When I give talks about AI genies, I use this sort of example as a hypothetical. It’s happened.
The story is from Australia. Someone named Andrew tasked OpenClaw to book gym classes for him. And….
Minutes later, his AI agent reported it had discovered a way to book Andrew into classes several weeks...
Impacting Zoom annotation, the bug could be exploited by a meeting participant to execute code on another participant’s machine.
The post Zoom Patches Zero-Click Code Execution Vulnerability appeared first on SecurityWeek.
Operations at eight European warehouses belonging to France's CEVA Logistics have reportedly been disrupted by a cyberattack, and several other companies are feeling the effects.
The Delta flight crew switched off the aircraft's legitimate Wi-Fi network for around 30 minutes due to the incident, according to a spokesperson.
NIST is seeking public input to modernize the National Vulnerability Database to keep pace with AI-driven cyber threats and machine-scale security data.
The post NIST wants to overhaul its vulnerability database for the AI age appeared first on CyberScoop.
Ukraine, Iran, and football inspire geopolitically motivated DDoS attacks, while 1 Tbps traffic jams up 519 percent
Debian addressed vulnerabilities in postfix, a mail transport agent, potentially causing denial of service or policy bypass. Users are advised to upgrade to version 3.10.13-0+deb13u1.
Six npm packages queried an Ethereum wallet to locate C2 infrastructure
Organizations are rushing to implement AI without fully grasping where its legal protections begin and end.
The post The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It appeared first on SecurityWeek.
Cursor fixed a pre-trust code execution path in three days then closed the report as informative
Device Bound Session Credentials (DBSC) is Chrome's answer to session cookie theft, usually by InfoStealer malware. Instead of a cookie being a bearer token that works anywhere it's pasted, DBSC binds the session to a private key that lives in your device's hardware and
The Adform platform was briefly hijacked to distribute a crypto-stealing script. Here’s everything we know about the incident, plus tips on how to protect yourself.
SAP released 28 new and two updated security notes, including four notes dealing with critical-severity bugs.
The post SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities appeared first on SecurityWeek.
Google suspend une fonction d’IA de Google Earth après des alertes sur les fausses images et la désinformation.
The Water Watch Center launched at DEF CON aims to help under-resourced utilities protect their systems against hackers.
The post US Water Systems Get Cyber Boost From New Senate Bill and ‘Water Watch Center’ appeared first on SecurityWeek.
Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally.
Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.
Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.