Alabama Subpoenaed OpenAI. An AI Sandbox Escape Is Now a Consumer-Protection Case.
Alabama has subpoenaed OpenAI over the Hugging Face agent incident, testing whether an AI containment failure can become a consumer-protection case.
Security
Vulnerabilities, defensive security, architecture and operational security.
The Plugin Logged the Error and Kept Going. Pods Could Hand an Attacker WordPress Admin.
A WordPress plugin did not merely miss one permission check. Its request path could send the method allowlist, nonce check, login requirement and capability gate through an error handler that logged the failure and returned control to the caller. The…
The Recruiter’s Identity Was Real. The Login Window Wasn’t – Intel 471 Pre-Webinar
Operation Fake KickOff uses fake recruiters, browser-in-the-browser pages and live MFA relay to steal corporate Google Workspace access.
The Vulnerability Backlog Doubled. The Exploited Set Didn’t. ‘Patch Faster’ Is the Wrong Answer.
Rapid7 counted twice as many high and critical disclosures, while newly exploited vulnerabilities stayed near 40. The queue is not the risk model.
The Doors Stayed Open. The Organisation Behind Them Was Running on Emergency IT.
Brandenburg’s seven memorial sites remained open after ransomware disabled central IT. The real resilience story was the emergency operation behind the public doors.
The Seven-Day Timelock Worked. Nobody Used It.
A Term Finance governance proposal sat on-chain for six days without a veto, then removed its own timelock and drained an estimated $8.5 million from the protocol's vaults.
Any Website Could Ask Passportal for the Tokens to the Vault. The Patch Stops the Leak, Not the Architecture.
A malicious website could ask the N-able Passportal browser extension for authentication tokens and receive enough access to enumerate, decrypt and modify credentials across a password vault. The vulnerable extension did not require the attacker to compromise N-able, the managed…
Your Browser Should Not Be an Authentication Boundary for AI Infrastructure
Ray CVE-2025-62593 turns a malicious browser visit into AI infrastructure code execution. Patch Ray and replace browser trust with authentication.
ToxicPanda Blocked Google Play, Then Paired With ADB From Inside the Phone.
ToxicPanda 2.0 abuses VPN permission to cut off Google Play, then automates Android wireless debugging to obtain shell-level capability. The chain shows how legitimate platform functions can become a post-compromise control path.
The Password and MFA Push Were Accepted. Device Trust Still Stopped the Attack.
ReliaQuest says a stolen password and approved MFA push produced a valid session, but device trust blocked every attempt to reach company applications.