WordPress Click2Shell CSRF Flaw Could Let Attackers Run PHP Code
A newly disclosed cross-site request forgery vulnerability in WordPress Core, with a public proof-of-concept, can let attackers execute PHP on the server.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
BigCommerce Warns Merchants of Breach via Third-Party Ribon Apps
Compromised credentials for third-party Ribon applications allowed attackers to inject malicious scripts into BigCommerce online stores.
AI Agent Cost Runaway Risks Enterprises, OWASP Warns
A recognized but underappreciated flaw in LLM applications may let AI agents consume resources without limits, leading to severe financial damage.
Film Torrents Carry New Malware, Victims Found in Kenya and Uganda
Cybercriminals are using popular movie torrents to distribute fresh malware, with confirmed infections in East Africa.
Malicious npm package hides payload in runtime, not install scripts
A new npm campaign shows attackers can bypass supply-chain checks by triggering malicious behavior only when the package runs, not during installation.
OpenAI Patches Codex Sandbox Flaws After Researchers Escape Twice
Two sandbox escape techniques from OpenAI Codex, including one that ran commands on a developer's machine, have been patched.
Identity Visibility Seen as Foundation for Modern Identity Security
A new analysis argues that organizations cannot secure identities they cannot see, pointing to stolen credentials as a leading breach entry point.
BragJack Attack Turns Browser AI Assistants Into Attack Tools
A newly disclosed attack technique, BragJack, exploits built-in browser AI assistants to steal data and execute malicious actions.
AI Actress 'Talking Tilly' Requires Face Scan for Calls
A viral AI video-call service collects facial and mood data from callers, raising privacy concerns before it shuts down.
ShinyHunters Breaches Clop's Leak Site, Threatens Extortion
The ShinyHunters extortion group has turned the tables on Clop by hacking and defacing the ransomware gang's own data leak site.
TigerByte Cyber Exits Stealth With $3M and US Government Contracts
The cybersecurity startup has secured over $7 million in contracts with US Space Force, Navy, and DARPA.
Orkes Conductor RCE Flaw CVE-2026-58138 Exploited in the Wild
Attackers are actively exploiting a critical unauthenticated remote code execution vulnerability in Orkes Conductor via inline workflow definitions.
Vectra AI Launches Ascent to Counter AI-Powered Threats
The new partner program expands Vectra AI's ecosystem to meet rising demand for AI expertise and security services in increasingly complex environments.
AI Deployment Outpaces Governance, EY Survey Finds
A new EY survey of senior AI executives finds that organizations are rolling out autonomous systems faster than they are building the controls to oversee them.
Schneier's Squid Post Doubles as Security News Thread
A Friday squid essay becomes an unlikely venue for surfacing security stories that Schneier hasn't covered.
Microsoft Patches Maximum-Severity Azure AI Foundry Bug
A CVSS 10.0 privilege escalation vulnerability in Azure AI Foundry was patched as part of a broader Microsoft security update.
NightEagle Expands From China's High-Tech Sector to Russian Enterprises
Kaspersky reports that the hacking group NightEagle, previously tied to China's high-tech sector, has now been linked to incidents at Russian businesses.
RatHat Android Malware Uses AI and ADB to Persist After Uninstall
Researchers warn of a new Android trojan that combines AI-driven device control with ADB-based persistence to survive uninstallation.