Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Sponsored
APIs, service accounts, and OAuth keep your stack connected. Attackers use them as entry points. Read TruffleHog's guide to catching exposed credentials before the bad guys do. Download Guide
Verisign launched a limited beta of Verisign Informed, a certificate status service that returns signed OCSP responses to counter stale revocation data, and applied for the .pki top-level domain.
Asos is investigating after thousands of app users received a notification claiming hackers had fully compromised its Snowflake instance.
OpenAI will enable its textGrain text watermark by default for ChatGPT and Codex users in the EU to comply with the EU AI Act, though its own tests show the 92% best-case detection rate falls by almost 75% once 20% of the text is changed.
Sponsored
That's because agents break tools built for humans. To govern them, you need to get clarity about the 5 sources of enterprise AI risk. Airia's State of Enterprise AI Risk [5] report explains how: * Ungoverned AI is the risk that compounds every other one * Model risk does not end at deployment * Vendor-embedded agents can access enterprise systems without
* Most organizations cannot say who approved an agent's decision, or who was responsible for the policy behind it
A critical vulnerability in Bouncy Castle for Java versions before 1.86 lets attackers spoof legitimate participants and decrypt messages within Messaging Layer Security groups. Improper certificate validation in the protocol implementation lets threat actors bypass core security objectives by presenting arbitrary credentials. Developers must upgrade to version 1.86 to enforce cryptographic binding between end-entity certificates and LeafNode signature keys.
Unauthenticated attackers are actively exploiting a pre-authentication SQL injection vulnerability in Roundcube Webmail versions 1.6.0 through 1.6.15 and 1.7.0 to execute arbitrary database commands and access sensitive data. The flaw, tracked as CVE-2026-48842, resides in the built-in virtuser_query plugin. Administrators must immediately update to versions 1.6.16 or 1.7.1, or disable the vulnerable plugin.
A critical path traversal flaw in Dell System Update (CVE-2026-86360) allowed unauthenticated remote attackers to execute code as root on PowerEdge servers using the DSU deployment tool. Dell's advisory also addressed four other high-severity DSU vulnerabilities: two that enable remote code execution (CVE-2026-63697 and CVE-2026-71168) and two that enable privilege escalation (CVE-2026-86361 and CVE-2026-86362). None have been reported as exploited so far. Admins should upgrade to DSU 2.3.0.0 or later.
Fenrisk found CVE-2026-56004 in Open Build Service's obs_scm Mercurial backend. An attacker-controlled _service revision beginning with --config could set a pre-update hook and run shell commands on the service server. A space in the value bypassed Python argparse handling of dash-prefixed arguments. Exploitation required Mercurial, a reachable HTTP(S) repository, and a successful clone. Fenrisk confirmed build.opensuse.org was vulnerable. openSUSE patched the flaw on July 2 by adding -- before the revision and recommending rejection of dash-prefixed revisions.
A 2021 Reddit glitch exposed internal removal reasons in Relay notifications. Screenshots reveal domain blocks, account bans, shadowbans, Spamurai rules, and URL inspection. Spamurai logged account age, karma, reports, ISP, email domain, browser details, language headers, TLS fingerprints, and referrers. This reproduced a Perspective API score and showed that appending two letters changed a spam score from 86% to 1%. Reddit also followed redirected URLs, scanned page content, and matched a Google Analytics ID tied to a spam ring.
Northeastern researchers and Consumer Reports captured Wi-Fi traffic from 21 vehicles through a Raspberry Pi access point, decrypted 30 companion iOS apps with mitmproxy, and found that 19 vehicles contacted at least one third party, including ad and tracking domains. Seven apps sent VINs, emails, phone numbers, or precise location to trackers, and GM's four apps shared VINs with ten companies, including Meta, Google, and Acxiom. Pairing a companion app roughly doubled a vehicle's tracker exposure on average, and of 17 manufacturers contacted, most shifted responsibility to owners. One notable exception: Honda improved its data collection practices to avoid sending precise geolocation information to a third party involved in user tracking.
