The AI Malware Wave Was Mostly a Sandbox Artifact. Only 12 of 405 Samples Reached Production.
Unit 42 found only 12 of 405 AI-enabled malware samples on production endpoints, exposing the gap between public repositories and operational activity.
Security
Vulnerabilities, defensive security, architecture and operational security.
One Hosting Customer Could Read the Server’s Secrets. Another Plesk Flaw Gave Them Root.
Two vulnerabilities disclosed within minutes of each other turned an ordinary Plesk hosting subscription into a route towards control of the entire server. One could expose Plesk administrator and database credentials through the DNS-management interface. The other could execute arbitrary…
TrueConf Was On-Premises. Attackers Turned It Into a Malware Distributor.
CISA says attackers are exploiting two TrueConf Server flaws that bypass authentication and escape the sandbox. Head Mare used them to replace trusted client installers with backdoored copies.
The Keys Were Safe. BounceBit Still Lost Control of the Ledger.
BounceBit is retiring its Layer 1 after a protocol authorization flaw moved 286.5 million BB without stealing keys or forging signatures. The failure sat inside the ledger's authority model.
The Algorithm Suspended the Driver. The Regulator Called It an €825 Million GDPR Violation.
A €824.99 million Dutch GDPR fine against Uber turns meaningful human review from an AI-governance slogan into an operational control.
The WordPress Plugin Said It Was Up to Date. Attackers Could Still Become Admin.
Two miniOrange SAML flaws let attackers forge administrator logins. The larger failure was operational: six paid editions could appear patched, receive no dashboard update, and remain invisible to vulnerability databases.
The Tracker Can Disappear. Targeting and Metrics Still Leak the Audience.
Research finds that privacy-protected ad targeting and campaign metrics can compose into an inference channel. The result is a systems limit, not evidence of misuse by one named platform.
One Prompt Poisoned the Agent’s Memory for Later Questions.
InjecMEM shows how one normal interaction can plant a record that later retrieval turns into an instruction inside an AI agent’s context.
Alabama Subpoenaed OpenAI. An AI Sandbox Escape Is Now a Consumer-Protection Case.
Alabama has subpoenaed OpenAI over the Hugging Face agent incident, testing whether an AI containment failure can become a consumer-protection case.
The Plugin Logged the Error and Kept Going. Pods Could Hand an Attacker WordPress Admin.
A WordPress plugin did not merely miss one permission check. Its request path could send the method allowlist, nonce check, login requirement and capability gate through an error handler that logged the failure and returned control to the caller. The…