AI Browsers Vulnerable to 'PleaseFix' Zero-Click Agent Hijacking
Attackers can take control of agents through malicious instructions hidden in content supplied to AI browsers, and there's no simple fix for the threat.
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Ransom Cartel ransomware creator sentenced to 16 years in prison
Maksim Silnikau, the creator and administrator of the Ransom Cartel ransomware operation, was sentenced to 16 years in prison for his role in ransomware attacks against at least 18…
An off-grid AI sounds like a great survival assistant, but is better left to roleplaying the zombie apocalypse
Would you rather play Russian roulette with an LLM or put your health and safety in the hands of a professional
No Perfect Fix for AI Browser Prompt Injection Flaws
AI browsers from top vendors remain vulnerable to prompt injection attacks despite multiple security guardrails, according to new research.
Canadian pleads guilty to Snowflake cloud data-theft attacks
A Canadian man pleaded guilty today to his role in accessing company accounts at cloud storage provider Snowflake and stealing data from at least 165 organizations in a scheme to e…
Prompt injection isn't the bug, AI agent frameworks are
Check Point researchers tried to break the frameworks enterprises use to build AI apps. Now they're telling Black Hat attendees what they found
Time Magazine has a separate version of its website with ads only AI can see
Brands are already paying to influence what chatbots say about them
Hackers run khunt post-exploitation toolkit from Oracle database
Hackers exploited a SQL injection vulnerability to install a post-exploitation toolkit directly inside an Oracle database that was used to breach a corporate network. [...]
CSS: The Hidden Threat Lurking in Your Inbox
CSS was once just about design. Now researchers warn it's powerful enough to exfiltrate data from webmail — and some vendors aren't prepared.
How a $50,000 Exploit Chain Turned Bixby Against Samsung Phones
The chain involved the exploitation of several vulnerabilities in the Samsung Members and Samsung Account applications. The post How a $50,000 Exploit Chain Turned Bixby Against Sa…
15 TP-Link Bugs Expose Risks in Zero-Trust Provisioning
Researchers are calling attention to the risks inherent in automated network device provisioning, using a world-leading device manufacturer as a case study.
Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures
A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelli…
Arista hits first $3B quarter as AI networking demand continues and supply pressures show signs of improvement
Arista Networks shared some good news about its earnings and future directions during its second-quarter earnings call this week. For starters, Arista reported its first-ever $3…
OpenAI Disrupts Poipet Scam Network Using ChatGPT Across Multiple Fraud Schemes
OpenAI said it disrupted a Cambodia-based scam operation that used its generative artificial intelligence (AI) chatbot ChatGPT to facilitate a wide range of investment, romance, ga…
Flaws in Google APK for Python Unlock Agent-to-Agent Attack
Google has fixed the issues, which exploited a trust boundary between two AI agents with different privilege levels to trigger automation that could compromise the supply chain.
AI Sends Global Crime Syndicates Into Fraud Nirvana
Organized crime is convincingly scamming at scale, making billions thanks to AI-enabled voice cloning, deepfake real-time video overlays, LLM-driven persona management, and automat…
Elon pledges to give Nvidia a virtual monopoly over the stars
In space, no one can hear you scream when the LLMs hallucinate
COLDCARD security audit phishing attack installs remote access tool
A phishing campaign is exploiting fears surrounding the recently disclosed COLDCARD wallet vulnerability and suspected $88.6 million Bitcoin theft to trick users into installing Sc…
IBM's agentic AI platform is under active attack - patch now
A critical Langflow flaw allowing RCE on default deployments is being exploited, says the CISA
TCG081: Network Automation Forum: From Simple Survey to Global Community
William Collins is joined by guest co-host Eric Chou as well as Network Automation Forum founders Scott Robohn and Chris Grundemann to discuss how their community emerged from a si…
NAN128: Beyond RAG: Making Network AI Truly Agentic
Eric Chou welcomes Juulia Santala, a Solutions Engineer at Cisco, to discuss her transition from traditional network programmability to cutting-edge AI research. They explore how s…
CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws
The U.S. Cybersecurity and Infrastructure Security Agency is giving federal agencies three days to mitigate vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, all activ…
Samsung and Mousterian move ahead with floating datacenter for Texas
But bobbing bit barn may be becalmed by state governor's moratorium on connecting to the grid
Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt
Cybersecurity researchers have discovered more than half-a-dozen services advertisements for illegal access to artificial intelligence (AI) models on underground cybercrime forums …
Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports
Two security flaws in Paperclip could let attackers execute commands on a network server or a developer's computer. Paperclip is an open-source control plane for teams of artificia…
Microsoft tells engineers to curb their token-burning enthusiasm
Redmond wants results from Copilot, not impressive-looking consumption figures
Operationalize AI at scale with HPE and NVIDIA
SPONSORED POST: The AI factory concept encompasses the new AI stack, explain HPE’s Thierry Pienaar and NVIDIA’s Kaushik Shirhatti
Google Blogger locks hundreds of blogs in malware false positive
Google has locked hundreds of Blogger websites after a false positive claimed they violated its "Malware and Similar Malicious Content" policy, with some sites deleted from the pla…
Palo Alto Networks at Black Hat: How AI erased the 50-day patch window
Data released at this week’s Black Hat security conference suggests the era of manual zero-day hunting and 50-day patch windows is coming to an end. This is a double-edged sword fo…
Black Hat USA 2026 – Summary of Vendor Announcements (Part 3)
Many companies are showcasing their products and services this week at the 2026 edition of the Black Hat conference in Las Vegas. The post Black Hat USA 2026 – Summary of Vendor An…