17 old software bugs that took way too long to squash
In 2021, a vulnerability was revealed in a system that lay at the foundation of modern computing. An attacker could force the system to execute arbitrary code.
enterprise
20 articles
Metabase SQLi exploit grants attackers total access
Business intelligence (BI) platform provider Metabase has disclosed a zero-day SQL Injection vulnerability, warning that customers’ sensitive credentials, to...
Patch Tuesday August 2026: A zero-day WinSock driver hole under exploit, and a maximum severity SAP vulnerability
A currently exploited zero-day elevation of privilege vulnerability that needs to be patched in a Windows driver for WinSock is the highlight of the 398 fixe...
Zoom zero-click RCE flaws allow attackers to compromise meeting participants
Zoom has fixed four vulnerabilities across its applications, including two that could allow attackers who join a meeting to execute malicious code on the sys...
GitHub already has an EDR. You just have to listen to it
Many of the recent supply-chain attacks could have been caught earlier if defenders looked closely at the telemetry GitHub already provides, researchers said...
OpenAI launches GPT-5.6-Cyber as AI narrows vulnerability response window
OpenAI has expanded its Daybreak cybersecurity program and introduced GPT-5.6-Cyber, a specialized model for approved security researchers, as the company wa...
Security leaders’ rogue AI confidence could actually be disastrous
A large majority of IT and security leaders are confident in their teams’ ability to detect when an AI agent has gone rogue, but few are able to take quick a...
The future of AI security research isn’t autonomous, it’s human-amplified
Meet HTTP Terminator, a new AI system that has identified hundreds of websites vulnerable to HTTP request smuggling, hacked them live at scale, and even iden...
OpenAI says Astra could reach ‘critical’ cyber capability, tightens safeguards
OpenAI said its upcoming model Astra is showing cybersecurity capabilities that could reach its highest risk category, where a system can autonomously find a...
One-click flaw in Atlassian Rovo exposed enterprise data via prompt injection attack
Atlassian’s enterprise AI assistant Rovo, which is usually connected across sensitive work environments like Slack, Microsoft 365, and Google Workspace, was ...
4 million fake applications and one blind spot: A SOC playbook for OAuth client ID spoofing
Key takeaways OAuth client ID spoofing defeats detections that key off application name or a known application ID, because the field itself is fabricated, ro...
Trojanized AI skills gain 1.7M installs in agent-targeted attack
Researchers have uncovered an extremely effective attack campaign that involved AI agent skills trojanized to deploy a credential stealer. The incident is pa...
Moonshot’s Kimi AI model has also escaped from a test environment
Yet another AI model has escaped from a cybersecurity test lab: This time, it’s the Chinese company Moonshot’s Kimi K3 model on the run. Frontier Security sp...
Snowflake attacker pleads guilty to hack of 165 companies’ data
A Canadian hacker has admitted being part of a group responsible for several major cyberattacks. Connor Riley Moucka pleaded guilty to being part of a coteri...
Python package security in 2026: How supply chain attacks are targeting your AI development environment
On March 24, 2026, developers building AI applications with LiteLLM — a Python package with 95 million monthly downloads — unknowingly installed malicious co...
Human oversight is still critical as AI patching tools miss security risks
AI-generated vulnerability patches still heavily depend on human review, particularly the ones involving security-sensitive code, according to a research. Re...
What does a data breach cost? AI is a sizable factor
The financial impact of a data breach is substantial for any modern business, regardless of industry or size. IBM’s latest Cost of a Data Breach report disco...
Why exposure management is replacing vulnerability management
Vulnerability management isn’t failing because security teams lack visibility. Most organizations already have more findings than they can reasonably address.
NatJack exploits put NAT security assumptions to the test at Black Hat
For decades, Network Address Translation (NAT) has been the default way IP addresses are provided inside larger networks, as a means to deal with the challen...
How a software provider closed unknown paths to cloud compromise
A healthcare software provider believed its segmented environment was reasonably secure. The company had invested heavily in layered controls across a distri...