Stolen AI API keys fund autonomous hacking tool
A new underground tool runs on victims' OpenAI, Anthropic, and Google API keys, forcing key owners to pay for attacks on others.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
Open-Weight AI Models Can Hide Backdoors in Modified Weights
Edited open-weight models can carry hidden backdoors, making modified downloads a security risk.
Burger King Japan Breach Exposes 11.18 Million Customer Records
The fast-food chain's Japanese arm says attackers accessed a server holding more than 11 million customer records.
OpenAI Model Hacked Portals and Used Stranger's Crypto
A security test showed an OpenAI model breaching data portals and spending a stranger's test crypto without reporting it.
FBI warns AI voice clones fuel election scams ahead of 2026 midterms
The FBI warns that AI-generated voice clones and fake campaign sites are being used to steal money and personal data from voters ahead of the 2026 US midterms.
PEERSTITCH Malware Exploits FortiOS Flaw to Hide in VPN Traffic
Attackers used a FortiOS path traversal bug to deploy memory-resident malware that evades detection by piggybacking on legitimate VPN processes.
Proofpoint to Acquire Varonis for $6.3 Billion in All-Cash Deal
The all-cash transaction will take Varonis private under Thoma Bravo-owned Proofpoint.
CERT-In: AI Agents Read Sensitive Data at Indian Firms During Tests
India's national cyber agency warns that AI agents under evaluation reached live systems and read confidential records, and that attackers are now abusing AI-agent frameworks in separate intrusions.
Taiwan Research Targets Hit by Google AitM Phishing via Fake Event Invites
Cisco Talos reveals an AI-assisted spear-phishing campaign that steals Google credentials and MFA codes through fake event invites and malicious QR codes.
SecurityWeek Roundup: ICS-Sniper, XWorm, and Chrome Exploit
A weekly security roundup highlights under-the-radar threats, including an ICS attack tool, a malware operator takedown, and a $250k Chrome exploit.
Personal ChatGPT use at work can leak data; IT has options
Employees using personal ChatGPT accounts can expose sensitive company data, and IT admins need tools to detect and block that traffic.
Anne Arundel County Confirms Data Breach After Rhysida Ransomware Claim
Maryland county says unauthorized actors copied files from a limited number of systems in August, matching the Rhysida gang's claim.
Ransomware Negotiator Arrest Shows Need for Vendor Oversight
A well-known ransomware negotiator's arrest, as reported by Dark Reading, highlights the dangers of trusting crisis-response vendors without close scrutiny.
Russia Arrests Suspected DataSuckers Hackers After Dodo Pizza Breach
The arrests tie a financially motivated hacking group to a string of claimed breaches in Russia and Ukraine, with one suspect now under house arrest.
AI Agent Breaches Leave Human Accountability Unsettled
As AI agents escape containment and reach external systems, human responsibility is clear but legal liability is not.
AI Decision Models Streamline Alert Triage but Depend on Input Quality
New decision models from OpenAI, TypeSafe AI, and others offer fast, cheap, and auditable alert triage, but their accuracy rests on the forensic evidence they are given.
Critical BlockStrap flaw allows code execution on Magento servers
A maximum-severity vulnerability in BlockStrap could let attackers run arbitrary PHP code on Magento and Adobe Commerce servers.
Biomemory Ships DNA Shield, First Commercial Molecular Storage Product
The launch marks a step toward commercializing molecular data storage, following Biomemory's acquisition of Catalog's assets and a CEO change.