Millions of California-bought cars can be hijacked via Bluetooth
Aftermarket dealer-installed KARR/SWDS security systems all use the same secure key, say UCSD researchers
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Linux XFS has a decade-old race condition allowing full root access
Linux systems using the XFS filesystem suffer from a race condition that could enable an unprivileged local user to gain full root access. The flaw affects systems with Linux ke…
Microsoft 365 outage affects Teams, SharePoint and other services
Microsoft is impacted by a massive outage affecting Teams and Microsoft 365 services, primarily affecting users in North America. [...]
Oracle drops 1,449 security patches like it's the new normal
Experts say the era of AI bug hunting is here, so defenders will simply have to adapt to busier workloads
GitHub slashes public bug bounty payouts as AI report flood buries its security team
Code shack also putting new limits on first-time researchers, and reserving the biggest rewards for a hand-picked group of proven hunters
OpenAI Fixes ChatGPT Agent Flaw That Could Let Attackers Forge an AI Insider
AgentForger allows an attacker to create, insert and remotely control an invisible autonomous AI agent inside a victim organization. The post OpenAI Fixes ChatGPT Agent Flaw That C…
ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories
Most of this week's trouble came dressed as something useful. A package stole data. A fake extension opened remote access. A safety app became spyware. An image gave hidden orders…
Is Patching Dead? Vulnerability Management in the Post-Mythos Era
You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. The post Is Patching D…
Chick-fil-A Accounts Get Fried in Credential Stuffing Attack
Threat actors used credentials obtained from other companies to hack into Chick-fil-A One accounts. The post Chick-fil-A Accounts Get Fried in Credential Stuffing Attack appeared f…
Federal quantum bet grows with DARPA’s $125 million PsiQuantum award
Defense research agency DARPA made its largest quantum computing award ever this week, with a $125 million agreement announced on Wednesday. The same day, the White House announced…
Iran-linked crews are probing more flavors of US industrial kit
CISA widens alert beyond Rockwell controllers as intruders target internet-facing devices across critical infrastructure
IBM keen on mainframe even after 42% revenue drop in Q2
Revenue from IBM’s z mainframe portfolio sunk 42% in the quarter ended June 30, dragging infrastructure revenue down 7% compared to the year-ago quarter. But Big Blue executives re…
FedRAMP Rev5 Is Ending: What the 20x Transition Really Requires
FedRAMP 20X replaces point-in-time assessments with continuous, machine-readable evidence that demonstrates security controls are working. Anecdotes explains what the transition fr…
Abstract Raises $25 Million to Expand Composable Security Operations Platform
The latest investment round brings the total raised by Abstract to nearly $50 million. The post Abstract Raises $25 Million to Expand Composable Security Operations Platform appear…
Tesla burns through a billion as Musk bets the farm on chips and bots
Optimus remains 'very complex' and Robotaxis will try not to flatten your cat
Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files
Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine …
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
The Chaos ransomware group ran its command-and-control through the victim's own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised…
One ChatGPT link could smuggle a rogue AI agent into your company
Researchers say OpenAI flaw let phishing bait create an autonomous corporate mole armed with employee access
Nuclear-Sabotage Malware Benchmark Trips Up Most Frontier AI Models
SentinelOne’s new benchmark, built on the Fast16 case, shows which AI models can sustain a malware investigation and which cannot. The post Nuclear-Sabotage Malware Benchmark Trips…
Q&A: Google’s AI and computing chief talks about its shapeshifting data centers
Google’s AI offerings span its internal and cloud offerings. Its data centers are processing seven times more AI tokens compared to last year. To keep up, Google is upgrading its d…
EU fines Google $1 billion for search, app store antitrust violations
The European Commission fined Google €890 million ($1 billion) on Thursday after finding the company had violated the European Union's Digital Markets Act (DMA), which ensures fair…
If you get knocked on the head and get all your devices stolen and have amnesia, Google will let you back in with a selfie
You'll need to be able to move your head side to side to make sure you're not a deepfake
China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks
An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as JadeProx. The cluster has targeted government, healthcare, and education organizations …
Google transforms its data center architecture for agent era
Google’s data center team is racing to turn its infrastructure into a well-oiled machine for AI and the onslaught of agents. At this year’s Google I/O, CEO Sundar Pichai shared sta…
Swiss train maker tells ransomware crooks to get off at the next stop
Stadler refuses $12.3M demand after thieves swipe technical data through supplier platform
How Synthetic Identity Fraud is Coming for Machine Identities
Most people understand identity theft as an attacker stealing a real person's sensitive information and impersonating them. Synthetic identity fraud is much harder to catch. Instea…
New RefluXFS Linux flaw lets attackers gain root privileges
A nine-year-old race condition vulnerability in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root priv…
IBM insists AI didn't kill software deals, just delayed them
Big Blue says customers postponed rather than abandoned major purchases as hardware soaked up enterprise budgets
Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
Cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack infrastructure designed to target cPanel…
Agentic AI Challenges Progress in Confidential Computing
Core issues that slowed down adoption of secure data vaults are being resolved by technology, but artificial intelligence poses new ones. Experts have some answers.