Microsoft says AI has flipped the attackers’ speed advantage
Microsoft's 2026 report says attackers are reaping AI's speed gains faster than defenders can respond.
The Latest
This WordPress backdoor regrows from any surviving copy
Sucuri's SC backdoor hides in eight places and rebuilds itself from any one that survives cleanup.
A China-tied crew keeps hammering unpatched SharePoint servers
Longlegs and Storm-2603 keep breaching unpatched SharePoint servers to plant Warlock ransomware.
Spoofed White House invitations seed a China-tied phishing run
A China-aligned crew posed as a White House adviser and an economist to phish US AI policy experts.
Europol task force dismantles KillSec and holds a 16-year-old
Police seized KillSec's leak site and froze 110 terabytes of stolen data, detaining a 16-year-old they call its leader.
Fortinet has no patch yet for a FortiMail flaw under attack
A 9.8-rated FortiMail flaw lets unauthenticated attackers write files, and the fix is still pending.
Half a million GitHub secrets are still live and unrevoked
Truffle Security found more than half a million still-valid credentials exposed in public GitHub repositories.
Treasury sanctions the engineer behind ATM jackpotting malware
The US Treasury has sanctioned the alleged developer of Tren de Aragua's ATM jackpotting malware and seven of his associates.
Google hands vetted defenders an unguarded Gemini 4 Argon
Google is handing a guardrail-free build of its newest frontier model, Gemini 4 Argon, to a small circle of vetted…
Two Zammad zero-days let an AI agent reach root in seconds
An AI-driven intruder chained two Zammad zero-days to climb from a helpdesk account to root in seconds.
Kevin Mandia’s Armadin vaults to a $2.5B valuation
Kevin Mandia's offensive security startup has raised $255.5 million in Series B funding, pushing its valuation past $2.5 billion.
Attackers bypass authentication in Cisco’s SD-WAN manager console
CISA has ordered federal agencies to patch a critical Cisco SD-WAN Manager flaw that attackers are already exploiting.
Anthropic warns investors as a rogue-agent lawsuit targets OpenAI
With one AI firm disclosing agent risk to investors and another facing a hacking suit, liability for runaway models is…
A hundred npm packages quietly conscript WhatsApp bots for spam
OX Security says 101 packages abuse a WhatsApp library to sign victims' bot sessions up for groups they never chose.
Spotlight
Chrome and Firefox releases close over a hundred security holes
Google and Mozilla pushed new builds fixing 32 Chrome flaws and roughly 76 Firefox bugs in a single day of browser patching.
OpenSSL patches a DTLS bug that spills server memory to callers
A resend-timer mistake in OpenSSL's UDP handshake can hand leftover heap bytes to the other side of a DTLS session.
Helpful AI agents quietly posted 13,000 company screenshots to GitHub
Glow Security traced thousands of internal images to AI coding agents that routed private screenshots through public repos.
Stale branch predictions reopen Spectre in browser JIT engines
Researchers show a practical Spectre v2 variant that harvests stale branch predictions left behind by just-in-time compilers.
Features
Star Blizzard trades precision for volume in a sharper phishing push
A Kremlin-tied crew tied to the FSB is trading hand-aimed spear-phishing for bulk runs that plant its CosmicPulse backdoor.
A SQL injection raid exposes Polish patients’ national ID numbers
Attackers pulled Polish national ID numbers from a clinic platform through a SQL injection flaw.
Pentagon records office admits a nine-month intruder access
The Defense Manpower Data Center left unencrypted records open to intruders for nine months.
A rogue MCP server can walk off with your OAuth tokens
A malicious MCP server can redirect a client's OAuth handshake and pocket the secrets.
Microsoft ties a quiet intrusion toolkit to the Daemon Tools breach
The toolkit let intruders hold ground inside telecom, university and government networks.
Apple patches a zero-day used in surgically targeted attacks
An out-of-bounds write in Apple's drawing engine was aimed at a targeted few.