The File That Turns One Windows Breach Into Every Password in the Domain
This was a controlled simulation, not a newly disclosed victim breach. Its value is showing where defenders can still break the chain before domain credentials leave.
AI Agents Attacked 105 Retailers in Six Days for About $25 Each
The operator supplied short instructions. The agents did the patient probing, exploitation and persistence at a pace most defenders were not built to match.
CISA Gave Zyxel Switch Owners Until Thursday to Fix an Exploited LAN Flaw
The flaw is reachable from the local network, not necessarily the public internet. That makes internal exposure and earlier compromise the questions that matter.
KATARU Bundled Four Linux Root Tricks That Did Not All Fit the Device
The malware looks ambitious: encrypted control, persistence, DDoS and multiple root exploits. The analysed ARM sample also carried x86 shellcode and inert checks.
What ShinyHunters Actually Proved by Defacing Clop’s Leak Site
The takeover proved control of what visitors saw. It did not by itself prove possession of Clop's server logs, source code or Tor private keys.
Fake Job Interviews Put 30,000 Devices and 7,000 Wallets in North Korea’s Reach
The coding test was the payload. Officials say the developer-focused campaign accumulated more than $10.7 million in transfers.
The AI Celebrity Wants Your Face, Your Age and Your Mood Before It Talks
The service says age-check images are deleted. The live call still sends video, audio, transcripts, memory and mood-related data through multiple providers.
Google Put AI on Every Code Change and Cut False Positives to 3%
Google moved AI security review into every code check-in, then added deterministic triage and human-reviewed fixes to keep the agents honest.
Who Would Hold California’s AI Off Switch?
Protect the restart, too.
A Memory Edit Can Walk Straight Through GX Works3 Password Protection
The block password can remain configured while a local attacker changes the engineering tool's execution state and bypasses it.
SolarWinds Shipped a Release With No Features, Just an Unauthenticated RCE Fix
Access Rights Manager maps who can reach sensitive systems. A static key meant an unauthenticated attacker could reach the manager itself.
Bounty Claims Need Independent Evidence
Make intake checks independent.