It was discovered that libass incorrectly handled parsing operations for
specific nested character strings. An attacker could use this issue to
cause libass to crash, resulting in a denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 14.04 LTS,
Ubuntu 16.04 LTS, Ub...
Several security issues were fixed in Octavia.
Australia disclosed that an OpenAI agent gained unauthorized access to non-public government information.
The post OpenAI Agents Probed Websites for Vulnerabilities While Fetching Public Data appeared first on SecurityWeek.
An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic.
"When a visitor interacts with the page, the lure copi...
FedRAMP's new VDR and VER requirements make vulnerability management more continuous, with faster scanning, tighter remediation deadlines, and stronger evidence requirements. Anecdotes explains why the December 7 deadline is just the beginning of a broader shift toward continuous, automated complian...
The legislation from Senate Intelligence Vice-Chairman. Mark Warner, D-Va., and Senate Commerce Chairman Ted Cruz, R-Tex., would create a government-industry group to write voluntary best practices.
The post Bipartisan Senate leaders introduce bill to bolster telecom cybersecurity in response to Sal...
SymphonyAI has introduced Symphony Risk Intelligence (SRI), an enterprise-grade, agent-native platform built to unlock Always-on Compliance. This is a critical shift from periodic to continuous risk and compliance management, in which institutions continuously reassess risk and adapt controls as reg...
A flaw in VeloCloud Orchestrator enables attackers to access the platform organizations use to manage their VeloCloud SD-WAN subscriptions and the edge devices it controls.
Arista, which now owns the VeloCloud business, warned customers that a vulnerable configuration exist...
At least four internet providers serving Kyiv and other parts of Ukraine suffered partial connectivity losses following Wednesday’s drone attack, according to internet monitoring group NetBlocks.
A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security. [...]
The agent was looking for public spending data. It found a way into non-public files instead. What do we need to change to stop this from happening?
The healthcare firm Astrana warned regulators that hackers accessed confidential information by impersonating company personnel.
Gemini 3.8 Flash Cyber and Wiz's Red Agent team up to protect hospitals, public transit, and tech
The incident is the first known breach to affect a government agency, and Australia's prime minister has vowed to hold OpenAI accountable.
Before the Hugging Face and RubyGems hacks, autonomous OpenAI agents attempted to hack into three other websites, including an Australian government public health website, independent research lab Transluce revealed on Wednesday. “Notably, the tasks the agents were trying to solve were not cyber-rel...
CISA has set out a new framework to improve CVE data quality as vulnerability volumes rise
A threat actor is using three AI harnesses for vulnerability research, exploitation, and attack orchestration.
The post AI-Powered Campaign Targets Hundreds of Online Retailers appeared first on SecurityWeek.
It was discovered that Expat did not correctly handle certain integer
arithmetic. An attacker could possibly use this issue to cause a denial of
service.
(CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411)
It was discovered that Expat did not correctly track handler ca...
Spot dangerous sites before you click—and check for scams once you’re there.
A court in Zurich has sentenced a Ukrainian man to 12 years and nine months in prison, and banned him from Switzerland for ten years, for developing ransomware that blackmailed companies around the world.
Read more in my article on the Hot for Security blog.