Australia opens inquiry after OpenAI agent breached health portal
A research agent got past controls on a government statistics portal, prompting a taskforce review and questions about how slowly OpenAI reported it.
The Latest
Malware hands its tactical decisions to a panel of AI models
Cisco Talos found a Windows implant that polls four commercial AI models and acts on whichever answer wins.
Malware turns up in HashiCorp Terraform registry packages
Aikido traced Go malware inside two Terraform providers and two Go modules, the first abuse of HashiCorp's registry as a…
A disk-filling tool quietly stops Microsoft Defender updates
BigDiskBuster fills the system drive so Defender cannot install platform or signature updates, and there is no patch.
Enterprise browser startup Island hits a $6.4B valuation
Island has closed a $400M Series F led by Evolution Equity Partners, pushing total funding past $1B.
Elsevier confirms a brief redirect after LAPSUS$ hijacked its traffic
The publisher says a limited redirect touched select platforms after students reported landing on the LAPSUS$ leak site.
ShinyHunters says it broke into the FBI and took 2TB of files
ShinyHunters says an Oracle PeopleSoft zero-day put it inside the FBI jobs portal, and it wants a retraction rather than…
Microsoft lands its first takedown of a fully AI-run crime service
Microsoft has seized the infrastructure behind a phishing kit that used AI to pick its victims, and two suspects are…
Check Point rushes a hotfix for a management server zero-day
A path traversal bug in Check Point's management plane was already being used against customers weeks before the vendor knew…
A heap overflow in BIG-IP APM lets outsiders run code
A heap overflow in BIG-IP APM hands unauthenticated attackers code execution on any appliance serving as an OAuth authorization server.
Arista tells customers to patch a VeloCloud orchestrator flaw now
A CVSS 10.0 input validation bug in on-premises VeloCloud Orchestrator is under active exploitation, and fixes cover only two of four release trains.
A Chinese crew turned three unpatched browser bugs into a backdoor
Volexity has linked a China-aligned group to a three-bug Chrome and Windows chain that ran before either vendor shipped a…
WordPress core patch closes a path traversal that can run code
WordPress 7.1.2 closes a path traversal in get_page_template() that needs no account and can end in code execution on some…
Zyxel switches fall to an obfuscated exploit as CISA sets a deadline
A Chinese-speaking operation pulled configuration files and hashed root credentials from 996 Zyxel GS1900 switches before federal agencies got 72…
Spotlight
Malware hides in a B-tree library now that npm blocks install hooks
A malicious npm package pulled two million weekly downloads while running its payload from ordinary library code instead of an install script.
TASK#STOMP hides a document thief behind Windows’ own tools
A PowerShell backdoor built from native Windows components steals business files, Wi-Fi passwords and clipboard contents while hiding as scheduled system tasks.
A single line break turned a WordPress comment into a server shell
An anonymous commenter could plant a script that ran in an administrator's browser and, from there, uploaded a web shell to the site.
A nested-virtualization bug lets ARM64 guests touch host memory
A skipped cache invalidation leaves a freed page of host memory mapped and writable for a guest virtual machine on ARM64 hosts.
Features
One in five water utilities has logins sitting in infostealer logs
SpyCloud found 1,787 of roughly 10,000 US water organizations exposed, including one infected device holding logins for 167 utility tenants.
A SharePoint spoofing bug turned out to be full remote code execution
Microsoft scored the flaw 6.5 as a spoofing issue, while the National Vulnerability Database calls the same bug an 8.8…
A fake LastPass page ships a signed driver that kills security tools
A GitHub page posing as the LastPass Authenticator installs a Microsoft-signed kernel driver that terminates 145 security processes before a…
Ireland fines Google €403M over how it handled location data
Ireland's regulator says Google's location processing broke GDPR rules and orders a six-month fix.
Fake recruiters call Rust maintainers to plant malware on their Macs
Fake recruiters are booking video calls with Rust maintainers and pushing malware.
Jade Sleet slips two macOS backdoors onto a developer’s laptop
Two Rust backdoors for Apple Silicon sat dormant on a developer's Mac for eleven days.