Current analysis, technical guidance and reporting across security, infrastructure, automation and artificial intelligence.
A million-plus email campaign combined fake executive approval, a forged ServiceNow invoice and an invented forwarded conversation to seek nearly $50,000 transfers.
Check Point used a shared internal package service to pass hidden tasks between separate ChatGPT accounts. In its demonstration, the victim saw a normal answer while Gmail data crossed the boundary.
Florida identified one compromised police login, improperly stored on an employee's personal device, as the route into its systems. The claimed scale of exposure remains unconfirmed.
Ivanti disclosed eight remote-code-execution flaws in Neurons for ITSM, two requiring no login. Cloud tenants were patched in August, but on-premises administrators must apply the right September patch.
Gen Digital traced a GRAYRABBIT intrusion to a crafted Sogou Input Method link. The link opened a six-year-old browser engine with its sandbox disabled, allowing an old JavaScript exploit to run.
Wiz observed attackers chaining two Artifactory flaws for administrator access and using a third flaw separately. Some intrusions left persistent accounts, malicious plugins and Rust backdoors.
A May package flood forced RubyGems to pause sign-ups and remove more than 500 malicious gems. New research points to AI agents, but the evidence remains disputed.
Anthropic says a Russia-linked espionage operator used AI to monitor detections and keep rebuilding malware until it was no longer detected. The attack cycle, not a single hash, is now the defensive problem.
Microsoft says September’s Windows security updates can destabilise Remote Desktop Services, break sign-ins and leave virtual machines reachable only through their management console.
CISA says attackers are exploiting CVE-2026-85706, a CVSS 10 GitLab flaw that can expose arbitrary server files without authentication. Self-managed operators need to update and investigate.
One compromised contractor session opened cloud applications, patient systems and external health-record portals. HHS says the AdaptHealth breach affected 4,115,802 people.
A nearby device can pair with affected Skullcandy Dime 3 earbuds without pairing mode, a PIN or owner approval. It can then interrupt audio and reach the headset microphone.
