Max severity GitLab path traversal flaw under active reconnaissance
The flaw could enable sensitive files to be read with just an HTTP request.
SC Media
20 articles
9/11 at 25, OfferLoader, Gemini CLI, Liquid, 10% Doom, Josh Marpet, and More - SWN #615
Check Point patches two critical VPN gateway bugs
Check Point fixed two 9.8-severity VPN flaws before any known exploitation in the wild.
Dead drops in public: What the AI agent stashed on Hugging Face
A technical breakdown of artifacts the agent left in public repositories during the July 2026 Hugging Face intrusion.
Anthropic finds 4th real-world attack by Claude agent, details models’ ‘biased reasoning’
Mythos 5 was highlighted as being especially prone to believing the real world was a simulation.
AI governance needs to become part of the CISO’s GRC program
Here's why CISOs must include Ai in the company's GRC program.
Ping YOUniverse: How to classify and manage AI agents
There are four kinds of AI agents, and each must be handled differently, Ping executives said.
How coding agents are changing application risk
Coding agents expand application risk beyond AI models to the tools, context and systems around them.
It's More Secure When It's Disabled - PSW #943
When English becomes exploit code: The hidden risk inside MCP servers
A harmless-looking sentence can influence an agent's choices once it enters a model's context.
CISA: WatchGuard Firebox bug exploited in ransomware campaigns
Ransomware gangs are exploiting a WatchGuard Firebox flaw that CISA flagged nine months ago.
A security framework for coding agents and their harnesses
The five layers of securing AI agent harnesses.
What CIO-CISO alignment looks like when it's working
Cushman & Wakefield leaders share five practices for building an effective CIO-CISO partnership.
A credo for the AI era: Trust, but Decompile
Here’s why defenders today have to take apart and analyze code the way a hacker would.
PaperCut MF/NG flaws attacked with hundreds of AI agents
The AI-assisted campaign enabled attackers to gain domain admin in as little as 5 minutes.
Skullcandy Dime 3 earbuds vulnerable to Bluetooth hijacking
The vulnerability, tracked as CVE-2025-20701, affects firmware version 1.0.
Gigabud banking trojan uses app cloning to evade fraud detection
Researchers at Group-IB have identified that Gigabud is now being paired with Vwork, a modified version of the Shelter app, attributed to the GoldFactory thr...
Over 36,000 Plex media servers remain unpatched against security vulnerabilities
The unpatched Plex Media Server instances are running versions 1.43.
US lawmakers ask government to ban 3 hack-for-hire firms
Democratic senators Ron Wyden and Sheldon Whitehouse, along with Republican congressman Pat Harrigan, sent a letter to U.S.
Pentagon weighs CMMC reforms after industry feedback
The CMMC program, particularly its Phase 2 requirements, faced criticism for being overly burdensome and costly for small and medium-sized businesses.