Hallucinated domain in official OpenAI skill underscores AI supply chain risks
Researchers have discovered a first-of-its-kind supply-chain vulnerability in OpenAI’s official skills repository. OpenAI maintains an official GitHub repository of skills that teach AI agents how to...
View ArticleXbow spent $40K on AI and cracked Google Chrome wide open
A chain of vulnerabilities in Google’s Chrome browser could have enabled researchers to take control of one billion Windows machines worldwide — and it cost them just $40,000 in AI compute time to...
View ArticleBank of America spent millions on anti-money-laundering tech, but not enough...
Bank of America has had to spend big on IT in response to an AI security audit and findings that its anti-money-laundering (AML) controls were lacking. The bank was fined a whopping $1.2 billion for...
View ArticleLinux kernel gets a fix for a flaw that enabled attackers to escape VMs
The Linux kernel’s networking stack was found vulnerable to a guest-to-host escape attack, in which an attacker operating inside a virtual machine (VM) could cross the isolation boundary and access...
View ArticleBeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert
Organizations running self-hosted BeyondTrust Remote Support should treat exposed appliances as potentially compromised after a suspected Chinese espionage group exploited a critical zero-day to gain...
View ArticleCyberattack AIs must be trained only on air-gapped systems, hundreds of AI...
Current security procedures for training AI models are inadequate, hundreds of AI researchers have warned governments and the AI community. They are calling for tougher rules and the establishment of...
View ArticleMalware evasion made easier with AI — but behavior still gives it away
Fresh research suggests recent panic over AI-generated malware may be overblown. Last month Anthropic detailed how Russia-linked cyberespionage group Midnight Blizzard used Claude to rebuild malware...
View ArticleNo click required: How the ad industry became a pipeline for mercenary spyware
That ad you just scrolled past on your phone but barely spared a look or click? It could be tracking your movements and collecting your data, without you having to do a thing. This “zero-click...
View ArticleTypeSafe’s Jev ‘even more susceptible to attack’ than LLMs, says security vendor
Although the Jev model rolled out last month by TypeSafe claims to have significant advantages over traditional LLMs, a security report published Wednesday argued that its streamlined approach makes...
View ArticleCisco warns of actively exploited Secure Email Gateway flaw
A critical vulnerability affecting Cisco’s Secure Email Gateway product is allowing attackers towrite arbitrary files on the underlying operating system. In an advisory issued on Wednesday, the...
View ArticleAttackers exploit Palo Alto PAN-OS flaw for root access as CISA orders...
Attackers are exploiting a newly disclosed flaw in Palo Alto Networks’ PAN-OS firewall software to run code with root privileges, and US federal agencies have been ordered to fix it and check for...
View ArticleRansomware extortion gets personal as attackers target employees’ families
Ransomware attackers are expanding their tactics beyond encrypting corporate systems and threatening to leak stolen data. They are increasingly using AI in attacks, exploiting organizations’ own AI...
View ArticleAs phishing-as-a-service goes industrial, Microsoft takes down a marketplace...
Microsoft says it has dismantled a criminal marketplace responsible for 1 billion malicious messages. Working with international authorities and several tech and cybersecurity companies in a nearly...
View ArticleHow Claude Code’s 256KB blind spot put developers’ secrets in the preview pane
Simply asking Anthropic’s Claude Code to review an HTML file could hand attackers access to a developer’s machine, cloud credentials and software development environment, according to a new Noma...
View ArticleHackers abuse the Ivanti Connect Secure bug to gain access without accounts
Attackers without an account of their own were found logging in to Ivanti Connect Secure appliances using an authentication bypass flaw that the vendor has since fixed. Once inside, attackers ran...
View ArticleUnplug your smart fridges, French supermarkets warned after cyberattack
More internet-connected refrigerators have joined the official list of those affected by a cyberattack that ruined stocks of chilled food at hundreds of French supermarkets over the weekend. The...
View ArticleCybersecurity is a leadership problem: Why the management model needs to...
When I started writing regularly about cybersecurity management in 2015, the environment looked very different. Cloud computing was still reshaping enterprise technology. Ransomware had not become the...
View ArticleAI agents aren’t ‘going rogue.’ Frontier labs are skipping security basics.
Since July, US frontier AI labs and other AI leaders have revealed a string of incidents in which their models accessed external computer systems without authorization, events popularly described as...
View ArticleOpenAI’s AI misalignment problem is growing
OpenAI’s misalignment problems seem to only be getting worse, based on yet another trio of reports detailing its models’ troubling and overzealous behaviors. In ad hoc misalignment testing, OpenAI...
View ArticleIonQ’s $1.2 billion acquisition of Elisity is trying to position it for...
When quantum vendor IonQ on Sunday announced a $1.2 billion all stock deal to take over cybersecurity vendor Elisity, it spoke of a near-term future where enterprise quantum cybersecurity needs will...
View Article
