Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks
The high-severity, unauthenticated vulnerability tracked as CVE-2025-25249 was patched in January 2026. The post Fortinet Code Execution Flaw Exploited in Pi...
general
20 articles
Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America
Threat actors targeting organizations across Latin America are increasingly embedding commercial large language models (LLMs) into intrusion workflows, using...
Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days
Four espionage groups used the BlueMoon Chrome+Windows exploit kit within 12 days. Researchers suspect AI development.
Product showcase: GitGuardian Honeytoken catches credential theft as it happens
Credential harvesting on developer machines has widened. Earlier infostealers worked from a short list of known targets, mostly browser stores and a few clou...
Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers
Threat intelligence firm GreyNoise has identified an AI-driven intrusion campaign, likely orchestrated by a Russian-speaking threat actor, that compromised a...
China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks
Researcher has discovered a rapidly spreading exploit kit called BlueMoon, which combines vulnerabilities in the Chrome browser with a Windows kernel privile...
Cybercriminals are building phishing pages that exist only inside victims’ browsers
A phishing campaign routes victims through genuine Microsoft OAuth and Teams infrastructure before showing them a fake login page built entirely inside their...
Anthropic Claude AI Models Attack Real Systems During Misconfigured Cybersecurity Tests
Anthropic has reported four cybersecurity evaluation incidents in which pre-release Claude AI models gained unauthorized access to real third-party systems a...
AI adoption brings new security headaches for already stretched CISOs
CISOs are taking on AI governance without a matching increase in resources or expertise, adding to an already broad remit spanning data protection, identity,...
A new open standard locks AI weights to approved hardware
OPAQUE, a confidential computing company that runs AI workloads inside hardware-isolated environments so operators cannot inspect them, released an open stan...
Kevin Mandia joins the Amazon board with 30-plus years in cybersecurity
Amazon elected Kevin Mandia to its Board of Directors on September 8. Mandia founded Mandiant and served as its CEO before Google acquired the firm in Septem...
Multiple crypto companies warn customers of phishing emails after alleged provider breach
Subscribers to newsletters from Trezor, CoinTracking and BitBox received corrupted messages through an email provider that all three companies use.
Gigabud banking trojan uses app cloning to evade fraud detection
Researchers at Group-IB have identified that Gigabud is now being paired with Vwork, a modified version of the Shelter app, attributed to the GoldFactory thr...
Over 36,000 Plex media servers remain unpatched against security vulnerabilities
The unpatched Plex Media Server instances are running versions 1.43.
US lawmakers ask government to ban 3 hack-for-hire firms
Democratic senators Ron Wyden and Sheldon Whitehouse, along with Republican congressman Pat Harrigan, sent a letter to U.S.
Pentagon weighs CMMC reforms after industry feedback
The CMMC program, particularly its Phase 2 requirements, faced criticism for being overly burdensome and costly for small and medium-sized businesses.
Orchid Security adds AI agent controls to identity platform
The new capabilities address the challenge of AI agents inheriting access through existing vulnerabilities like hard-coded credentials and dormant accounts, ...
Web DDoS attacks more than double in 1st half of 2026, Radware report finds
The Radware H1 2026 Global Threat Analysis Report indicates a significant shift in attack methods, with direct-path volumetric floods, particularly stateless...
Shai-Hulud npm worm resurfaces, bypassing security scans
Researchers at Aikido Security discovered four packages containing the Shai-Hulud worm, which had the same malicious payload hash as the original attack from...
Geordie AI launches cost intelligence for enterprise AI spending
The system measures spending agent by agent across cloud, code, and endpoints, offering a more comprehensive view than gateway-centric tools.