Closing the Blind Spots in Agentic Pentesting
AI-driven penetration testing is powerful but incomplete; pairing it with exposure validation and breach simulation can cover the gaps.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
Chainguard Harness: AI finds exploitable bugs in running apps
Chainguard's new service uses frontier models to probe live applications in isolated sandboxes and deliver verified fixes.
AI-Discovered Linux vhost Flaw Grants Root and VM Escape
A Linux kernel bug in the vhost subsystem, found with AI assistance, lets local users gain root and, in some setups, lets a guest VM write to host memory.
Scytale MCP gives AI assistants read-only access to compliance data
The new MCP server lets AI tools query live compliance data with scoped, read-only access, while a write capability is planned for later.
Microsoft Disrupts Three Phishing Platforms Linked to Chinese Cybercriminals
A coordinated legal action seized infrastructure behind YAM Store, CoGUI, and Iron Man, which enabled mass credential theft worldwide.
Schneier: AI Cryptanalysis Threat Is Real, but Over-Engineering Wins
Bruce Schneier pushes back against Matthew Green's pessimistic view, arguing that cryptographic over-engineering will protect against future AI attacks.
Cisco fixes actively exploited Secure Email Gateway zero-day
A newly patched Cisco Secure Email Gateway vulnerability allowed unauthenticated remote attackers to run commands with root privileges.
U.K. Sanctions Crypto Platform Cryptomus for Russian Money Laundering
The U.K. has frozen assets of Cryptomus and linked services, marking the first Five Eyes sanction against a crypto firm incorporated in another Five Eyes country.
Polish probe says NSO had technical access to Pegasus surveillance data
A Polish investigation found the spyware maker retained control over Pegasus systems, raising concerns about foreign access to state surveillance data.
Schneier to Speak on Democracy and Security in Montreal, Toronto
Bruce Schneier's fall 2026 speaking schedule highlights democracy-focused security talks in Canada.
Record Microsoft Patch Tuesday: 1,400+ Flaws, Exploited Windows Shell Bug
Microsoft's largest Patch Tuesday ever fixed over 1,400 vulnerabilities, including an actively exploited Windows Shell flaw, but experts say volume is outpacing triage.
Harmonic Security Raises $50M to Protect Workforce AI Use
The funding will support expansion of engineering and go-to-market teams in the US and UK as the startup addresses AI-related security risks.
Microsoft fixes Always On VPN issues from September Windows 11 updates
Microsoft has resolved a known issue that caused Always On VPN connection problems after the September 2026 Windows 11 security updates.
curl 8.23.0 Fixes HTTP/2 Upload Flaw Enabling Code Execution
A memory corruption bug in curl's HTTP/2 upload handling could let a malicious server execute code on a client's machine; the project shipped a fix on October 14.
Siemens and Rockwell Issue ICS Patches; ABB Warns on dynovaPRO
The latest ICS Patch Tuesday roundup includes 17 Siemens advisories, a Rockwell ArmorBlock takeover fix, and an ABB warning about active probing.
SANS ISC Analyzes LausivLoader's Inter-Stage Data Passing
A SANS ISC analysis details how LausivLoader uses a business-themed malspam attachment to pass data between malware stages.
Docker Sandboxes Flaw on macOS Lets Guest Code Access Host Files
A critical Docker Sandboxes vulnerability on macOS could let malicious guest code escape the shared project directory and read or modify host files.
Vercel Sandbox Flaw Could Let Rogue AI Agents Exfiltrate Data
New research finds a certificate-handling weakness in Vercel Sandbox that could let malicious AI agents bypass network restrictions and leak sensitive data.