AI agents using LLMs can boost security productivity by 1,000x in tasks like vulnerability patching, but need strict implementation with permissions, transparency, and security controls to prevent hallucinations and data leaks. Security professionals should adopt a "yes with guardrails" approach: automate low-level tasks such as CSV processing and ticket creation while maintaining evidence validation, treat MCP servers as APIs with proper authentication, and ensure vendor AI products don't share data externally. Focus on upskilling teams in AI tools for multiplication, ask critical questions on permissions and data flows before deployment, and keep source code visible for all AI implementations.
Sponsored
Dropzone AI [11] becomes your team's intelligent partner - autonomously investigating alerts, surfacing critical insights, and accelerating decision-making. From 40-minute investigations to 3-minute conclusions. No playbooks required. Just seamless
DllShimmer parses DLLs and extracts information about exported functions (name, ordinal number, and forwarder info) and creates a boilerplate C++ file (.cpp) based on this information. The generated file allows you to add your own code to each function exported from the original DLL without disrupting the normal operation of the program.
Wallarm offers a unified platform for API and AI security, providing real-time attack blocking, abuse detection, and advanced penetration testing for AI through intelligent agents.
Certipy is a tool to enumerate and assess Active Directory Certificate Services (AD CS) for misconfigurations.
Security researchers found malicious npm packages "solana-pump-test" and "solana-spl-sdk" posing as Solana SDK components but stealing cryptocurrency data from Russian developers. These infostealers send data to US servers, suggesting possible state-sponsored activity targeting Russia's ransomware ecosystem relying on cryptocurrency. The attacker, using the handle "cryptohan," promotes these packages that expose password files, exchange credentials, and wallet data from infected systems.
The U.S. Department of Justice confiscated more than $2.8 million in cryptocurrency, $70,000 in cash, and a luxury car from Ianis Aleksandrovich Antropenko. He is accused of participating in the Zeppelin ransomware scheme from 2019 to 2022. Antropenko faces charges of computer fraud and conspiracy to launder money, having processed funds through ChipMixer while targeting healthcare and IT companies worldwide. The Zeppelin ransomware operation ended in November 2022, and its source code was later sold for only $500 on a hacking forum in January 2024.
A federal class-action lawsuit accuses Otter.ai of violating privacy laws by secretly recording and using meeting participants' voices to train its AI without consent, particularly affecting non-account holders who join virtual meetings. The Otter Notetaker bot can automatically join meetings linked to workplace calendars and record all participants, with the lawsuit citing cases where sensitive business discussions were inadvertently captured and shared. With 25 million users and over 1 billion meetings processed, the case could set a precedent for AI transcription services' consent requirements and data usage practices.
Cybercriminals are using phishing kits to hijack brokerage accounts and coordinate “ramp and dump” schemes by inflating foreign stock prices with compromised accounts after failing to cash out funds directly.
Nuance, owned by Microsoft, agreed to pay $8.5 million to settle a lawsuit after hackers exploited the MOVEit software, exposing the data of over 1.2 million people.
PipeMagic is a malicious backdoor disguised as an open-source ChatGPT desktop app that facilitates ransomware operations.
Sponsored
The corporate firewall is a relic of bygone times. With employees working from coffee shops, airports, and home networks, traditional perimeter security leaves your endpoints exposed to unmanaged devices and compromised networks.
Complete source code for Android banking Trojan ERMAC 3.0 leaked from an open directory, revealing a Malware as a Service (MaaS) infrastructure targeting over 700 banking, shopping, and cryptocurrency apps. The leak exposed critical security flaws, including hardcoded JWT secrets, static admin tokens, and default credentials in the malware's PHP/Laravel backend and React frontend. ERMAC 3.0 features enhanced form injection methods, AES-CBC encrypted communications, and a Kotlin-based Android backdoor that avoids infecting devices in countries in the Commonwealth of Independent States (CIS).
Plex has reached out to some of its users and urged them to update their Plex Media Server installation due to a recently patched security vulnerability. Plex has not assigned a CVE to the vulnerability or released details yet, but has stated that it was discovered via the Plex bug bounty program.
The Warlock ransomware gang targeted the UK telecommunications firm Colt, causing disruptions to its online and voice services. In response, Colt took its systems offline, resulting in service interruptions, and is currently in the process of restoring operations. The attackers have claimed to have stolen sensitive data, potentially exploiting a flaw in Microsoft SharePoint.
