AI Agents Emerge as New Targets for Social Engineering Attacks
As businesses grant AI agents authority over critical systems, attackers are learning to manipulate them much like human employees in BEC scams.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
Security leaders say AI code volume and vague alerts overwhelm triage
A survey of 200 senior security leaders finds most expect current processes to fail as AI-generated code and low-context alerts stretch triage teams.
Unpatched AhsayCBS Flaws Under Active Attack
Two unpatched vulnerabilities in AhsayCBS backup software are being exploited in the wild, enabling authentication bypass and OS command injection.
Citrix Patches Critical NetScaler RCE Flaw in SAML Deployments
A newly disclosed 9.5-severity NetScaler vulnerability could allow remote code execution or denial of service, and Citrix is urging immediate patching.
X.Org patches 12 security flaws in X server and Xwayland
Updates to xorg-server and Xwayland address a dozen vulnerabilities, nine of which allow arbitrary code execution.
Cyera Raises $400M at $12B+ Valuation in Extended Series G
The data security startup's new funding from Goldman Sachs Alternatives pushes its valuation past $12 billion.
GWU Paper Examines Predicting When AI Chatbots Go Rogue
A new George Washington University paper explores whether the timing and cause of AI chatbot 'rogue' behavior can be predicted, a step toward anticipating safety failures.
AI Endpoint Management: From Visibility to Automated Remediation
AI tools are shifting endpoint security from reactive cleanups to continuous, prioritized action across visibility, compliance, and patching.
Microsoft Teams to Integrate Third-Party Deepfake Detection
The move lets organisations plug external deepfake and impersonation detection into Teams meetings, addressing rising AI-driven fraud concerns.
Threats Roundup: Rogue Ransomware, Malicious VS Code Themes, and PQC Gaps
A weekly roundup of security stories shows attackers exploiting both elaborate multi-stage chains and simple configuration mistakes.
FBI and French Police Seize Sites Selling Stolen Intimate Images
Law enforcement took down two websites that trafficked hacked and stolen explicit images of 17,000 women and girls, and arrested a suspect in France.
Maryland man guilty of $53M Uranium Finance hack
A Maryland man was convicted of stealing more than $53 million by hacking the Uranium Finance crypto exchange twice in April 2021.
Phishing scam targets YouTube creators with fake sponsorship deals
A new phishing campaign lures YouTube creators with fake brand sponsorships to steal their Google accounts.
Leaked chats show Russian extortion gang sent 'agents' into US law firms
A leaked message cache indicates a Russia-based ransomware group planned physical infiltrations of US law firms, a tactic the FBI has also documented.
Forgotten OAuth Grants Become Attackers' Entry Point
OAuth grants are multiplying faster than security teams can review, and the Klue breach shows attackers are exploiting the leftovers.
AWS Bedrock AgentCore Flaw Could Let One Chatbot Take Over Entire Fleet
A patched vulnerability in AWS Bedrock AgentCore showed how a single malicious prompt to one AI agent could compromise an organization's whole AWS environment.
Rein Security Raises $25M to Protect AI Agents at Runtime
The funding will help Rein Security expand its runtime protection for AI agents, a growing security concern.
Empire Market co-creator sentenced to 40 years for $430M dark web scheme
The sentence shows law enforcement is still holding dark web marketplace operators accountable years after their platforms are taken down.