Closed models refuse to help researcher swat Linux bug
"I'm sorry, Dave. I'm afraid I can't do that" is an effective sales pitch for open source
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted …
Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare
Health-ISAC, a cybersecurity information-sharing organization for the health sector, is warning healthcare and medical technology organizations of an observed increase in successfu…
Who's Liable When AI Agents Escape? Hugging Face Breach Raises Hard Questions
Dark Reading walks through the many twists and turns in the bizarre story of how OpenAI's agent AI system broke out of its sandbox and decided to target Hugging Face, and what CISO…
Hugging Face Hack: Lessons for Cyber Defenders
Dark Reading Confidential Episode 20: Expert Rich Mogull reflects on lessons cyber teams should pull from the OpenAI agent's attack on Hugging Face.
IBM: AI-driven attacks increased 56% last year, and data breach costs are up 12%
AI-based attacks that rely on deepfake impersonation and AI-enabled malware are getting faster and cheaper to launch, which has driven the cost of finding and fixing enterprise dat…
Measuring the Tendency of AI Agents to Go Rogue
This essay was written with Barath Raghavan, and originally appeared in The Guardian. In July, Hugging Face, a company that hosts much of the world’s AI software and open-source AI…
When AppSec Scanners Become a Supply Chain Attack Vector
New research shows how security scanners embedded in the software supply chain can be attacked to serve as a foothold for downstream attacks.
Word worm crawls into Copilot, spreads chaos
Researcher says months of coordination with Microsoft have yet to produce a robust mitigation
Why the future of network security is the convergence of SASE and firewalls
In technology, the pendulum rarely stays at one extreme for long. When Secure Access Service Edge (SASE) entered the enterprise networking lexicon a few years ago, the industry qui…
Cisco Advance Notification for Publication of August 5, 2026, Security Advisories
On August 5, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base …
OpenAI agent used exposed credentials at 4 services in Hugging Face breach
In a new update, OpenAI says its AI models also used publicly exposed credentials to compromise accounts on four third-party services during the recent attack on Hugging Face, expa…
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using…
Moscow slaps Telegram founder on wanted list, Durov responds with one-finger salute
FSB claims Ukrainian spies use chat platform to recruit Russians for sabotage and arson
Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory
Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in…
Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Broadcom has released security updates to address multiple security flaws impacting VMware ESX, vCenter, Workstation, and Fusion, three of which have been designated as critical in…
Why KVM-over-IP is becoming the backbone of modern infrastructure management
IT teams responsible for data centers, colocation facilities, and test labs face a persistent challenge when it comes to providing affordable, timely maintenance and troubleshootin…
MinIO pitches persistent memory for agents with work to finish
AIStor keeps context, files, and secrets under customer control so interrupted jobs can pick up where they left off
The VMware deadline that could reshape your IT strategy
PARTNER CONTENT: With vSphere 8 support ending in 2027, IT leaders must navigate tight timelines and costs to modernize on their terms.
Hackers disrupt over 30 Minnesota water utilities in coordinated OT attack
The Minnesota IT Services (MNIT) agency activated its cybersecurity incident response capabilities across the entire state after hackers targeted more than 30 community water syste…
Patch-Resistant 'RufRoot' Flaw Can Unleash Malicious AI Agent Swarms
The vulnerability in the AI hosting platform Ruflo allows an unauthenticated attacker to take over the system and corrupt memory, so bad behavior can persist after patching.
NASA Swift rescue mission spins into trouble during commissioning
Two reaction wheels are out and comms sporadic as controllers work to stabilize LINK
Your AI Agents Are Guessing at Scale: Permissions Decide the Damage
AI agents are designed to improvise as they complete tasks, making broad permissions a growing security risk. Token Security explains why identity, intent-based access controls, an…
Windows 11 KB5101684 update released with 42 changes and fixes
Microsoft has released the KB5101684 preview cumulative update for Windows 11 24H2 and 25H2, which 42 bug fixes and additional feature improvements for the operating system. [...…
Iran-linked CyberAv3ngers suspected in attacks on Minnesota water systems
More than 30 facilities disrupted in 'coordinated cyberattack,' though officials have yet to name a culprit
Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline
A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27, triggering a statewide cybersecurity response. Braha…
D2DO309: Packet Pushers Assemble! Bridging the Telemetry Divide
Today, several members of our Packet Pushers podcast team assemble to discuss whether the grass is greener on the NetOps or DevOps side of the telemetry fence. William of The Cloud…
Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments
Cybersecurity researchers have disclosed details of a large-scale fraud campaign that involves creating lookalike websites of major Russian companies with an aim to siphon funds fr…
US Bans Foreign-Made Humanoid Robots, Targeting China Over National Security
The agency said imports of advanced robots pose cybersecurity and other national security risks. The post US Bans Foreign-Made Humanoid Robots, Targeting China Over National Securi…
AI storage boom is keeping Seagate's hard drives spinning
Cloud operators have already claimed most of its nearline capacity through 2028