Website typo protection is an automatically enabled, typosquatting protection in Microsoft Edge. Upon typing a misspelling of a common domain in Edge, the user will get a notification of the potential typo, and the address bar will include a “Not Secure” badge (similar to when visiting a website without HTTPS). This post provides details for configuring protection if it isn't enabled and includes screenshots of the notifications.
In preparation for the creation of a Cryptographically Relevant Quantum Computer (CRQC), NIST selected three post-quantum (PQ) cryptographic standards. This post details how to test hybrid TLS, where classical keys are used in combination with PQ ML-KEM keys, in Python on AWS. boto3, the Python SDK for AWS, relies upon the Python `ssl` module, which in turn relies on OpenSSL, which added support for hybrid TLS in version 3.5.
This article explains how to achieve end-to-end encryption of credit card data in Kafka without changing any application code, using the Kroxylicious proxy. This solution simplifies PCI compliance and data protection by encrypting messages transparently, minimizing disruption to existing systems and workflows.
Sponsored
If you're leading governance, risk and compliance, you're under constant pressure: security reviews, audits, vendor questionnaires -
streamlines the entire GRC workflow. Security questionnaires? Automated. Evidence collection? Continuous. Risk management? Built in.
An eBPF-based Linux kernel framework disrupts DNS-based C2 channels and tunneling through high-speed deep packet inspection in the kernel stack. It features a userspace deep learning model for detecting obfuscated DNS payloads, dynamic blacklisting, and real-time threat intelligence. It also provides kernel-level DNS exfiltration prevention with access control and threat event streaming.
Rust Interactive Function Tool (RIFT) is a tool to assist reverse engineers in identifying library code in Rust malware.
Approv provides runtime protections to secure devices, apps, APIs, and the channels used to communicate with the cloud, as well as real-time threat analytics to deliver visibility into mobile application security.
Russian threat actor EncryptHub is exploiting patched Windows vulnerability CVE-2025-26633 via social engineering and malicious MSC files to deploy Fickle Stealer malware and backdoors. The group uses fake IT support requests, a compromised Brave Support platform, and fake videoconferencing to gain control. Attacks feature encrypted C2, persistence, and evasion techniques like fake browser traffic.
State Department documents with sensitive details about the August 15 Trump-Putin summit were left in an Alaskan hotel's printer. The eight pages revealed meeting locations, times, and phone numbers of U.S. government employees involved in the summit at Joint Base Elmendorf-Richardson. Guests found the papers, photographed them, and reported the breach.
Vulnerabilities in home solar inverters pose cybersecurity risks, potentially exposing the power grid to attacks. Lax industry security, regulatory gaps, and widespread adoption have made these devices a national concern, highlighting the complexity of securing modern, distributed energy networks
A critical remote code execution vulnerability (CVSS 10) in Cisco's Firewall Management Center via RADIUS permits unauthenticated remote code execution when RADIUS authentication is enabled - apply patches immediately.
Italian authorities confirm a major breach affecting at least 10 hotels with nearly 100,000 records for sale, including high-resolution passport and ID scans stolen via a booking system breach between June and August.
Anthropic has updated its paid Claude Opus 4 and 4.1 AI models to terminate conversations if harm or abuse is detected, a feature most users will rarely encounter.
Sponsored
SASE leads the enterprise IT security market. But some vendors are just rebranding point products as a “platform” to stay competitive. That's not SASE—it's complexity, gaps, risk, and a career liability.
Matrix Foundation identified two high-severity vulnerabilities (CVE-2025-49090 and CVE-2025-54315) that allow attackers to hijack creator privileges or predict room addresses, disrupting communications used by government and military groups. These flaws affect federated Matrix servers (external servers - internal ones are unaffected) and were fixed in Room Version 12. Administrators are urged to upgrade immediately and restrict access to trusted servers. No exploits have been observed in the wild.
Manpower, one of the world's largest staffing companies, is notifying nearly 145K individuals that attackers stole their data in a December 2024 attack. The stolen data includes passports, IDs, SSNs, addresses, contact information, corporate communications, financial statements, HR data, and confidential contracts and NDAs. The RandomHub ransomware group stole the data, but the data has since been removed from its website, suggesting that the ransom may have been paid.
