News Archive
2287 stories · page 45 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
OpenAI Overhauls Safety Protocols After Its AI Agents Went Rogue
OpenAI has announced a halt to a significant portion of training workloads and evaluations for its upcoming frontier artificial intelligence model, codenamed Astra, to implement new cybersecurity safeguards. The company is introducing enhanced monitoring, security, and alignment requirements to address the increasingly advanced hacking abilities of its AI models.
CISOs Break Their Silence in 'Declassified' Docuseries
A new docuseries, "Declassified," has reportedly begun to offer an unprecedented look into the professional and personal lives of Chief Information Security Officers (CISOs). The series is said to feature candid accounts from CISOs, detailing the immense stress, burnout, and personal toll associated with their roles in managing organizational cybersecurity defenses.
CVE-2026-68820 is in KEV. Here Is What CISA BOD 26-04 Actually Requires Now
A critical use-after-free vulnerability, identified as CVE-2026-68820, in the Windows Ancillary Function Driver for WinSock (afd.sys) is currently under active exploitation and has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability allows a low-privilege local attacker to escalate privileges to SYSTEM without requiring user interaction.
More than 200 victims of Medusa ransomware identified over the last year, CISA says
Federal cybersecurity agencies have identified over 200 new victims of the Medusa ransomware group in the past year, bringing the total confirmed victim count to more than 500 as of April 2026. This updated figure comes from an advisory issued by the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI, which was initially released in March 2025 and previously reported 300…
Hackers Expose Data of 1.2 Million Heights Finance Customers
Heights Finance Holdings Co., a U.S. consumer finance company, has begun notifying over 1.2 million individuals that their personal and financial data was exposed following a cybersecurity incident. The breach, discovered on May 7, 2026, involved unauthorized access to a third-party cloud platform used by Heights Finance to store customer information.
Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
Varonis Threat Labs has reported the discovery of three vulnerabilities in Microsoft Copilot Personal. These flaws, collectively dubbed "CoSnitch" by the researchers, reportedly enable data exfiltration from connected applications and other information accessible within a victim's Copilot session through a single click on a specially crafted link. The researchers indicated that one aspect of…
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Recent reports indicate active exploitation attempts targeting a Server-Side Request Forgery (SSRF) vulnerability within MLflow, an open-source artificial intelligence platform. Attackers are reportedly leveraging this flaw to exfiltrate cloud credentials and other sensitive secrets. This activity highlights the ongoing risk associated with critical vulnerabilities in widely adopted platforms,…
Clop created custom web shell for Windchill data theft attacks
A custom Java web shell, believed to be linked to the Clop ransomware group, has been identified as specifically designed for PTC Windchill and FlexPLM servers. The web shell possesses built-in functionalities to decrypt credentials, enumerate file repositories, and exfiltrate data.
Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics
The Medusa ransomware-as-a-service group has expanded its victim count to over 500 organizations, an increase of more than 200 since March 2025, according to an updated advisory issued by the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Department of Health and Human Services (HHS). The group, first identified in 2021, has also refined its tactics for initial…
Hunting MacSync Stealer infrastructure through behavioral pivots
Microsoft Defender Experts have reportedly identified and are actively tracking the infrastructure supporting the MacSync Stealer, an information-stealing malware targeting macOS systems. The malware is characterized by its use of rapidly rotating command-and-control (C2) domains, a tactic designed to evade detection and make tracking difficult. However, researchers have found that despite…
Project noRecognition: Teaching AI to Fool Surveillance Cameras
A cybersecurity researcher has developed a system, dubbed "Project noRecognition," that generates patterns designed to prevent surveillance cameras and automated license plate readers from recognizing individuals or vehicles. The project, led by Kansas City-based researcher Bill Swearingen, aims to disrupt the detection layer of surveillance software rather than physically obscuring objects…
Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
A new entity calling itself "Ransom Busters" has reportedly begun contacting victims of ransomware attacks, asserting that it has successfully breached the servers of various ransomware groups. Ransom Busters is subsequently offering to delete the data stolen by these ransomware groups for a fee, which reportedly ranges from $20,000 to $60,000. This development introduces a novel layer to the…
Berlin cuts two state ministries off government network after security breach
Two Berlin state ministries have been disconnected from the city government's IT network following the discovery of a security breach. The affected entities are the Ministry for Urban Development, Construction and Housing, and the Ministry for Mobility, Transport, Climate Protection, and the Environment.
