WEF: Cyber-Fraud Overtakes Ransomware as CEO Top Concern
The World Economic Forum's 2026 outlook shows cyber-enabled fraud, AI-driven threats, and geopolitical volatility are reshaping cyber risk and widening resilience gaps.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
AWS open-sources Strands Box, a policy-enforced sandbox for AI agents
The tool pairs OS-level isolation with a rule engine that checks every agent action across shell, code, and network traffic.
Dataminr Adds Agentic AI to Predict and Verify Corporate Security Threats
The release signals a shift toward agentic AI that not only predicts threats but also verifies them in real time.
Arcjet launches security controls and audit trails for AI agents
A new product aims to give engineering and security teams shared visibility and enforcement for AI agent deployments.
Iran's Telegram-Controlled HEAVYGRAM Backdoor Tied to Handala Hack
Attribution of the HEAVYGRAM Telegram backdoor to both a hacktivist persona and state intelligence highlights a widening Iranian surveillance operation.
Android apps gain component-level security patch checks
New stable AndroidX libraries let apps see patching status of individual device components, enabling more nuanced security decisions.
Hardcoded MCP credentials exposed in public GitHub configs
A new report finds AI coding tools' API keys and tokens sitting in publicly accessible MCP configuration files on GitHub.
MIND Raises $72M for AI-Powered Data Loss Prevention
The investment will accelerate platform development and enterprise market expansion for MIND's AI-based DLP offering.
Week in Security: Active Exploits, Critical Patches, Exposed Infrastructure
A single-source roundup of the week's security news shows ongoing exploitation of known flaws, urgent patches, and exposed critical infrastructure.
Russia claims thousands of election cyberattacks, offers no evidence
Russian officials reported thousands of cyberattacks on election infrastructure, but provided little technical detail and the claims remain unverified.
Jade Sleet Tied to Indian IT Firm Breach via New Backdoors
North Korean group Jade Sleet compromised an Indian IT services firm using two backdoors, showing continued focus on developer supply chains.
WordPress Patches Click2Shell Flaw That Can Install Themes Silently
A newly patched WordPress vulnerability lets a crafted link trick an administrator into installing a theme, potentially leading to remote code execution.
Helmit parental app flags risky online chats with AI monitoring
A new parental control app combines AI social media scanning with screen time and location tools to alert parents to potentially harmful conversations.
Project Zero Details Windows Bug From Incomplete 'Dark Elevator' Patch
A newly documented Windows privilege escalation flaw, CVE-2026-66804, shows how an incomplete patch for the 'Dark Elevator' bug left a dangling COM object registration attack surface.
Fastly launches AI Runtime Control and AI Firewall for enterprise AI security
New Fastly capabilities aim to give organizations real-time visibility and control over AI models and agents.
Malware at Nippon Columbia Exposes 8.7M Karaoke Records
A malware infection at a contractor for Japanese entertainment firm Daiichi Kosho leaked millions of customer and employee records.
Microsoft Fixes False Defender Antivirus Off Alerts
A known issue that made Defender Antivirus appear disabled after updates has been resolved by Microsoft.
ClickFix Lures Deliver New ChainScript RAT via Polygon C2 Rotation
A previously undocumented remote access trojan is being distributed through fake browser-update prompts, using Polygon blockchain transactions to keep its command-and-control servers reachable.