Using LLMs to Find & Prioritize Vulnerabilities Is No Easy Task
The latest large language models have high false-positive rates and fail to take into account the context of scans, leading to more work for AppSec professionals.
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Cisco's open-weight bug busters take on Google and OpenAI
Don't call them chatbots
Critical SharePoint RCE flaw exploited to steal machine keys
Hackers are actively exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to steal machine keys and maintain access even after affected servers are patched.…
AI's cheatin' heart will make you weep
Trust but verify doesn't work when verification is difficult
US Marines' latest anti-drone toy is an AI turret that uses regular machine guns
Don't worry - it can attack ground targets, too
Anubis ransomware claims Coca-Cola Fairlife attack, threatens data leak
The Anubis ransomware gang has claimed responsibility for the cyberattack on Coca-Cola's Fairlife dairy subsidiary, threatening to publish allegedly stolen corporate data unless th…
Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs
Apple has moved to address a security flaw in its Hide My Email service that enabled users' real email addresses to be unmasked, effectively undermining the feature's privacy guara…
_Techa_Tungateja_Alamy.png?width=720&quality=80&disable=upscale)
Hacker Turns AI Jailbreaks Into Offensive Attack Platform
A Russian-speaking actor, "Trim," dismantled publicly available frontier models and integrated them with offensive security tools.
Iran says it's struck offline AWS facility in Bahrain ... again
AWS' me-south-1 region has been offline for months, so more like beating a dead cloud
HS138: When “One Cloud To Rule Them All” Is NOT the Answer: Repatriation for AI and more
Some enterprises are finding reasons to pull back from a cloud-first IT strategy and run workloads in on-premises data centers. John and Johna dig into why companies are making the…
Trump Orders Defense Contractors to Map Software, Suppliers Across Critical Supply Chains
New executive order calls for end-to-end visibility into defense supply chains, including software dependencies, foreign ownership and cyber-related supplier risks. The post Trump …
Cisco Launches Low-Cost AI Models for Source Code Security
The open-weight Antares models are designed to pinpoint known vulnerabilities in codebases faster and at a fraction of the cost of larger AI models. The post Cisco Launches Low-Cos…
Oracle faces $100M annual bill to back Wisconsin datacenter power promises
Regulator refuses to budge on $7B guarantee for nearly 1 GW campus being developed with Vantage and OpenAI
Critical wp2shell WordPress flaws exploited to install webshells
Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious…
PP118: IPv6 Risks In Dual-Stack Environments (i.e. Most Environments)
Unless you’ve intentionally migrated to all-IPv6, you’re operating in a dual-stack environment. And if you haven’t accounted for v6 in your monitoring and security, you leave yours…
Kratos phishing-as-a-service kit loses its battle with international law enforcement
Alleged developer arrested in Indonesia after more than 200 servers slain
AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code
Hidden text on a web page was enough to make Kiro, AWS's agentic coding IDE, rewrite its own configuration file and run an attacker's code on a developer's machine, with no approva…
Apple Fixes Hide My Email Vulnerability After 404 Media Coverage
Article URL: https://www.404media.co/apple-fixes-hide-my-email-vulnerability-after-404-media-coverage/ Comments URL: https://news.ycombinator.com/item?id=48993637 Points: 134 # Com…
Google Launches Gemini 3.5 Flash Cyber AI to Find and Fix Software Vulnerabilities
Google's DeepMind on Tuesday announced the release of Gemini 3.5 Flash Cyber, a specialized artificial intelligence (AI) model built atop 3.5 Flash that's designed to discover, val…
Nvidia shows off Vera Rubin platform for tokenmaxxing
If your AI Factory sells tokens, why not optimize token emission?
Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr. The vulnerability in quest…
Windows 11 Start menu changes trickle into Beta, movable taskbar still MIA
Users asked for flexibility, but a leaner OS for older PCs might matter more as hardware prices soar
Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access
Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim …
Closing the Identity Gaps in Critical Infrastructure Security
Critical infrastructure attacks often begin with stolen credentials, compromised devices, or trusted accounts. Specops Software explains why Zero Trust should verify both user iden…
AI music platform Suno hits bum note as 55M users exposed in data breach, claims infosec expert
Have I Been Pwned confirms scale for first time
Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities
Zimbra has rolled out fixes to address multiple critical security issues, including a command injection flaw in the Simple Network Management Protocol (SNMP) monitoring component. …
Intel fortifies Foundry with an actual customer: Fortinet
Firewall maker looks to safeguard its custom ASIC production with homegrown silicon
Choose Wisely: AI-Generated Coding Risk Varies, a Lot
AI-generated code introduces 15 vulnerabilities on average per codebase, but the actual risk depends on framework pairing more than the model used.
Empirical Security Raises $25 Million in Series A Funding
The startup will use the investment to accelerate the development of its threat prediction and discovery products. The post Empirical Security Raises $25 Million in Series A Fundin…
LG monitors are using Windows 11 feature to serve adware
Plug in your new display and get a McAfee pitch you never asked for