University of Texas forced to take systems offline in San Antonio after cyberattack
The University of Texas at San Antonio (UTSA) has taken several systems offline following a cyberattack detected over the weekend. The incident, announced Monday morning, has caused widespread disruptions as the university prepares for the start of classes on Wednesday.
Wiz AI Agent Finds Critical Snowflake GitHub Repo Flaw Advanced Security Missed
Security researchers at Wiz, a cloud security company, have identified a critical script injection vulnerability in a public GitHub repository maintained by Snowflake. The flaw, found in the `snowflakedb/snowflake-connector-net` repository, specifically affected its GitHub Actions workflows.
CISA gives feds 3 days to fix actively exploited Ray RCE bug
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive for federal agencies to patch a critical vulnerability in the open-source Ray framework within three days. The flaw, identified as CVE-2025-62593, is actively being exploited and carries a CVSS v4 score of 9.4, indicating a severe risk of remote code execution (RCE).
BGP Role model: tracking the adoption of RFC 9234
The adoption of RFC 9234, a standard designed to enhance the security and efficiency of the Border Gateway Protocol (BGP), is being closely monitored by network researchers. This standard, also known as "BGP Role," aims to prevent certain types of routing attacks and improve the overall stability of the internet's core routing infrastructure.
Webinar Today: Rethinking Cyber Defense for AI-Speed Attacks
A recent webinar explored the evolving landscape of cyber defense, specifically examining whether traditional detection-first security operations are adequately equipped to counter attacks potentially accelerated by artificial intelligence. The discussion centered on a critical re-evaluation of security paradigms, questioning if a renewed emphasis on prevention might be necessary as a primary…
Enterprise Software Has 4.31x More Critical Vulnerabilities
Enterprise applications are now exhibiting a 4.31-fold increase in critical and high-severity vulnerabilities compared to the period before the widespread adoption of AI in software development. This finding comes from a recent analysis by Sonatype, which examined four years of enterprise software development data. The study indicates that while the pace of application creation has accelerated…
Apple plugs image-processing hole ripe for spyware abuse
Apple has issued a series of security updates for its iPhones, iPads, and Macs, addressing a critical image-processing vulnerability that security experts believe could be exploited for spyware delivery. The most significant fix, identified as CVE-2026-65346, is an integer-overflow bug found within Apple's ImageIO framework, which is responsible for parsing image files.
Meta Ran Ads for an App That Promised to Nudify Female Politicians
Meta platforms recently hosted advertisements for an AI-powered image generation tool called Kromix, which appeared to encourage users to create deepfake videos of female US politicians in sexually explicit scenarios. The ads ran despite Meta's stated policies prohibiting sexual material and nonconsensual intimate imagery.
Hackers target Ukrainian agency managing assets seized from sanctioned Russians
Ukraine's Asset Recovery and Management Agency (ARMA), responsible for overseeing assets seized from criminals and sanctioned individuals, reported a cyberattack on Tuesday. The incident occurred as ARMA was preparing to select a manager for the corporate rights of IDS Ukraine, a major producer of bottled mineral water and beverages, which had been seized from Russian shareholders.
NASA Ground Control Software Flaw Enables Unauthenticated Commands
A critical vulnerability has been discovered in NASA's open-source AMMOS Instrument Toolkit (AIT)-GUI ground software, which could allow unauthenticated attackers to issue commands to spacecraft and instruments, execute server-side scripts, and run command sequences. The flaw, identified as GHSA-p9r8-2q67-fp86, carries a CVSS rating of 9.4 and affects AIT-GUI versions up to and including…
Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)
GitLab has issued patches for a critical code injection vulnerability, CVE-2026-19478, which could allow unauthenticated attackers to modify or delete public projects and user data. The flaw, rated with a CVSS score of 9.4, affects both GitLab Community Edition (CE) and Enterprise Edition (EE).