Fastly launches AI Runtime Control and AI Firewall for enterprise AI security
New Fastly capabilities aim to give organizations real-time visibility and control over AI models and agents.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
Colorado Water Utilities Hit by OT Cyberattacks, Officials Say
Attacks on Colorado water utilities disrupted operations by altering equipment settings and disabling alarms, highlighting risks to critical OT infrastructure.
AI Still Stumbles on CAPTCHAs, Anthropic Report Shows
A new incident report reveals that even advanced models like Claude struggle with basic human verification puzzles.
SAP ECC Extended Support: Costs and Risks Before 2027 Migration
As some large firms plan to run SAP ECC beyond 2027, the decision to pay for extended support until 2030 carries costs and security implications.
SecurityWeek Roundup: Ransomware Sentencing, AI-Driven Plugin Attack, SAP Flaw
A weekly roundup of security stories that may have been overlooked, including a ransomware developer's sentence, an AI-powered attack on a WordPress plugin, and a critical SAP vulnerability.
Cisco patches exploited email gateway 0-day; Revolut breach detailed
A weekly security roundup highlights an urgent Cisco fix for an actively exploited zero-day and new details on a Revolut breach that used a spoofed government email.
Fake GitHub repos impersonate LastPass to spread new Rapuncel infostealer
A campaign uses SEO-optimized GitHub repositories posing as trusted software to deliver a previously unknown credential-stealing malware.
Microsoft 365 Sharing Leaves Stale Access Risks, Access Reviews Can Help
A BleepingComputer explainer highlights how Microsoft 365's easy sharing can leave sensitive data accessible long after it should be, and argues owner-driven access reviews restore visibility.
Four Nations Act on North Korean IT Worker Allegations
A new UN report says Vietnam, Laos, Pakistan and Argentina have taken meaningful steps against North Korean IT worker schemes.
Gopass brings GPG-encrypted password management to the command line
An open-source password manager positions itself as a drop-in replacement for pass, targeting teams that work in the terminal.
AI compliance failures hit 40% of large firms, survey finds
A new survey shows that legacy workflows are driving most AI governance problems at large companies.
OAuth Consent Abuse: Why MFA Alone Isn't Enough
Multifactor authentication remains vital, but it cannot substitute for proper OAuth governance and consent oversight.
Transparent Tribe Uses Rust Backdoor With GitHub C2 in India, Afghanistan
A Pakistan-aligned group is targeting government and defense entities with a new Rust-based backdoor that uses private GitHub repositories for command-and-control.
Project Zero Details Windows Bug From Incomplete 'Dark Elevator' Patch
A newly documented Windows privilege escalation flaw, CVE-2026-66804, shows how an incomplete patch for the 'Dark Elevator' bug left a dangling COM object registration attack surface.
Intent Injection Attacks Threaten AI-Native 6G Networks
Researchers warn that the shift to intent-based networking in 6G could open a new attack surface for malicious intent injection.
Microsoft Teams to Let Admins Block Custom File Extensions
Admins will soon be able to customize which file extensions Teams treats as security threats.
DavMail 7.0.0 leans on Microsoft Graph to ease Exchange access
The update strengthens the Java gateway's role as a bridge for users who want to drop Outlook without losing access to Exchange mailboxes.
Impersonation and Phishing Top Online IP Threats, Report Finds
A new CSC report identifies impersonation, phishing, and domain abuse as the most pressing online intellectual property risks.