News Archive
2287 stories · page 10 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
Osavul Lands $10 Million to Spot Hostile Intent Across Cyber, Physical Domains
Osavul, a company specializing in hybrid risk intelligence, has announced it secured $10 million in Series A funding. The investment round was led by 33N Ventures, with the stated purpose of advancing Osavul's capabilities in detecting hostile intentions across both cyber and physical domains.
AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit
The Dutch Institute for Vulnerability Disclosure (DIVD), a non-profit organization that identifies and reports software vulnerabilities, confirmed it was breached on September 21 through the exploitation of two zero-day vulnerabilities in Zammad, an open-source helpdesk and customer support ticketing system. The attack was attributed to an "agentic AI" system, which reportedly used the flaws…
Legit Security extends automated fixes to vulnerable open-source dependencies
Legit Security has announced an expansion of its Agentic Remediation capability to automatically address vulnerabilities found in open-source dependencies. This update allows development teams to move directly from vulnerability detection to a verified fix without requiring manual triage, a process previously limited to first-party code.
One year later: Sovereign AI and the fight for choice
Cloudflare has announced a new initiative focused on "Sovereign AI" to address concerns from governments and enterprises regarding data control, privacy, and regulatory compliance in the age of artificial intelligence. This program aims to provide customers with greater choice and control over where their AI models are run and how their data is processed, particularly in response to the…
ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)
A recent report indicates that threat actors have been observed leveraging the legitimate ScreenConnect client in their attacks. This activity suggests a trend where attackers opt for readily available and trusted software to achieve their objectives, rather than developing or deploying sophisticated custom malware. The report, published on Thursday, October 1st, highlights the abuse of a…
Many expect AI in the SOC to make entry jobs harder to get
The increasing integration of artificial intelligence into Security Operations Centers (SOCs) is reshaping the cybersecurity career landscape, particularly for entry-level positions. While AI tools are largely welcomed by current security staff for automating repetitive tasks, concerns are emerging about their potential impact on skill development and the accessibility of junior analyst roles.
Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
Cryptocurrency exchange Bitget has confirmed that a recent theft of $387.5 million was facilitated by the exploitation of a zero-day vulnerability in third-party security products. The confirmation, based on ongoing investigation findings from blockchain security firm SlowMist, indicates that malicious activity involved these external security solutions. Investigators reportedly recovered a…
MetaMask Security Incident Prompts Exit of Affected Ethereum Validators
MetaMask has reported an ongoing security incident affecting a portion of its infrastructure, prompting a response from the company. The software cryptocurrency wallet provider stated that it is actively addressing and remediating the issue internally, working in coordination with external partners and security advisors. While the incident is being managed, MetaMask has indicated that it has…
The vulnerabilities AI finds are the ones attackers want
Threat actors are rapidly exploiting vulnerabilities discovered by artificial intelligence research agents, often within days of public disclosure, according to new research from Google Threat Intelligence Group (GTIG). The group's analysis, covering January 2025 to August 2026, indicates a significant increase in overall vulnerability exploitation, particularly for "n-day" flaws.
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
Recent analysis by LevelBlue's Threat Hunt Operations & Research (THOR) team indicates that threat actors are exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway products. The observed post-exploitation payloads are designed to establish persistence by creating superuser accounts and mapping web shells to URLs that mimic…
FTC is Investigating OpenAI and Anthropic Over Possible risks to Consumers
The Federal Trade Commission (FTC) has initiated an investigation into artificial intelligence developers OpenAI and Anthropic. A spokesperson for the agency confirmed the probe, stating that it centers on potential risks to consumers posed by the companies' technologies. No further details regarding the specific nature of these risks or the scope of the investigation were provided.
