> TODAY'S SUMMARY (2 articles)
Today's cybersecurity news highlights critical threats in the software supply chain and the rising risks associated with AI technologies. Attackers have exploited OpsShield's trusted update channel, demonstrating vulnerabilities in software supply chains that could compromise user security. Meanwhile, financial institutions, such as Bank of America, are warning customers against sharing sensitive banking information with AI assistants, emphasizing the potential for significant financial risks. These developments underline the urgent need for enhanced security measures in both software development and user interactions with AI.
|
// AI-powered summary generated at 04:00
RatHat's C2 panel now builds malware and ranks victims with AI across nearly 100 deployments
Meta-spotted flaw could hand attackers arbitrary code execution via a maliciously crafted file
It was discovered that FreeIPMI incorrectly handled certain malformed
Fujitsu SEL long-text responses, leading to a stack-based buffer
overflow. An attacker in control of a malicious IPMI device could
possibly use this issue to cause FreeIPMI to crash, resulting in a denial
of service, or possibly e...
Kiteworks on Monday said it worked with federal intelligence authorities over the weekend as it identified and addressed a critical security vulnerability during the scheduled precautionary shutdown.
"During the shutdown, this activity led to the discovery of a previously unknown critical vulnerabi...
The company said it found and patched a previously unknown critical vulnerability in one product during the weekend shutdown, and has no indication it was exploited.
The post Kiteworks lifts shutdown advisory after ‘credible threat intelligence’ from federal authorities appeared first on CyberScoop.
Pentagon personnel agency breach exposed data of 3 million people after attackers accessed a file-sharing server for about nine months. The U.S. Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense, is notifying people that their personal information w...
Identity governance helps control who should have access, but periodic reviews alone may not reveal attacks as they happen. tenfold Software explains how real-time identity telemetry can help security teams investigate suspicious activity before it escalates. [...]
AWS AgentCore SDK flaws could let attackers run commands in AI sandboxes and reach AWS credentials
LastPass has announced an expansion of its Business Max offering to include AI Monitoring & Protect and Web Monitoring & Protect, new visibility and governance capabilities that enable organizations to identify and secure the AI tools, SaaS applications, and websites its employees use, all f...
Cybersecurity researchers have identified a cluster of 101 npm packages that are used to trap developers into a WhatsApp group subscriber campaign dubbed PhantomSub.
"The malicious packages abuse the 'Baileys' WhatsApp open source project to add the victims to groups without their consent," OX Secu...
Turns out teaching an AI to keep going can make it rather bad at knowing when to stop
Postman has announced the general availability of Fabric Gateway, a protocol-agnostic control plane for governing how AI agents, LLMs, and MCP servers discover and interact with APIs, tools, and other agents. With Fabric Gateway, organizations can securely connect AI agents to their APIs while centr...
Microsoft Threat Intelligence warns that NeedyMantis threat actor from China has targeted organizations across a range of industries
Starting yesterday, our sensors picked up a small number of scans for "wordfence-waf.php". This particular script is used by Wordfence, a solution to protect WordPress sites. During the Wordfence install, the wordpress-waf.php file will be created in the site&#;x26;#;39;s root directory [1].
Apple patched zero-day CVE-2026-86950 in CoreGraphics, exploited in sophisticated targeted attacks against specific iOS users. Apple has released security updates for iOS, iPadOS and macOS to fix a zero-day vulnerability, tracked as CVE-2026-86950, in CoreGraphics that may have been exploited in att...
Apple says the bug was used to attack "specific targeted individuals" running iOS 26, which the majority of Apple customers are still using.
The company will use the funds to expand its sales, partnerships, channels, and customer support teams.
The post Reco Raises $55 Million for Agentic Security appeared first on SecurityWeek.
The personalized versions of ChatGPT were used to impersonate legitimate products and trick users into executing PowerShell commands.
The post Hackers Use ChatGPT Custom GPTs in ClickFix Attacks appeared first on SecurityWeek.
Source control records who committed code. It does not record who made the decisions behind it, and that gap is widening as AI agents take on more of the delivery process. This session explores how organisations can adapt accountability models for an AI-assisted development environment. What’s cover...
A sophisticated attacker with a quantum computer can exploit a protocol design flaw to downgrade post-quantum IPsec tunnels to classical crypto. We helped the IETF develop a transcript authentication extension to prevent these attacks.