Guardana is an open-source AI security verification tool for security and platform engineers. It checks code and model artifacts, live AI systems, and recorded runs. It reports what it found, what it could not verify, and what it could not check. It verifies outside the request path. Guardana is not an inline guardrail, a general SAST or CVE scanner, or a compliance certification.
doxx.net has launched ADN, a private network with peer-to-peer messaging, file transfers, custom domains, and DNS threat blocking. It blocks malicious destinations before connections and uses proof-of-work accounts without usernames, passwords, or personal data.
Coi protects host credentials and files by isolating AI coding agents such as Claude Code or Codex inside Linux system containers during autonomous sessions. The open-source tool uses Incus, a lightweight LXD fork, to grant root access, systemd, and native Docker, alongside kernel-level threat detection that automatically pauses or kills compromised containers.
The Senate passed the Health Care Cybersecurity and Resilience Act by unanimous consent. The bill moves to the House. It funds prevention, incident response, and security training. It directs HHS and CISA coordination, names ASPR as sector risk manager, and requires an HHS incident-response plan.
Jordanian authorities detained alleged ShinyHunters member Saif al-Din Khader, known as Rey. Two sources said he is helping the FBI identify other members through his devices and correspondence with a sample of stolen FBI data containing employee identities, job details, and medical and psychiatric records. The group's dark-web site disappeared after another alleged member was detained in the Netherlands.
A Claude Code agent flagged a root-level Monero miner on Ben Thompson's always-on Mac Mini after attackers exploited CVE-2026-65400, a macOS screen sharing flaw, through an internet-exposed port 5900. Thompson kept screen sharing on because headless Macs need someone to click GUI-only TCC prompts, and he found that the automatic security updates setting did not cover the point release carrying the fix. He argues that Apple's planned Full Disk Access restrictions push macOS further toward a managed device, at odds with agent-driven computing.
Google paused its Open Source Software Vulnerability Rewards Program on October 1 after automated reports flooded maintainers and engineers.
Names, addresses, and CPR numbers for about 8.8 million people were exposed after attackers accessed Denmark's Central Population Register, reportedly using a Danish company's legitimate login credentials.
Linux 7.4 will support AMD Zen 6's BTB CTX Isolation, which separates user/kernel and guest/host branch predictor contexts.
Warlock, also tracked as Longlegs and Storm-2603, targeted four Spanish- or Portuguese-speaking organizations within two months: a water utility, telecom provider, regional government, and university. The group exploits Microsoft SharePoint flaws, then uses DLL sideloading, vulnerable drivers, VS Code remote tunnels, and SYSVOL replication to spread ransomware through Active Directory.
The Pentagon says a months-long intrusion exposed records for 2.8 million living people. Stolen Defense Manpower Data Center data included Social Security numbers, addresses, demographics, and military specialties. ShinyHunters also claimed FBI employee records, including roles investigating China and Russia. Officials have not disclosed the Pentagon entry point, attacker contact, ransom demands, or evidence supporting claims of no misuse.
A KVM zero-day reported by researcher Paulos Yibelo reportedly allowed guest code to gain root on the host, breaking the Firecracker microVM boundary Vercel Sandbox uses to isolate untrusted workloads and AI agents. Vercel CEO Guillermo Rauch confirmed the bug and that the $50,000 maximum bounty was awarded, but no CVE, affected kernel versions, exploit chain, or patch have been disclosed. Operators relying on KVM for multi-tenant isolation should watch for Vercel's promised write-up and Linux vendor advisories, and should not assume the unrelated Januscape fix covers this flaw.
Truffle Security scanned 224 million public GitHub repositories and verified 543,699 working credentials in July. The median credential had been exposed for 784 days. The oldest dated to 2009. GitHub's push protection reduced leaks of recognized token types by about 53%, yet missed connection strings, private keys, and Google API keys. These accounted for 51.8% of live credentials. Revocation separated outcomes sharply: only one npm token remained active, while 11,465 Postgres strings and 69,041 Google Cloud credentials still worked.
