanel flaw exposes enterprises to hosting supply-chain risks Attackers target hosting control panels with backdoors and SSH key abuse, turning overlooked infrastructure into entry points. By Prasanth Aby Thomas May 12, 2026 4 mins Security Vulnerabilities Linux kernel maintainers suggest a ‘kill switch’ to protect systems until a zero-day vulnerability is patched One Linux vendor likes the idea, but analysts and users view it as a two-edged sword. By Howard Solomon May 11, 2026 6 mins Security Vulnerabilities Zero-Day Vulnerabilities Google discovers weaponized zero-day exploits created with AI The 2FA bypass exploit stemmed from a faulty trust assumption, providing evidence of AI reasoning that can discover high-level logic flaws. By Lucian Constantin May 11, 2026 4 mins Cyberattacks Cybercrime Zero-Day Vulnerabilities Malicious Hugging Face model masquerading as OpenAI release hits 244K downloads The repository reached the #1 trending position on Hugging Face within 18 hours, highlighting how public AI repositories are becoming a new software supply chain attack vector. By Gyana Swain May 11, 2026 5 mins Artificial Intelligence Cybercrime Malware New ‘Dirty Frag’ exploit targets Linux kernel for root access The actively exploited flaw builds on Dirty Pipe and Copy Fail techniques to overwrite page cache and gain full system control. By Shweta Sharma May 11, 2026 4 mins Security Vulnerabilities 1…456789101112…433 Show me morePopularArticlesPodcastsVideos news Google makes Gemini 4 AI model available to a trusted few By Nidhi SingalOct 1, 20265 mins Artificial IntelligenceSecurity news Cisco SD-WAN Manager hit by zero-day admin access attack By Shweta SharmaOct 1, 20264 mins Network SecurityVulnerabilitiesZero-Day Vulnerabilities opinion Why AI agents are like the dog that pushed kids into the Seine By Etay MaorOct 1, 20266 mins Access ControlData and Information SecurityIT Governance podcast Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security podcast The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO podcast Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cybercrime video Why Email Still Works for Attackers By Joan GoodchildSep 30, 20266 mins Email Security video The Evolving CISO: AI, Leadership and the Future of Cybersecurity By Joan GoodchildSep 24, 20266 mins CSO and CISO video Why Security Debt May Be a Bigger Risk Than Security Spend By Joan GoodchildSep 10, 202616 mins Cyberattacks
