Vercel Sandbox Flaw Could Let Rogue AI Agents Exfiltrate Data
New research finds a certificate-handling weakness in Vercel Sandbox that could let malicious AI agents bypass network restrictions and leak sensitive data.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
WeaselBiscuit npm Stealer Targets Chrome Extension Storage
A newly identified JavaScript stealer distributed through 13 npm packages is designed to harvest data from Chrome extension storage, expanding the supply-chain threat landscape.
Canonical Websites Hit by Second DDoS Attack This Year
The outage disrupted access to Ubuntu and Canonical sites, marking the second such attack this year.
Norway Fines Microsoft Ad Firm $9.6M Over Grindr Data Sharing
The record penalty highlights how adtech firms may be held liable for processing sensitive dating-app data without explicit user consent.
Plugin4Shell Lets Repo Owners Swap Pinned Plugin Code in AI Agents
A newly disclosed flaw in four AI coding agents lets a repository owner replace a pinned plugin with malicious code, undermining version-pinning safeguards.
AvisLoader: New Windows Malware Uses P2P to Resist Takedowns
A newly documented Windows loader relies on encrypted peer-to-peer messaging to keep command-and-control resilient against disruption.
Iran's Telegram-Controlled HEAVYGRAM Backdoor Tied to Handala Hack
Attribution of the HEAVYGRAM Telegram backdoor to both a hacktivist persona and state intelligence highlights a widening Iranian surveillance operation.
Android apps gain component-level security patch checks
New stable AndroidX libraries let apps see patching status of individual device components, enabling more nuanced security decisions.
Arcjet launches security controls and audit trails for AI agents
A new product aims to give engineering and security teams shared visibility and enforcement for AI agent deployments.
AWS open-sources Strands Box, a policy-enforced sandbox for AI agents
The tool pairs OS-level isolation with a rule engine that checks every agent action across shell, code, and network traffic.
New HTTP QUERY Method Stirs Security Questions
A newly standardized HTTP verb, QUERY, sits between GET and POST, prompting security analysts to consider how it might be abused.
Fraudulent hires often hold company credentials before detection, report finds
A 90-day gap between hiring and onboarding gives identity-based attackers a window to obtain legitimate company credentials.
Abandoned IoT apps still transmit data to dead servers, study finds
A University of Massachusetts Amherst analysis of 61,500 abandoned Android IoT apps shows millions of users remain exposed because old companion apps keep sending sensitive data to unmaintained servers.
Identity Access Must Be the Foundation of Cyber Resilience
As enterprises adopt more cloud apps, resilience planning now hinges on getting identity and access management right.
Survey: WordPress pros lack breach recovery plans despite incidents
A survey of 319 WordPress professionals finds that most have faced security incidents, yet few have a formal recovery plan.
Polite Bots Fool Social Media Users More Often, Study Finds
A new Surfshark study shows that courteous AI-generated comments are harder for people to distinguish from human posts.
Hardcoded MCP credentials exposed in public GitHub configs
A new report finds AI coding tools' API keys and tokens sitting in publicly accessible MCP configuration files on GitHub.
IonQ to Buy Zero Trust Firm Elisity in Up to $1.3B All-Stock Deal
IonQ's acquisition of Elisity adds least-privilege access technology to its security portfolio in an all-stock deal valued at up to $1.3 billion.