US sanctions 10 over ATM malware scheme tied to Tren de Aragua
The U.S. Treasury Department has imposed sanctions on ten individuals and several companies, all tied to a sophisticated ATM malware scheme that has reportedly siphoned over $40 million from financial institutions. The Office of Foreign Assets Control (OFAC) announced the sanctions, linking the "jackpotting" operation to Tren de Aragua, a Venezuelan criminal organization, and identifying the…
OpenAI reveals ‘novel’ encryption bypass used in distillation attack
OpenAI has disclosed that it disrupted a sophisticated campaign aimed at extracting reasoning capabilities from its AI models, attributing a significant portion of the activity to individuals associated with the Chinese company Moonshot AI. The company described the attack method as "novel," involving an encryption bypass that did not compromise its systems directly but rather manipulated…
Internet Society Launches Global Online Trust and Safety Hub as Part of Its Safer Internet Initiative
The Internet Society has announced the launch of a new Global Online Trust and Safety Hub. This initiative is presented as a component of its broader Safer Internet Initiative. The announcement was made from Washington, D.C., and reported on September 30, 2026.
Irony alert: OpenAI whines that Chinese model stole its special IP that it stole from everybody else
OpenAI has accused individuals associated with China's Moonshot AI of conducting a "distillation attack" against its models throughout July. The company stated that this activity, which began on July 1 and was fully disrupted on July 28, involved manipulating model interactions to reproduce protected reasoning at scale, violating its terms of service.
Apple Products Vulnerability Exploited Same Day as Disclosure
A critical out-of-bounds write vulnerability in multiple Apple products was exploited on the same day it was disclosed. Both US and EU government catalogues now list it as actively exploited.
Google: Vulnerability disclosures double to 10,000 per month as AI fuels exploitation
Google's Threat Intelligence Group (GTIG) has reported a significant surge in vulnerability disclosures, with monthly totals more than doubling from January to August of this year. The number of disclosures climbed from 5,045 in January to over 10,000 in both July and August, peaking at 10,740 last month. This increase is attributed by GTIG researchers to the growing influence of artificial…
16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows
A 16-year-old security researcher, known as Faav, discovered an authentication flaw in Microsoft's internal analytics service, Titan, which granted him administrator access and the ability to execute unauthorized SQL queries. This vulnerability potentially exposed analytics databases containing an estimated 17.3 trillion rows of data. Microsoft has since addressed the issue and awarded Faav a…
Over 543,000 valid credentials exposed in public GitHub repositories
More than 543,000 valid credentials were found exposed in public GitHub repositories as of July 2026, despite the platform's security measures designed to prevent such leaks. Research conducted by Truffle Security, based on a dataset assembled for training large language models from a crawl that concluded on August 7, 2025, revealed that the median duration a unique credential remained…
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
Threat actors are actively exploiting a previously disclosed vulnerability in Zimbra Collaboration Suite (ZCS) to gain unauthorized access and exfiltrate sensitive information, as reported by the Microsoft Security Research team. The attacks involve the deployment of web shells and subsequent harvesting of authentication secrets, indicating a sophisticated post-exploitation strategy aimed at…
Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
Microsoft has issued a warning regarding active phishing campaigns that are leveraging legitimate remote monitoring and management (RMM) software, specifically MSP360, to establish remote access on targeted systems. The campaigns reportedly distribute an installer for MSP360, masquerading it as various lures such as meeting invitations, PDF documents, or software update prompts, to trick users…
CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a critical pre-authentication remote code execution (RCE) vulnerability affecting MikroTik RouterOS. The flaw, identified as CVE-2026-84411, is an integer underflow within the web-management HTTP request handling component of RouterOS.
WatchGuard Patches Critical Fireware OS Code Injection Vulnerability
WatchGuard has released a series of patches addressing multiple vulnerabilities within its Fireware OS. The update targets a total of fifteen distinct security flaws, encompassing critical code injection vulnerabilities, denial-of-service issues, authorization bypasses, and path traversal bugs. This comprehensive patch aims to fortify the security posture of devices running the Fireware…
Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks
Reports indicate that government and finance organizations have been targeted in weeks-long attacks exploiting zero-day vulnerabilities in NetScaler products. The attacks leverage two specific vulnerabilities, identified as CVE-2026-88771 and CVE-2026-88772, with multiple security firms confirming observed exploitation.