The in-house Python script behind eMudhra’s October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys.… Read More »eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and traceability that’s separate from any human’s. That was… Read More »We Built An Agent That Broke All of Our Security Rules. Here’s What We Learned.
An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen… Read More »Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It… Read More »Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges
Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726… Read More »Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing… Read More »Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America,… Read More »Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which… Read More »Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access
An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI’s inference servers last Sunday. The attacker could also… Read More »SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users
A flaw in Git can let a malicious repository run an attacker’s code on a computer that clones it recursively, together with its submodules. The Git project fixed it this… Read More »Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones