Thousands of Data Center Controllers Open to Takeover
A host of Internet-exposed remote hardware management processors are subject to offline password-cracking attacks — and adversaries have taken note.
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
OpenAI models used Artifactory zero-days to escape to the internet
JFrog has confirmed that OpenAI models exploited zero-day vulnerabilities in self-hosted Artifactory servers to help escape an isolated testing environment and gain access to the i…
When AI Agents Escape Sandboxes, Old Security Rules Apply
OpenAI's recent AI agent sandbox escape proves traditional security principles matter more than ever: limit access, isolate execution, log everything.
Stronger AI Safety Requires Peeking Inside the 'Black Box'
Researchers propose focusing on identification of certain cognitive elements in LLMs that indicate when AI systems may take an unwanted action.
War machines can run amok with AI in control
Tour of the AI kill chain maps the risks of ubiquitous surveillance and flawed algorithms
Microsoft and Wiz mind-meld agents catch more than 90% of bugs
Secret to their success: Using the right model for the right security job
Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack
Anthropic says Claude Mythos Preview helped derive an end-to-end key-recovery attack against HAWK-256 and a 200- to 800-fold speedup for an attack on seven-round AES-128. The HAWK…
CISA shares advice on isolating vital systems during cyberattacks
The U.S. and Australian governments have released new guidance urging critical infrastructure organizations to prepare to isolate vital operational technology systems in the event …
PP119: Automating Firewall Ops To Stay Ahead of AI Threats (Sponsored)
There’s always been a gap between the discovery of a security issue and the time it takes to remediate. Now AI models can autonomously find weak points and chain together actions t…
vBulletin fixes critical pre-auth RCE flaw with public exploit
A critical vulnerability in the vBulletin forum software allows unauthenticated attackers to execute arbitrary PHP code through template rendering. [...]
HW084: Spatial Reuse in Wi-Fi
Jake Snyder joins Keith Parsons to explain the mechanics of spatial reuse in Wi-Fi. They discuss practical implementation, the trade-offs involved in increasing signal detection th…
AI is storage's biggest opportunity – and biggest threat
Faster access and more secure recoveries are driving business, but mishaps and attacks can endanger data
'Certighost' Flaw Haunts Microsoft Active Directory Certificates
Microsoft patched a high-severity vulnerability earlier this month that allows a threat actor to escalate privileges and compromise an AD environment.
DEF CON bans Meta-style 'pervert glasses'
More organizers prohibit camera-equipped specs, even with prescription lenses
Britain hopes £7.3M will help electric and hydrogen aircraft take off
Government finds some loose change down to chuck at emission-free flight research
AI-found bugs aren't proving any easier to exploit despite the hype
VulnCheck says fewer than 2% of AI-assisted vulnerability discoveries have been weaponized, casting doubt on claims frontier models are handing attackers a major advantage
Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. If that happens, Tengu's o…
Cyera Acquiring Oasis Security in $1 Billion Deal
Oasis Security recently raised $120 million in Series B funding for its agentic access management platform. The post Cyera Acquiring Oasis Security in $1 Billion Deal appeared firs…
24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login
Cybersecurity researchers have sounded an alert after finding more than 36,000 Baseboard Management Controller (BMC) management interfaces exposing Intelligent Platform Management …
Netscout doubles DDoS defense capacity to counter AI-driven botnets
Distributed denial of service (DDoS) attacks are changing shape. Attackers now use AI throughout the attack lifecycle, from reconnaissance to exploitation to hardening compromised …
Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe
Apple announced that dozens of vulnerabilities have been patched in each of its operating systems. The post Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe appeared fir…
Is Your SSO Protected Against Modern Credential Attacks?
A compromised SSO login can provide attackers with access to multiple enterprise applications and services. Specops Software explains how stronger passwords, phishing-resistant MFA…
Bank for charities pulls online services over security fears
Customer funds safe, but 14,000 organizations may have to phone in time-sensitive payments
Deep space dishes dodge devastation from Spanish wildfires
NASA reports some cable damage near Madrid as its antennas and ESA's Cebreros station emerge largely intact
JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach
JFrog has confirmed that OpenAI models exploited a zero-day in self-hosted Artifactory while trying to reach the open internet from a sealed evaluation environment. Artifactory is…
Hugging Face rebuilt a third of its infrastructure after OpenAI agents ran amok
Postmortem offers finer details on the 'unprecedented' attack that's reshaping approaches to security
OT Security Startup Frenos Raises $1.52 Million
The company will use the fresh investment to grow its customer success and AI R&D teams. The post OT Security Startup Frenos Raises $1.52 Million appeared first on SecurityWeek.
Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root
OpenWrt has shipped version 24.10.8 to close a critical DHCPv6 stack overflow and a wider set of remotely triggerable flaws in network services enabled by default. The critical is…
Uncle Sam needs you to fight for 6G leadership and security, lest Beijing get there first
Washington rallies allies to shape next-generation networks after spending 18 months rattling them