AI helps Microsoft bug hunters chase a record $20M payday
Broader bounty rules added to a swelling volume of machine-assisted vulnerability reports
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Oligo Raises $60 Million for Runtime Security
The company will use the investment to accelerate product innovation and expand go-to-market operations. The post Oligo Raises $60 Million for Runtime Security appeared first on Se…
CISO Conversations: Russ Kirby – Passion Is the Antidote to Burnout
Russ Kirby, CISO at Ping Identity, shares how passion, courage, and “good enough” thinking shaped his path from HP to the C-suite—and what keeps him up at night. The post CISO Conv…
Varonis Agent IBAC keeps AI agents within their intended boundaries
AI agents need broad access to be useful, but traditional access controls cannot determine whether an action aligns with a user's intent. Varonis explains how Agent IBAC detects in…
Weaponized Email AI Assistants Could Help Attackers Hijack Accounts
Researchers demonstrate how attackers could abuse built-in email chatbots to evade detection, impersonate trusted employees, compromise executive accounts, and facilitate financial…
PP120: News Roundup—AI Giants Praise Open Weight Models, Attackers Capture Captive Portals, a Tricky Mac Attack, and More
Packet Protector uncorks another News Roundup! We talk about attackers capturing hotels’ captive portals to steal Microsoft credentials, and the OpenAI-attacking-Hugging Face story…
HS139: When “One Cloud to Rule Them All” is NOT the Answer: Regionalization
IT folks spent a lot of time in the last 20 years creating globe-spanning infrastructures that maximize performance while minimizing the number of data centers or cloud instances t…
Zenity Raises $125 Million in Series C Funding
The AI security company will invest in product innovation, global expansion, and customer experience. The post Zenity Raises $125 Million in Series C Funding appeared first on Secu…
Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
A credential-stealing npm worm that first appeared in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4…
Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access
Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business doc…
Cloud giants pour nearly $600B into capex as AI demand surges
Revenue is soaring, yet hyperscalers say they still cannot build capacity fast enough
AI Notetaker Lets Hackers Spy on Government, Corporate Video Calls
A Google Firebase misconfiguration lets users of tl;dv, an AI meeting tool, query any other users' meeting information and potentially join calls.
Tennessee congressional hopeful accused of shooting license plate cameras
Cops arrest budding politician for allegedly dealing with Flock's expansion the American way
TP-Link Omada ZTP Vulnerabilities Chain Into Full Network Takeover
Forescout researchers have found 15 new vulnerabilities in the TP-Link Omada networking ecosystem. The post TP-Link Omada ZTP Vulnerabilities Chain Into Full Network Takeover appea…
Obsidian Security Raises $85 Million at $1.1 Billion Valuation
Obsidian Security has developed a platform for governing AI agents across third-party applications. The post Obsidian Security Raises $85 Million at $1.1 Billion Valuation appeared…
When Vibe Hacking Turns AI into the Junior Hacker Every Adversary Always Wanted
The cybersecurity industry has spent decades assuming that offensive capability scales with technical expertise. That assumption is starting to break. Security teams have long es…
CAF Bank reopens online service but warns of further outages
Customers told traffic may be limited at certain times following more than ten days offline
Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent
Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security showed that a public GitHub issue could manipulate a triage agent in…
Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering
A crafted prompt to a low-privilege Google ADK agent could be used to pass a malicious hand-off comment to a privileged agent. The post Gemini Agent-to-Agent Attack Method Exposed …
New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root
cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database's root context, crossing the privilege boundary between a cPanel account and the se…
Some Claude Chats Are Searchable on Google
And it’s personal information (alternate link): The exposed data includes an AI-powered therapy app that someone appears to have vibe-coded, notes on meetings, and a dashboard some…
Decades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks
Over 24,000 internet-accessible server-management interfaces disclose authentication hashes before login. The post Decades-Old BMC Vulnerability Exposes Thousands of Data Centers t…
DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT
A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliv…
150,000 Impacted by Madera Community Hospital Data Breach
An extortion group stole personal, financial, and medical information from the hospital’s network. The post 150,000 Impacted by Madera Community Hospital Data Breach appeared first…
UK mulls making employers ask before installing bossware
Proposals span AI productivity scores, keystroke logging, biometrics, and other ways to watch workers
CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KE…
Device Code Phishing Up 1,500% in 2026; Vishing Doubles
Newer social engineering techniques help attackers ignore entrenched security controls and limit the evidence they leave behind.
NASA puts astronauts’ lives in the hands of Tesla’s flaky Cybertruck
Muskmobiles subject to 11 recalls get the launchpad rescue mission currently handled by vehicles that can survive land mine blasts
Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers
The biggest single reward paid out by Microsoft between July 1, 2025, and June 30, 2026, was $200,000. The post Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers ap…
Cloudflare has mostly ditched third party security tools, suggests not trying that at home
Automates bug bounty triage with Sonnet for $58 a month, CSO says Mythos would cost $200k