Your enterprise AI footprint is about three times bigger than your model list
Organizations are building AI systems that combine models, agents and external tools instead of relying on standalone AI, according to Snyk’s latest State of...
general
20 articles
National cyber director lays out White House plans to secure AI without writing new rules
The Trump administration executive order on artificial intelligence tried to strike the balance between responsible use, security and mutual benefit, all wit...
OpenAI, Anthropic AI agents targeted real people and systems in cyber tests
OpenAI and Anthropic have confirmed that their AI models were involved in separate, newly disclosed third-party cybersecurity testing incidents that resulted...
AISI, OpenAI report more ‘unsanctioned’ model hacks
Following similar reports by OpenAI and Anthropic, the UK’s top AI testing lab and a private cybersecurity tester say their models exploited parts of the ope...
TP-Link patches Omada ZTP flaws allowing hackers to breach networks
TP-Link has patched 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada network devices that could be chained with previously disc...
Massive supply-chain attack compromises 440 packages under four hours
Researchers from multiple security firms observed a variant of Mini Shai-Hulud, self-replicating malware linked to TeamPCP, in all the affected packages. The...
Phishing service spoofs RingCentral to steal Microsoft 365 accounts
The Greatness phishing-as-a-service (PhaaS) platform has expanded from credential phishing to adversary-in-the-middle attacks and device-code phishing target...
Randomness, Grey, Deepseek, Sonicwall, Spice, CaptiveCrunch, eBay, and Aaran Leyland - SWN #604
OpenAI: Cambodian scam centers used ChatGPT to lure Indian nationals, conduct investment fraud
A tip from WhatsApp led OpenAI to ban multiple accounts associated with investment scams and human trafficking operations based in Cambodian scam centers.
SharePoint Flaws Used to Hack Switzerland’s Federal IT Agency
Swiss Federal IT Agency FOITT says attackers exploited SharePoint flaws to compromise about 200 accounts. Servers are being rebuilt as investigations continue.
New npm packages deliver remote access trojan targeting Alibaba developers
A new set of malicious npm packages were discovered targeting users of Alibaba developer tools with a cross-platform remote access trojan (RAT).
Bogus SQLite vulnerabilities highlight flaws in CVE pipeline
The Register reports that a batch of critical and high-rated SQLite CVEs, which were recently added to the National Vulnerability Database (NVD) with enrichm...
Fake Roblox Xeno executor installers distribute malware
Fake Xeno Executor installers are targeting Roblox players with malware that provides remote access and steals sensitive information.
Russia-linked Midnight Blizzard targets hotel Wi-Fi networks in US, Europe
Hotel Wi-Fi phishing campaign targets business travelers, Microsoft warns.
New XCSSET variant targets macOS devs via compromised Xcode projects
A new version of the XCSSET malware is targeting thousands of macOS users through compromised Xcode projects and GitHub repositories. [.
Iran Cyberattacks Against Minnesota Water Systems
Attribution is preliminary, and so far it seems no real damage. And it seems like this is a campaign that has targeted at least seven states.
77 Open VSX extensions found harvesting developer info
77 extensions on the Open VSX marketplace impersonated legitimate developer tools while transmitting information about the systems and development environmen...
Shai-Hulud npm Worm Returns, Poisoning Over 1,280 npm Packages
Shai-Hulud npm worm spreads through Keyv and hundreds of packages with 2 billion monthly downloads, stealing npm, GitHub, cloud and CI credentials in real time.
Dem senators criticize Trump administration decisionmaking on AI security risks
The five senators said the administration has alternated between being too passive and overstepping, and China stands to benefit as a result. The post Dem se...
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a r...