Cisco warns of actively exploited Secure Email Gateway flaw
A critical vulnerability affecting Cisco’s Secure Email Gateway product is allowing attackers towrite arbitrary files on the underlying operating system. In an advisory issued on Wednesday, the...
View ArticleAttackers exploit Palo Alto PAN-OS flaw for root access as CISA orders...
Attackers are exploiting a newly disclosed flaw in Palo Alto Networks’ PAN-OS firewall software to run code with root privileges, and US federal agencies have been ordered to fix it and check for...
View ArticleRansomware extortion gets personal as attackers target employees’ families
Ransomware attackers are expanding their tactics beyond encrypting corporate systems and threatening to leak stolen data. They are increasingly using AI in attacks, exploiting organizations’ own AI...
View ArticleAs phishing-as-a-service goes industrial, Microsoft takes down a marketplace...
Microsoft says it has dismantled a criminal marketplace responsible for 1 billion malicious messages. Working with international authorities and several tech and cybersecurity companies in a nearly...
View ArticleHow Claude Code’s 256KB blind spot put developers’ secrets in the preview pane
Simply asking Anthropic’s Claude Code to review an HTML file could hand attackers access to a developer’s machine, cloud credentials and software development environment, according to a new Noma...
View ArticleHackers abuse the Ivanti Connect Secure bug to gain access without accounts
Attackers without an account of their own were found logging in to Ivanti Connect Secure appliances using an authentication bypass flaw that the vendor has since fixed. Once inside, attackers ran...
View ArticleUnplug your smart fridges, French supermarkets warned after cyberattack
More internet-connected refrigerators have joined the official list of those affected by a cyberattack that ruined stocks of chilled food at hundreds of French supermarkets over the weekend. The...
View ArticleCybersecurity is a leadership problem: Why the management model needs to...
When I started writing regularly about cybersecurity management in 2015, the environment looked very different. Cloud computing was still reshaping enterprise technology. Ransomware had not become the...
View ArticleAI agents aren’t ‘going rogue.’ Frontier labs are skipping security basics.
Since July, US frontier AI labs and other AI leaders have revealed a string of incidents in which their models accessed external computer systems without authorization, events popularly described as...
View ArticleOpenAI’s AI misalignment problem is growing
OpenAI’s misalignment problems seem to only be getting worse, based on yet another trio of reports detailing its models’ troubling and overzealous behaviors. In ad hoc misalignment testing, OpenAI...
View ArticleIonQ’s $1.2 billion acquisition of Elisity is trying to position it for...
When quantum vendor IonQ on Sunday announced a $1.2 billion all stock deal to take over cybersecurity vendor Elisity, it spoke of a near-term future where enterprise quantum cybersecurity needs will...
View ArticleOctober Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged,...
Microsoft released a record-shattering 1,407 CVEs to be plugged today on October Patch Tuesday, breaking the 2020 record of 1,261. The list was so long that its release was several hours later than...
View ArticleGitLab patches a max-severity regex flaw alongside five high-severity bugs
GitLab just fixed a max-severity vulnerability that could allow unauthenticated attackers to execute arbitrary code on its servers. The company released a fix on Monday, alongside patches for five...
View ArticleOver 1,500 npm packages exposed by Trusted Publishing validation flaw
A flaw in npm’s Trusted Publishing mechanism could allow attackers to hijack legitimate software packages by reclaiming abandoned GitHub repository names, potentially exposing millions of package...
View ArticleThese ARE the droids you’re looking for
There’s an old leadership fantasy that goes something like this: The CISO surveys a sprawling technology estate, discovers 11 tools doing the work of four, calculates the licensing savings, selects a...
View ArticleResearchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ prompt
Researchers have tricked six widely used AI agent frameworks into running tool calls written by an attacker, simply by asking the underlying model to repeat the call back. The technique, which the...
View ArticleThe 7 biggest issues CISOs and security teams face today
Year after year CISOs see the volume, velocity, and sophistication of attacks increase. They also see their attack surfaces expand and increase in complexity. Advances in artificial intelligence and...
View ArticleLightwell project filters out 400 Java library vulnerabilities
Lightwell, the open-source security initiative set up by IBM and Red Hat, has identified more than 400 previously undiscovered vulnerabilities in widely used Java libraries — and now the companies are...
View ArticleRansomware consultant said he would decrypt data, is accused of paying...
The owner of a ransomware remediation company is facing trial for defrauding customers. Zohar Pinhasi, also known as “Zack Silver” and “Zack Green,” has been arraigned in New York on wire fraud...
View ArticleOpenAI reports three new incidents of misalignment
OpenAI continues to report incidences of “misaligned” behavior by its AI models, with three new reports dropping on Oct. 2. However, they describe relatively minor issues compared to previous...
View Article
