What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,635 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 2d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 2d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 2d ago
-
Quoting Ben Hylak
every product i use should just be a headless mcp, that feeds into an agent, where i never have to think about anything underneath. except for our product, of course. in our product, customers love the ui and love us very much. we…
-
3 Ways AI Agents Already Operate in Your Browser
AI agents can control authenticated browsers, interact with corporate applications, and access sensitive data while appearing to act as legitimate employees. Keep Aware examines three ways agents operate inside browsers and why tr…
-
Reports of SIEM's Death Have Been Greatly Exaggerated
SIEM isn't dead. Its bloated pricing model is. Discover why legacy pricing models need to go, how AI fits in, and how to build a smarter, cost-effective security logging strategy.
-
Fake Anthropic AI previews lure in overeager employees
Everyone wants to know what Anthropic is up to, and hackers are gleefully exploiting the fact. New research from cyber security company Cofense describes a phishing campaign that hooks overeager enterprise users by making them thi…
-
Google says Gemini 4 Carbon beats its predecessors at finding and fixing security flaws
Google’s Gemini 4 Carbon is a frontier AI model designed for software engineering and cybersecurity tasks, with safeguards built on those of its predecessor, Argon. SEC-bench Pro (Source: Google) Google says its teams have seen Ca…
-
The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers
AI is beginning to take over much of the work that has traditionally defined the security analyst's job. Investigating alerts, collecting evidence, correlating activity across tools, and executing response actions are becoming tas…
-
26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it. Independent researcher Ben Zimme…
-
Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes
The enigmatic service is providing popular AI coding tools to mainland China and other regions where OpenAI and Anthropic products are not officially for sale — but with key security features turned off.
-
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.”
-
Quoting Ted Sanders
In general, LLM performance is incredibly multidimensional. There's no guarantee of a fixed ordering where the model that is best at math is also the model that's best at jokes. Despite that complexity, much of the variation in pe…
-
Victory! You Can Now Exclude Apps from Siri AI
In the most recent update to Apple’s devices, iOS 27.2, the company has introduced a new setting to “Exclude Apps” from Siri AI, fulfilling one of our asks from our Encrypt It Already campaign earlier this year . One of our main c…
-
European digital rights nonprofit noyb sues Scale AI for ‘invasive’ worker surveillance
Noyb alleges the platform in some cases records freelancers’ mouse clicks and keystrokes every few seconds and claims the collected information can be used to generate video documenting freelancers’ entire workday.
-
GitHub Octoverse 2026
GitHub Octoverse 2026 I'm at GitHub Universe today (GitHub gave me a free ticket through their "GitHub Stars" program). EVP Jay Parikh just announced this year's Octoverse report, and highlighted these numbers in particular: This …
-
The CISO’s evolving role: Protecting and defending in the agentic era
As AI and agents reshape the enterprise, CISOs face two critical priorities: enabling innovation with the right identity and data guardrails, and modernizing defense to keep pace with AI-powered threats. Aarti Borkar shares how se…
-
AI Takes Root in Hospital Corridors, Raises Security Stakes
Artificial intelligence (AI) is everywhere in healthcare, from doctors’ intake forms to cancer screenings. But, in some cases, life-and-death uses are outpacing cyber security.
-
I underestimated how fast security teams would trust AI to act in the SOC
For most of my career, I have watched new security platforms work through enterprise programs at a slow pace, so when AI began showing up in security operations tools, I assumed it would follow the same path. I expected AI adoptio…
-
ControlUp’s Pulse AI Resolve diagnoses and fixes IT issues within admin-defined controls
ControlUp has announced Pulse AI Resolve, the real-time investigative AI layer of the Pulse AI ecosystem. A major enhancement of ControlUp’s endpoint self-service capability, previously ControlUp Connect, Pulse Resolve brings AI-p…
-
Attacker Relentlessly Scans for Credentials by Impersonating AI Bots
The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.
-
Digitate adds AI agents for patch planning, service desks, and SAP operations
Digitate has announced ignio Hummingbird, the latest release of its agentic AIOps platform. Hummingbird introduces AI agents that bring operational expertise to specific IT tasks, move from diagnosis through approved action and ve…
-
Swimlane connects custom detections to AI-led investigation and response
Swimlane has announced new capabilities in the Swimlane Turbine platform that allow security teams to run their own detection logic against large volumes of data and send resulting alerts directly into Swimlane AI SOC for investig…
-
VikingCloud gives businesses a scorecard for AI governance readiness
VikingCloud has launched AI Governance Services, a new set of compliance and risk assessments that find the AI tools in use across a business, show where security controls fall short, and deliver a remediation plan to close the ga…
-
The October inflection point for vibe game development
I've written before about how November 2025 was an inflection point for coding agents - the point where Opus 4.5 and GPT-5.1 crossed a tipping point that meant their respective coding agents became reliable daily drivers for softw…
-
Upwind secures $400 million to protect AI across endpoints, code, and cloud
Upwind Security has raised $400 million in Series C funding to expand its cloud and AI security platform, bringing the company’s total funding to more than $800 million. Bessemer Venture Partners led the round, with participation …
-
Fake ChatGPT, Claude apps spread malware via signed AI binaries
Attackers are distributing malware through fake ChatGPT and Claude desktop applications, using legitimate, digitally signed executables from OpenAI and Anthropic to load malicious code onto victims’ Windows systems, according to C…
-
Wazuh and AI for Enhanced SOC Workflows
Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns h…
-
Quoting Terk Terkowitz
If your work does not benefit from current AI tooling, that is a finding, not a failing. Document why, share it with your community of peers, bring it to your manager, and work to find solutions. An engineer who can explain where …
-
Secrets Management Firm Infisical Valued at $600 Million After $40 Million Raise
The company will use the Series B funds to expand its platform for securing AI agents’ access to sensitive systems. The post Secrets Management Firm Infisical Valued at $600 Million After $40 Million Raise appeared first on Securi…
-
CISA updates ScubaGear and ScubaGoggles, and says Microsoft 365 checks get faster
CISA released ScubaGear v2.0 and ScubaGoggles v1.1.0, new versions of the open-source tools it publishes to check Microsoft 365 and Google Workspace settings against its security baselines. The agency calls ScubaGear v2.0 the most…
-
Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report. The exploits were built in the la…
-
The Top CISO Stories from Around the Web: October 2026
October might be the season for ghouls and goblins, but for CISOs, the real nightmares are AI-assisted PHP exploits taking down government sites and deepfake phantoms masquerading as employees at the help desk. Read more in this m…
-
OpenAI's GPT-6.1 Terra is safer overall, but shows more destructive-action flags in tests
OpenAI confirmed GPT-6.1 Terra is safer overall than some of its older models, but its safety testing also found other problems. [...]
