Our team won the runner-up prize of $3M at DARPA’s AI Cyber Challenge, demonstrating Buttercup’s world-class automated vulnerability discovery and patching capabilities with remarkable cost efficiency.
The winners of the AI Cybersecurity Challenge (AIxCC), Team Atlanta, won a $4m prize
Another day, another AI data exfiltration exploit. Today we talk about OpenHands, formerly referred to as OpenDevin. It’s created by All-Hands AI.
The OpenHands agent renders images in chat, which enables zero-click data exfiltration.
Simon Willison recently gave this data exfiltration attack patter...
Le Pennsylvania Office of the Attorney General a signalé une faille de sécurité des données en août 2025, qui a pu donner accès non autorisé à des informations personnelles. Les données concernées pourraient inclure des noms, des numéros de sécurité sociale et des informations médicales. L'office a...
Plainview Volunteer Fire Department suffered a data security incident on or about August 9, 2025. The investigation found suspicious activity within their network environment. A cyberattack against the Plainview Volunteer Fire Department was claimed by RansomHouse on October 1st.
A sky-high premium may not always reflect your company’s security posture
Leaders of the US Cybersecurity and Infrastructure Agency (CISA) pushed back on layoff concerns and highlighted new initiatives
The Information Commissioner has applied for a civil penalty against Optus following the 2022 data breach that exposed the personal details of 9.5 million Australians
Posted by Jann Horn, Google Project ZeroIntroduction
In early June, I was reviewing a new Linux kernel feature when I learned about the MSG_OOB feature supported by stream-oriented UNIX domain sockets. I reviewed the implementation of MSG_OOB, and discovered a security bug (CVE-2025-38236) affect...
The judiciary announced stronger protections for its case management system following reports of a major breach of sensitive court documents in multiple states
Is your phone suddenly flooded with aggressive ads, slowing down performance or leading to unusual app behavior? Here’s what to do.
Bouygues Telecom revealed the attackers stole personal data of 6.4 million customers, including contact details, contractual data and international bank account numbers
Today let’s explore Devin’s system prompt a bit more. Specifically, an interesing tool that I discovered when reading through it.
Hidden in Devin’s capabilities is a tool that can open any local port to the public Internet. That means, with the right indirect prompt injection nudge, Devin can be tri...
Introduction In early June, I was reviewing a new Linux kernel feature when I learned about the MSG_OOB feature supported by stream-oriented UNIX domain sockets. I reviewed the implementation of MSG_OOB, and discovered a security bug (CVE-2025-38236) affecting Linux >=6.9. I reported the bug to L...
In December 2019, the now defunct gaming website Unigame (maker of Hunter Online) suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 844k email addresses and salted MD5 password hashes.
Now that DARPA’s AI Cyber Challenge (AIxCC) has officially ended, we can finally make Buttercup, our CRS (Cyber Reasoning System), open source!
Le comté de Spartanburg a été victime d'une cyberattaque, ce qui a entraîné la perturbation de certains services en ligne. Les responsables du comté ont déclaré que l'attaque avait été contenue et que les services essentiels continuaient de fonctionner normalement. Le comté travaille actuellement à ...
Inotiv, Inc. a subi une faille de sécurité informatique le 8 août 2025, une enquête est en cours pour déterminer l'ampleur de l'incident. L'entreprise a pris des mesures pour contenir et remédier à la situation, mais les opérations commerciales ont été perturbées. L'incident a eu un impact temporair...
The NSA’s CAPT program, launched in 2024 with Horizon3.ai, now benefits 1000 of the 300,000 US Defense Industrial Base companies
FuturHealth, Inc. suffered a data breach where an unauthorized actor viewed and copied certain files stored within their network between August 8, 2025, and August 14, 2025. The breach involved the names and other types of personal information of some individuals. FuturHealth is offering complimenta...