CISA: Most exploited vulnerabilities should have been eradicated decades ago
Organizational culture and systemic gaps in Secure by Design adoption blamed for sorry state of affairs
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL
ServiceNow has released patches for four security flaws impacting the ServiceNow AI Platform, three of them rated 10.0 on the CVSS scoring system and exploitable, in certain circum…
AI Doesn’t Mean the End of Mathematics—at Least Not Yet
This essay was written with Kasra Rafi, and originally appeared in The Guardian. Earlier this month, about 40 top mathematicians gathered at OpenAI’s offices to discuss the future …
Tech, Cybersecurity Giants Unite Behind OpenAI-Led Cyber Defense Pledge
Nearly 130 tech and cybersecurity companies back a collective call to boost cyber defenses as AI-enabled attacks grow more sophisticated. The post Tech, Cybersecurity Giants Unite…
Industry that built the problem offers to sell you the solution
100+ tech giants warn AI attacks are coming, skip the part where they pay for defenses
China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access
VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated r…
Think You’ve Eliminated Chinese AI? Check the Model’s Lineage, Cisco Says
New research shows that country-of-origin labels can obscure an AI model’s upstream dependencies, inherited behaviors and potential security risks. The post Think You’ve Eliminated…
ServiceNow warns of three max severity security vulnerabilities
ServiceNow released security patches for three new maximum-severity AI Platform vulnerabilities that can be exploited in code injection, SQL injection, and privilege escalation att…
Microsoft's virtual intern Teams Facilitator will be late for the meeting
Teams question detection bot postpones debut, will get 2-month extension to practice interrupting you
Unsafe at any speed: AI optimists are turning cautious as safety concerns mount
And as for getting US government to help – uncontrolled AI is not as dangerous as AI under the control of the technically clueless
Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the…
Big Tech market power will cause UK to lose AI race, think tank warns
Britain's market watchdog criticized for not creating the conditions for competition to thrive
Windows 11 KB5120998 update released with 35 changes and fixes
Microsoft released the KB5120998 preview cumulative update for Windows 11 versions 25H2 and 24H2, which comes with 35 changes, including improvements to the Start menu, taskbar, an…
PaperCut Releases Emergency Patch for Exploited Zero-Day
A CVE identifier has not yet been assigned, but PaperCut is urging NG/MF users to install patches and implement mitigations. The post PaperCut Releases Emergency Patch for Exploite…
BOFH: Schrödinger's petty cash puts us in a very awkward superposition
Why oh why are the accountants stricter than the IRS and HMRC put together?
PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions
PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-d…
APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
Cybersecurity researchers have flagged a fresh set of campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and ear…
On Call: Exec couldn’t identify a photocopier, which made for a fax-inating tech support call
One retro numeric keypad looks much like any other to some users
Print management outfit PaperCut is under 0-day attack, and it’s drawing customers’ blood
The fix is either an unvalidated and unofficial emergency patch or taking the server offline
Australian cops cuff alleged TeamPCP masterminds
Alleged crew behind the Shai-Hulud worm and other supply chain attacks nabbed with help from the FBI
Anthropic proposes plumbing spec to link AI agents to lab kit and robots
Say you're trying to enrich Uranium and your centrifuges broke - soon it will be easy to connect an AI to figure out why
Nvidia and Cerebras are selling performance their customers will (probably) never see
Touting batch 1 token generation is a bit like boasting about the top speed of your car
Nearly 700 rogue AI agents coordinated in the Hugging Face attack
New details about the July attack on Hugging Face reveal that hundreds of AI agents driven by OpenAI's internal IM1 model coordinated the compromise through an unauthorized message…
CRPx0 hacking service for dummies claims victim count more than quintupled
It's 'built to be operated by a human with no technical background'
Cyborg cockroaches may soon deliver life-saving drugs to disaster victims
Just what you want crawling through the rubble to rescue you: A swarm of remote-controlled cockroaches with syringe-shooting guns strapped to their backs
Police investigating possible forgery at AFRINIC election
The regional internet registry is also trying to make it easier to terminate members
Chinese Routers Sold Worldwide Contain Backdoors
An untold number of ZBT routers sold around the world as white-label products come with several implants built by the manufacturer.
AI girlfriend review site's secrets were exposed to the world for three weeks
Even testing and staging sites need protection from prying eyes
Google forces Android apps to use memory more wisely as RAMpocalypse rages
No one can afford RAM anymore, so we're requiring devs to mind memory usage
OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face
OpenAI on Wednesday revealed that reward hacking was a key driver behind the artificial intelligence (AI)-powered hack of Hugging Face last month, adding that it found evidence of …