Fortinet is warning of a new critical (CVSS 9.8/10) pre-auth remote code execution vulnerability affecting multiple branches of FortiSIEM. The vulnerability is an OS command injection caused by “improper neutralization of special elements.” Fortinet has also stated that working exploit code is publicly available and urges immediate remediation.
Kubernetes clusters use a flat network that allows all pods to communicate, which poses security risks. To secure the network, deploy CNI plugins like Calico or Cilium that support policies, then set default-deny ingress/egress rules, allowing only necessary traffic between pods and namespaces. Essential measures include restricting host networking, shielding cloud metadata from pod egress, and testing network policies with application manifests before production.
2025.08.15·securitylabs.datadoghq.com·8 min read·TLDR InfoSec Security budgets are slowing to 4% YoY growth, the lowest in five years, driving understaffed teams and delayed initiatives. Pressure stems from geopolitics, tariffs, and macroeconomics. Budgets are tightest in healthcare, services, retail, and hospitality, while finance, insurance, and tech still grew more than 5% by prioritizing cloud, IAM, SecOps automation, and zero trust.
Depot had an arduous process in which developers needed to spend hours maintaining arm64 versions of GitHub Actions runners. The team first developed a workflow in which Claude first attempted to apply the Depot team's patch file and then cyclically modified it until it applied successfully without removing any existing patches. The second workflow involved Claude tracking upstream changes, summarizing them, and highlighting any breaking changes.
Sponsored
The mega-deal validates identity as security's new pillar [11], but also exposes the limits of current solutions. Legacy PAM creates security gaps between login and action - forcing organizations to invest in sprawling, fragmented identity tools. The solution: Identity security transformation that moves beyond static vaults to a Zero Trust approach securing what happens AFTER login. StrongDM: Leave your
Veles is Google's new open-source secret scanner. Built as a standalone module within the OSV-SCALIBR ecosystem, it was designed to detect leaked credentials in source code and artifacts. It currently supports the detection of GCP API keys, GCP service account keys, and RubyGems API keys. Veles is actively used at Google to scan internal repositories and powers credential detection for deps.dev's hundreds of millions of open-source packages. The tool will be integrated into Google Cloud services, including Artifact Registry and Security Command Center, with a future roadmap including expanded secret detection types, automated validation, and remediation workflows.
Vendetect is a CLI tool for automatically detecting censored and copy/pasted code between repositories.
ReconPro is a specialized web reconnaissance tool designed for cybersecurity professionals and bug bounty hunters. It provides instant access to carefully curated Google dorks organized by vulnerability type and risk level, significantly accelerating the initial reconnaissance phase of security assessments.
Charon is a new ransomware targeting Middle East public sector and aviation organizations using advanced persistent threat tactics, including DLL side-loading, process injection, and EDR evasion techniques similar to China-linked Earth Baxia operations. The ransomware employs partial file encryption with Curve25519/ChaCha20, network propagation capabilities, and includes a dormant Dark-Kill driver for disabling security tools via BYOVD attacks. The targeted nature of attacks, evidenced by victim-specific ransom notes, highlights the concerning convergence of APT-level sophistication with ransomware operations.
SquareX researchers showed a passkey bypass that doesn't break cryptography but manipulates the WebAuthn flow via JavaScript injection. By tricking users into installing a malicious browser extension or exploiting site XSS, attackers can hijack registration/authentication, impersonate users, or force password fallback—even with Face ID—by forging WebAuthn API calls in the browser.
In this conference talk, Balaji Sundara introduces the concept of agentic AI systems as a self-prompting, self-correcting, and self-balancing orchestration system. Sundara suggests a multi-pronged defense model that includes proactive measures like secure design principles, reactive measures such as rollback for flawed decisions, and detective measures such as human-in-the-loop monitoring. He also stresses that APIs underpin AI agents and, therefore, agentic systems inherit existing API issues and defenses.
Microsoft's new Pull Print for Universal Print lets users securely release print jobs at any registered printer with QR code authentication, preventing confidential documents from being left unattended.
Microsoft released development code in July and August 2025 Windows updates, causing harmless Event Viewer errors about the Pluton Cryptographic Provider that administrators can ignore.