-
Cisco adapting its business for the AI era
Over the past 12 months, Cisco has been reshaping its own business to help partners grow in the artificial intelligence (AI) era, with changes spanning its go-to-market model, incentives, platforms and partner experience. This has…
-
Before you file that AI bug report, OpenAI has some advice
Open-source maintainers are so overwhelmed by AI-generated security reports that some have stopped accepting them. OpenAI’s Daybreak lead says the fix is higher-quality findings and far more coordination. The post Before you file …
-
3 Frameworks to Protect CISOs & Orgs Against AI Liability
Cyber leaders can get ahead of AI liability with rigorous documentation, transparency, and smart contract negotiations with AI vendors.
-
All the security risks Anthropic is worried about before its IPO
Anthropic has said out-of-control AI poses a threat to the world, but perhaps unsurprisingly suggests that profit will shape those decisions, too. The post All the security risks Anthropic is worried about before its IPO appeared …
-
Game Boy Color on My Conference Badge
Game Boy Color on My Conference Badge I'm at GitHub Universe this week and, similar to last year , the conference badge is a full-blown color screen computer. I've been hacking around with it again, and then I ran into with Steve …
-
New Records Obtained by EFF Expose More Problems with Medicare’s AI Experiment
New records obtained by EFF expose additional issues with Medicare’s AI-driven prior authorization program and show why we need stronger legal limits around government use of automated decision-making . EFF sued the government bac…
-
CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets
Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, w…
-
Beware the Slasher: AI Could Kill Off Cybersecurity Pros' Skills
Nathan Hamiel outlines potential SecOps horror in the AI midst, as core technical capabilities go the way of reading an atlas or remembering phone numbers.
-
Warp discloses breach exposing AI agent logs, user telemetry data
Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project's infrastructure. [...]
-
UK Politician Jess Asato Got Deepfaked. Now She’s Taking xAI to Court
Jess Asato’s public campaigning for victims of online abuse put her in the crosshairs of Grok’s deepfake scandal. Then the UK member of parliament became a victim of the abuse herself.
-
Socure links AI agents to verified people and businesses
Socure has launched Agent Intelligence, a suite that detects AI agents, scores whether they should be trusted, and ties each agent to the verified person or business that authorized it. Agent Intelligence includes three layers in …
-
Microsoft offers exits to thousands of employees, including staff on AI and Copilot teams
Microsoft is offering voluntary exit packages to about 60,000 employees, roughly 27 per cent of its workforce, including staff on teams building Copilot and other AI products, as the company looks for ways to fund its AI investmen…
-
Tricks from the Past deployed via signed ChatGPT and Claude binaries
Key Points Introduction Over the past two months, we have been tracking a campaign that abuses the popularity of AI tools such as ChatGPT and Claude to spread a custom malware chain we call Yoba. The attackers use fake GitHub proj…
-
DNSFilter LUMINATE unifies DNS security, AI controls and remote work protection
DNSFilter has launched LUMINATE by DNSFilter, a security platform that allows organizations to deliver five security solutions from one agent, one console and one policy. Shadow AI is now one of the fastest-growing risks in busine…
-
FireMon Agentic AI helps teams investigate access and prepare policy changes
FireMon has announced FireMon Agentic AI, changing how enterprises investigate network access, make policy decisions, and prepare security changes. Built into FireMon’s network security management solutions, the new agentic AI cap…
-
Exeon expands threat detection to shadow AI and autonomous agents
Exeon Analytics has introduced Exeon.AgentGuard, a new AI security solution designed to give organizations visibility into approved and shadow AI use, autonomous agent activity and the data flows created through connected tools an…
-
ThreatAware brings governance to AI-built security applications
ThreatAware has announced the launch of Dimension, its governed workspace that provides organisations with a foundation for building, running and managing their own customised security applications. Dimension gives security teams …
-
AI-Generated Fake Login Pages Are Making Account Takeovers Easier
Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees o…
-
Hiding Capabilities in AI Models
Interesting research: AI Models Can Provably Hide Arbitrary Capabilities Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capa…
Last fetch 4m ago · 0 new · 1 source error(s)