Infosecurity Magazine
Head of AI Security Roles Surge in Large Organizations
A new IANS report has found that despite the growth of the head of AI security role, accountability for AI governance in firms remains unsettled
آرشیو ۹۰ روزه
همه اخبار
جستوجو در عنوان، خلاصه یا نام منبع. هر خبر به صفحه اصلی خودش لینک دارد.
۱۱۸۱۶ خبر
صفحه ۴۸ از ۳۹۴
Dark Reading
Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree
A Chinese-speaking attacker has compromised hundreds of websites across the globe, looting from big fish like John Deere, SharkNinja, and engine manufacturer Cummins.
Microsoft Security Response Center
CVE-2026-96913 Windows Kernel Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
Microsoft Security Response Center
CVE-2026-83839 Windows Hyper-V Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
Microsoft Security Response Center
CVE-2026-83782 Windows Shell Remote Code Execution Vulnerability
Updated an acknowledgement. This is an informational change only.
Microsoft Security Response Center
CVE-2026-70337 Microsoft PowerShell Remote Code Execution Vulnerability
Updated an acknowledgement. This is an informational change only.
Microsoft Security Response Center
CVE-2026-70074 Windows DNS Information Disclosure Vulnerability
Updated an acknowledgement. This is an informational change only.
Microsoft Security Response Center
CVE-2026-62913 Microsoft Exchange Server Remote Code Execution Vulnerability
Updated an acknowledgement. This is an informational change only.
Microsoft Security Response Center
CVE-2026-102204 Windows Subsystem for Linux Elevation of Privilege Vulnerability
Updated CVE to relect that this vulnerability is in the Windows Subsystem for Linux product. Microsoft recommends that customer using this product should install the latest version to be protected.
Infosecurity Magazine
Researchers Warn OpenCode Quietly Patched Critical RCE Flaw, Leaving Users At Risk
OpenCode silently patched a critical RCE flaw, leaving vulnerable users unaware of the security risk, researchers at Pillar Security warned
Flare
Arachnophobia: How Fear, Branding, and Bad Attribution Distorted The Com
Part 1: The Ecosystem and the Actors By Jon DiMaggio, Cybersecurity Researcher The most dangerous thing about The Com isn’t any single group inside of it, but that the ecosystem replaces them faster than law enforcement can arrest the ones already operating. In 2025 and 2026, law enforcement handed down real sentences to real people […] The post Arachnophobia: How Fear, Branding, and Bad Attribution Distorted The Com…
The Register - Security
'Password1' and a forgotten test account land Welsh outfits in hot water
ICO reprimands Ogi Networks and Data Cymru after ransomware breach exposes info of 3,300 people, mostly children
Mozilla Security Blog
Protecting Firefox users following the compromise of eMudhra intermediate certificates
On Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised. These keys could allow attackers to issue … Read more The post Protecting Firefox users following the compromise of eMudhra intermediate certificates appeared first on Mozilla Security Blog.
Cisco Security Advisories
Cisco Unified Intelligence Center SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could…
SOCRadar
30 Questions to Ask Before Buying an AI Pentesting Tool
“AI pentesting” now covers very different products. Some platforms plan and run attack chains on their own and return exploitation evidence for every finding. Others are vulnerability scanners with a language model summarizing the output. On a datasheet, or in a scripted demo against a vendor-prepared target, the two can look almost identical. The 30 […]
Horizon3 Attack Research
CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE
Horizon3 researchers analyze CVE-2026-106173, a critical Fortinet FortiSIEM vulnerability affecting an unauthenticated gRPC service. The deep-dive explains how path traversal and null-byte handling enable arbitrary file writes and remote code execution, along with indicators of compromise for defenders.
The Register - Security
Bullhorn sees red after cyberattack knocks recruitment platform offline
Staffing software giant calls in CrowdStrike as customers face login headaches and questions remain over possible data theft
SOCRadar
Japan Data Breaches 2026: Inside the October Surge
Japan is facing a dense wave of breach disclosures. Since late September, at least 20 major Japanese companies have reported breaches, including Times Car, Lawson, Yakiniku King, Sourcenext and Burger King Japan, and a ransomware attack on SoftBank’s IDC Frontier cloud took 495 customer organizations offline. Between September 25 and October 8 alone, at least […]
SOCRadar
INC and The Gentlemen Ransomware: Exposed AI Infrastructure
SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen Ransomware...
Schneier on Security
Possible new Cellebrite iPhone Radio Zero-Day
Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him: Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the “advanced unlocking services” they’ve marketed for years. A press release from earlier this year confirms AU is a new product for 2026. […] According to Cellebrite, AU: is a “next-generation AFU vector that is more resilient to Apple’s OS changes…
Security Affairs
AfD Email Breach Exposes 421,000 Messages in Anonymous Online Archive
A data breach exposed AfD emails, while an anonymous site published AI summaries of 421,000 messages, raising questions about authenticity and privacy. Germany’s Alternative für Deutschland (AfD) confirmed on October 19 that its hosting provider was hacked in September and that mailboxes were copied. By the time the confirmation reached Bild, a website called hexane.cc […]
Infosecurity Magazine
Siemens Customers Targeted by ClickFix Attackers Exploiting DLL Side-Loading Flaw
Siemens identified the activity to be from the Romulus multi-platform ClickFix campaign, with Siemens Software Center users urged to apply an update
Graham Cluley
Police arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient’s death
A 28-year-old Russian man has been arrested by German police, suspected of being a key member of the Qilin ransomware gang. Detectives have linked the man to the attack against blood-testing firm Synnovis, that disrupted London hospitals, and resulted in the death of a patient. Read more in my article on the Hot for Security blog.
The Register - Security
Why cyber resilience is now a boardroom priority for UK public services
PARTNER CONTENT: What happens after the inflection point?
Security Affairs
Microsoft Treats AI Agents as Insider Threats in New Security Framework
Microsoft urges organizations to secure AI Agents as insider threats, using dynamic permissions, continuous risk monitoring and automated containment. Microsoft published a detailed blog post explaining how organizations should secure AI agents. Microsoft sees them as a growing insider threat, not just a possible risk in the future. AI agents are not dangerous by nature, […]
GitLab Blog
Uncover the business logic vulnerabilities SAST scanners miss
Broken object-level authorization ranks first on the OWASP API Security Top 10, and OWASP says that traditional static application security testing (SAST) tools struggle to find access control flaws. A missing authorization check is an absence of code, so a scanner that matches patterns has nothing to match. You can find the gap only if you already know what the endpoint is meant to enforce.We're building Business Lo…
GitLab Blog
Redesign how your team ships software with AI agents
AI agents are sending more and more code into review queues built for human-paced work. A coding assistant can speed up code writing, but it can’t show you whether review, security checks, and release approvals can keep pace with all that extra code. AI-native engineering — the practice of intentionally designing the engineering process so people and agents each do what they are best suited to — starts with identifyi…
Quarkslab
MbedTLS Security Audit
At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.
Dark Reading
Researchers Infiltrate Microsoft Tech Support Scam Operation
A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.
The Register - Security
Grocery giant Ahold Delhaize confirms cyberattack forced US and European systems offline
Second security snafu in two years