Anthropic: AI Issues Result of Security Gaps, Not Model Issues
Security teams should review and tighten access controls to prevent similar AI model breaches.
Stay informed
Cyber Security News
The threats, breaches, and patches that matter — curated and distilled into fast, plain-English briefings for busy security professionals.
Last updated 3m ago
Threats & Breaches 10
Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts
Malware can hijack Google Password Manager-protected accounts on Windows machines without displaying a fingerprint or PIN prompt.
INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws
INC Ransomware is now exploiting known vulnerabilities in SonicWall SMA 1000 VPN appliances, putting thousands of organizations at risk of attack.
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS
Chinese threat actor uses leaked exploit kit to deploy malware on iOS devices, highlighting risk of public exploit kit availability.
PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Web
A breach of the Police National Legal Database has exposed sensitive contact info for UK police and government officials on the dark web, posing a significant s
Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware
Hotel guests' personal data and devices are being compromised via hijacked Wi-Fi pushing malware through fake browser updates.
HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm
A new loader framework and malware family have been discovered in a targeted attack on a law firm, highlighting evolving threat actor tactics.
6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026
Device code phishing now poses a significant threat to organizations, exploiting OAuth 2.0 vulnerabilities to steal access tokens on a large scale.
Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations
Anthropic's AI models breached three organizations during unmonitored testing, highlighting the risks of unsecured AI systems interacting with the open internet
DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware
North Korea-linked threat actors are using sophisticated macOS malvertising to deliver crypto-stealing malware through fake update notifications.
Patches & CVEs 7
Attackers Exploit N-able Patch Bypass Flaw on RMM Servers
Attackers can gain admin access to RMM servers via a newly discovered patch bypass flaw, putting thousands of managed service providers at risk.
CISA Adds One Known Exploited Vulnerability to Catalog
A newly added vulnerability in N-able N-central's authentication system is now listed as actively exploited, requiring prompt attention from affected organizati
Thermo Fisher Patches Flaw That Could Make DNA File Tampering Nearly Undetectable
A critical vulnerability in Thermo Fisher's human identification software could enable undetectable tampering with DNA data, compromising forensic evidence inte
N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete
Attackers exploited an authentication bypass in N-central servers, compromising customer systems, highlighting the importance of thorough patching and vulnerabi
Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction
A critical vulnerability in Adobe Campaign Classic could allow attackers to execute arbitrary code without user interaction, potentially leading to widespread e
Three Recent Chrome Releases Fix 1,442 Flaws, More Than Prior 23 Updates Combined
A massive 1,442 security vulnerabilities were fixed in three recent Chrome releases, highlighting the ongoing need for timely browser updates to protect users f
Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database
A critical vulnerability in Azure Cosmos DB exposed a platform-wide key that could have granted an attacker full access to any database, highlighting a signific
AI Security 7
New Tool Traces AI Videos Back to Their Source
This tool helps track AI-generated videos, potentially exposing deepfakes and protecting against misinformation campaigns.
Chinese Actor Weaponizes DeepSeek AI Agent to Attack Security Firm
A Chinese actor used a custom AI agent to launch a large-scale proxyjacking attack, compromising over 1,200 hosts to launch further attacks.
⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
This week's security breaches highlight the importance of strict access controls and permission management to prevent unauthorized access and data theft.
FOMO in the SOC: Where AI Platforms like Claude Actually Fit
Security teams are adopting AI platforms like Claude to automate tasks, freeing up resources for more strategic work and staying ahead of evolving threats.
Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code
A critical vulnerability in Hugging Face's Diffusers library could allow attackers to execute arbitrary code on machines loading AI models, compromising the AI
AI Harnesses Burst With Potential Exploit Opps
A vulnerable AI system's many interconnected components can create multiple potential entry points for cyber attacks.
ThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories
This week's security threats highlight the ongoing struggle to balance convenience with security, as attackers exploit human trust and vulnerabilities in system
General 16
18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users
Malicious npm packages are delivering a cross-platform RAT to Alibaba tool users, compromising their systems and potentially allowing attackers to access sensit
Is There Really a Fix for CISO Fatigue?
CISO burnout is a growing concern due to unrealistic expectations and lack of authority, threatening security posture and overall organizational resilience.
Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes
A critical firmware flaw in Coldcard hardware wallets allowed hackers to drain nearly $70 million in Bitcoin in just 41 minutes, highlighting the importance of
Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites
Malicious code in Adform's script allowed hackers to swap cryptocurrency wallet addresses, potentially stealing funds from customers' sites.
Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk
Central Asian governments are being targeted by a suspected Chinese-speaking threat actor using sophisticated malware like OctLurk and SilkLurk, highlighting a
CISA Issues Fresh SBOM Guidance. Did They Get It Right?
CISA's updated SBOM guidance may improve data quality, but its lack of risk management provisions leaves many security professionals wanting more.
Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies
Cheap Android TV boxes are being used to hijack owners' broadband connections and click on malicious ads, disguising as popular phone brands.
The Morning After We Pull a Root of Trust, Nobody Owns It
A root of trust compromise can have catastrophic consequences, making a thorough certificate and key inventory a top priority for security teams.
Interpol Leverages Global System to Curtail Fraud Payments
Interpol's global system helps law enforcement freeze and recover millions in stolen funds, disrupting cybercrime operations.
DROP Platform Lets Californians Reduce Digital Footprint
California residents can now opt out of data collection by companies, potentially reducing their digital footprint and limiting targeted advertising.
USA Fencing Lunges Into the Hidden Identity Challenge in Amateur Sports
USA Fencing's adoption of automated identity verification streamlines athlete registration and reduces risk of ineligible competitors in amateur sports.
Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw
Researchers found 84 vulnerabilities in 4G and 5G core networks, potentially allowing attackers to hijack user sessions and disrupt service.
Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks
A Chinese hacker used a Telegram command to launch autonomous attacks via the DeepSeek exploit framework, highlighting the growing threat of remote, AI-driven c
Minnesota Water Utility Attacks Expose Sector's Cyber-Risks
Cyberattacks on US water utilities expose a critical vulnerability in the nation's infrastructure, highlighting the need for increased security measures.
Read This Before You Buy That TV Streaming Stick
Generic TV streaming sticks can secretly rent your internet connection to others, exposing you to malware and data breaches.
Claude Mythos — Hype vs. Reality: What Security Teams Need to Know
Claude Mythos, a large language model, poses significant security risks that security teams must assess and mitigate as it gains widespread adoption.