Fastify moved about 100 repositories from manual laptop releases to GitHub Actions using npm Trusted Publishers, which replace long-lived npm tokens with short-lived OIDC tokens bound to a specific repo, workflow, and environment. Releases are triggered manually via workflow_dispatch and wait for approval from the fastify/release team in a release environment restricted to main, then published with provenance through a SHA-pinned reusable workflow. Maintainers can script the same setup with npm trust github (npm 11.15.0+) and the GitHub environments API, then remove non-admin npm publish rights.
ConfigPoisoning (CVE-2026-102437) ran attacker commands when a developer viewed a file diff in DeepSeek-Reasonix Studio, because a .gitattributes entry pointed the file at a command in a poisoned .git/config that the tool's hardened git wrapper never overrode. Since .git/config does not survive a clone, delivery needed an archive, synced folder, or CI cache, or a prompt-injected agent writing it into an already-cloned repo, and GitLab reports the same flaw class in several other coding agents under coordinated disclosure. Users should update to Studio 2.21.0 or npm 1.39.3, and builders of git-wrapping tools should override every command-executing config key on each call or read blobs with git cat-file and diff in-process.
Osavul analyzes open and privileged data to identify hostile intent targeting people, facilities, and supply chains. Analyst-reviewed assessments trace supporting evidence and run on-premises within sovereign infrastructure, keeping sensitive customer data inside customer systems.
A local web interface to inventory, audit, revoke, and create OVHcloud API keys.
Apex Flash-1 is an open-weights security research model from Cantina and Yeta Labs, a GLM-5.3-Flash fine-tune trained with GRPO reinforcement learning on 150 tasks built from 50 real vulnerability cases. It solved 40 of 60 tasks on Cantina's internal held-out eval versus 36 for the base model and 43 for Claude Opus 5 High, at an estimated $2.38 per run against $74.68, though each model ran the set only once. It is built as a worker model orchestrated by a larger one, and ships with an abliterated variant for teams running self-hosted security agents.
Proofpoint linked TA419 to credential-phishing campaigns against US policy specialists. The group spoofed Lynne Edwards Parker, Heidi Crebo-Rediker, and an Anthropic employee. Emails offered committee roles or report work, then sent victims to Cloudflare-protected pages mimicking OneDrive. Evilginx-based Browser-in-the-Browser pages targeted Microsoft 365 credentials and session cookies.
Spanish police arrested a 16-year-old in Alicante, suspected of administering KillSec. Operations across Spain, Greece, the UK, and Romania seized its leak site, five domains, five servers, and at least 110 TB of data. Investigators link KillSec to about 1,000 suspected attacks, including 500 confirmed compromises.
Apple announced that macOS will require very explicit user action to grant Full Disk Access, citing the risk of autonomous AI agents holding a permission that bypasses per-app TCC controls. The change tightens consent rather than banning FDA, and follows a disputed report of Meta's Muse agent reading a user's Messages and a ChatGPT Mac app flaw found by Objective-See. No macOS version or ship date was given for a change that touches agents like ChatGPT, Claude for Mac, and OpenClaw, which commonly request FDA.
Sponsored
Thirty-minute triage now takes 60 seconds, but a verdict nobody can check is just a suggestion. Daniel Miessler discusses the context
Epic paused most product work for about six weeks after testing found MyChart flaws.
A federal judge ruled that a Tulsa sheriff's deputy violated the Fourth Amendment by searching Flock's license plate database without a warrant, suppressing the resulting evidence in a non-binding ruling that is among the first to find a Flock search unconstitutional.
Citrix released NetScaler ADC and Gateway 14.1-73.41 and 13.1-64.28 to fix CVE-2026-88779, an exploited SAML memory overflow that it classifies as a denial of service, though researchers found a patched honeypot running downloaded malware.
