PHP Warns of Two Critical Flaws, Emergency Patches Due Tomorrow
The PHP team is rushing out emergency security updates after details of two critical vulnerabilities leaked early.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
Calendar invite attacks surge 1,216% in a month, security firms warn
Malicious calendar invites are becoming a fast-growing attack vector, with one vendor reporting a 1,216% monthly spike.
Eight eMudhra CA Keys Compromised; Browsers and Software Block Certificates
Emergency fixes from Google, Mozilla, Apple, and others follow the compromise of eight eMudhra intermediate CA keys.
Ransomware attackers threaten employees' families at 37% of firms
A Semperis survey of 1,200 IT and security professionals finds ransomware gangs increasingly use personal threats, stalking, and swatting to pressure victims into paying.
Revolut outage disrupts app and online banking worldwide
A global Revolut outage affected most services, underscoring the reach of fintech banking disruptions.
OVHcloud CLI Releases Backdoored on GitHub to Steal Developer Secrets
A supply-chain attack swapped five OVHcloud CLI releases for secret-stealing builds, exposing developers who installed during a 94-minute window.
Teradata adds post-quantum encryption and immutable backups for AI data
New Teradata capabilities aim to protect enterprise AI data with identity separation, post-quantum encryption, and tamper-proof recovery.
US Army's ECHOTRIBBLE program seeks AI agents that self-replicate and vanish
The US Army is developing offensive AI agents under a program called ECHOTRIBBLE that can infiltrate networks, copy themselves, and erase all traces.
Chrome Enhanced Protection adds suspicious-site warnings and ClickFix detection
Google is expanding Chrome's Enhanced Protection with two-stage site warnings and server-side Gemini analysis that targets ClickFix-style command scams.
US Agencies Issue Voluntary Response Playbook for Rogue AI Incidents
NIST, CISA, and NSA have published ten recommended practices to help organizations handle incidents involving malicious or uncontrolled AI agents.
Qilin and INC Ransomware Exploit PAN-OS Flaw to Bypass MFA
Active exploitation of a patched PAN-OS authentication bypass shows ransomware groups targeting virtualization layers to disable security controls.
FortiSIEM Critical Flaw Gets Public PoC for Unauthenticated RCE
A proof-of-concept exploit now publicly demonstrates how an unauthenticated attacker can achieve remote code execution against unpatched FortiSIEM appliances.
CISOs Urged to Fix Identity Gaps in Dev Workflows Before AI Adoption
A Dark Reading roundtable finds that closing identity and access gaps in the software development lifecycle is a prerequisite for safely using AI.
Anti-Putin Hack Disrupts Russian School Assessments
A cyberattack on Russia's education testing platform replaced questionnaires with anti-Kremlin messages, forcing a nationwide suspension of student assessments.
CJIS v6.1: Five Practical Compliance Priorities for Agencies
New guidance from Specops highlights MFA, account management, passwords, logging, and audit readiness as core focus areas for agencies meeting CJIS v6.1.
AI Software Security Hinges on Developer Maturity, Not Speed
The maturity of AI adoption among developers, not the pace of rollout, determines how effectively security risks are managed.
ThreatModeler NexusAI Automates Threat Model Maintenance
The new AI agent within ThreatModeler Nexus aims to keep threat models current as application architecture changes.
Abstract adds AI investigation and automated response to its agentic SIEM
The update links SOAR-style response actions directly to detection rules, with AI triage built into the same data plane.