Windows Defender’s own driver can leave systems defenseless
A Microsoft-signed Windows Defender remediation driver can be repurposed into a kernel-level “operation engine” capable of deleting files, modifying the regi...
enterprise
20 articles
7 ways AI can be used to enhance security operations
AI has an almost unlimited number of applications, yet none may be more important than its ability to strengthen enterprise security. AI marks a new era of b...
OpenAI adds an AI safety layer to detect misuse without retaining enterprise data
OpenAI is adding a new safety capability that allows enterprises to detect misuse of its AI systems across multiple interactions without retaining prompts or...
Backdoored Rust packages hit crates.io, exposing developers to malware at build time
Malicious versions of three Rust packages, including the widely used arrayref, were published to the crates.io registry on August 20, carrying a backdoor tha...
AI threats are everywhere. A risk-first CISO decides what to prioritize
The good news? AI gives cyber defenders some of the best discovery tooling they’ve ever had.
Ransomware takes aim at enterprise resilience
Ransomware remains one of the most disruptive cyber threats organizations face. Companies have strengthened their cyber defenses over the years, but attacker...
Critical flaw patched in popular JavaScript sandbox used in AI projects
A critical sandbox escape vulnerability was discovered and patched in isolated-vm, a library for running JavaScript code inside an isolated process. If explo...
Citrix issues critical security updates for its NetScaler devices
Citrix is urging its NetScaler ADC and NetScaler Gateway customers to quickly patch two critical security holes, one involving a memory overflow vulnerabilit...
Kriminal breaks out of Grok, Claude guardrails at $12.99
Security researchers are warning of a criminal AI service built on Grok and Claude, among other models, that promises uncensored access to powerful AI capabi...
Airlock Digital Completes Independent IRAP Assessment at the PROTECTED Level
Airlock Digital, a global provider of application control and allowlisting solutions, today announced that it has completed an independent Information Securi...
OpenAI ‘temporarily slows’ scaling efforts, also promises zero data retention for select frontier model customers
OpenAI this week announced multiple moves designed to counter negative perceptions of its security and privacy, saying it had slowed its pace of scaling, imp...
Snowflake flaw slips past AI checks, gets exploited by another AI
An autonomous AI security agent developed by cloud security firm Wiz identified and exploited a critical vulnerability in Snowflake’s GitHub Actions pipeline...
Most organizations aren’t ready for a Hugging Face-level event
The National Security Agency (NSA) and Central Security Service recently published an advisory statement on behalf of the Five Eyes Cyber Security Agencies, ...
CISOs are struggling to threat-model AI. Can 15-minute sessions help?
A few weeks ago, on a busy day, threat-modeling expert Adam Shostack opened an email from a client. Someone at that organization had vibe-coded an app and pu...
Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it
Almost eight months after confirming a critical security vulnerability within the personal version of its AI assistant, Copilot, Microsoft on Tuesday issued ...
Critical GitLab flaw allows attackers to delete and modify public repos
GitLab has fixed a critical vulnerability that could allow unauthenticated attackers to perform unauthorized modifications inside code repositories or to com...
New Malware turns Microsoft cloud into its control center
Security researchers are warning of a newly uncovered Python malware framework that routes much of its command-and-control (C2) activity through Microsoft se...
What you say during a cyber breach can — and will — be used against you
The first 24 hours after a cyber incident are messy. Teams are moving fast, and a lot gets said on Slack or email that can come back later.
AI can find zero-days but still can’t reliably write secure code
In recent months, LLMs have gone from flooding open-source projects and bug bounty programs with questionable security reports that wasted developers’ time, ...
OpenAI president’s blog pushing agentic AI most notable for what it did not say
OpenAI president Greg Brockman on Sunday warned enterprise CISOs that they need to more aggressively embrace agents if they want to survive upcoming cyberatt...