Attackers are exploiting CVE-2026-73570 in Zimbra Collaboration Suite. A crafted email can trigger unauthenticated OS command execution when zimbra-snmp and SNMP notifications are enabled, and Microsoft observed web shells, reverse shells, privilege escalation, remote-access tools, email backups, and credential collection. Shadowserver found 274 compromised instances.
A single unauthenticated POST to /%6a_security_check mints an admin session on Cisco SD-WAN vManage through CVE-2026-76504, a critical authentication bypass Cisco disclosed on September 30 as an exploited zero-day. Cisco's login module checked the raw request URI while WildFly matched the decoded path, so the encoded request skipped the password check and fell into a session-continuation branch that trusted hardcoded internal usernames like viptela-reserved-cloudops. With ~1,500 vManage instances internet-exposed per VulnCheck, defenders should follow Cisco's advisory and hunt serviceproxy-access.log and vmanage-server.log for encoded j_security_check paths and viptela-reserved- usernames.
Attackers are exploiting CVE-2026-104286 as a zero-day, a CVSS 9.8 path traversal and NULL byte flaw in the FortiMail management interface that lets unauthenticated HTTP requests write arbitrary files and execute code. FortiMail 7.2.0 through 8.0.1 is affected, and fixed builds 7.4.9, 7.6.7, and 8.0.2 are not yet available, so admins should disable IBE or restrict the management interface to trusted networks. Compromise indicators include an added /data/etc/ld.so.preload and /data/lib/liblog.so, plus an archive account named archive234 pointing to 79[.]141[.]169[.]187, and CISA gave federal agencies until October 4 to triage and mitigate.
Uber faced two issues with agentic identity: its current identity model wasn't designed to account for agents acting on behalf of users, and provenance wasn't properly carried across different agents in a workflow. To address this, Uber implemented an identity system in which workflows begin by requesting a workload ID from SPIRE. That ID is then presented to a custom STS, which verifies in its agent registry that the requested agent is allowed to run on that workflow and returns a JWT with the relevant details to the workload. To simplify adoption, Uber built a standardized Agent-to-Agent client that provides an automatic, secure-by-default path.
It is pivotal to provide defenders with access to the most powerful, cyber-capable models, whether open-weight or frontier models. Instead of restricting access to these models, we should shift the paradigm to focus more on restricting attackers' access. Frontier labs should implement low-friction, cross-lab Know Your Customer (KYC) programs, do more to detect and block attackers, and publish time-to-detection-and-response metrics. Victims of AI cyberattacks should also be encouraged to share more detailed information about the attack and the attackers.
A zero-day in a third-party security product gave Bitget's attacker a foothold on August 31, 25 days before the $387.5 million theft. The attacker later planted a web shell and C2 on a second appliance and pivoted to the production wallet job server, where a custom withdrawal tool forged risk-control parameters and drained wallets in under three hours. The vendors remain unnamed, and the North Korea attribution comes only from Bitget's CEO, so the takeaway is to monitor security appliances like production hosts and enforce withdrawal risk checks outside the wallet host.
Google is releasing Argon first to trusted cyber defenders through its Fairwind Program. The model can find, validate, and patch vulnerabilities, including a healthcare flaw exposing patient data. It scored 68% on CWE-bench v1 and found exposures across 20 programming languages. Google is testing safeguards against prompt injection, misuse, and unsafe agent actions before wider access.
kunglao-agent is a Claude Code plugin for autonomous reverse-engineering tasks.
Drop allows users to create sandboxed environments that isolate programs and agents while attempting to preserve as much of the development environment (user, selected config files) as possible.
Monthly vulnerability disclosures doubled in 2026, reaching over 10,000 by midyear. High-risk flaws rose 167%, and exploited vulnerabilities averaged 18 per month, up from 10.5 in 2025. AI-discovered bugs more often enable remote code execution (50% vs 26%) and skew toward medium and low risk. Researchers saw rapid weaponization of n-days, including a BeyondTrust flaw exploited within four days of disclosure. AI-related CVEs also climbed, with 2,076 tracked since early 2025, though zero-days against AI infrastructure remain unconfirmed.