Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours
The attacker exploited AI workflows, chained cloud weaknesses, and stolen credentials to extort a large Amazon customer.
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Mount Royal University confirms breach as hackers claim attack
Mount Royal University in Calgary says hackers stole and then deleted data from its file storage systems after breaching the university's network. [...]
Intel-backed AI chip startup SambaNova breathes new life into aging Nvidia GPUs in latest benchmarks
Third-party testing shows heterogeneous compute platform combining H200s and SN50 RDUs churning out 763 tok/s in MiniMax M2.7
Former GitHub CEO launches competitor designed for the age of vibe coding
As GitHub struggles to manage AI load, challengers take aim
Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials
Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to developers and users of Paysafe, Skrill, and Neteller payment …
OpenAI job listing suggests ChatGPT could someday replace junior analysts at Goldman Sachs
What, did someone get some bad news during their IPO process or something?
GitHub Copilot: Sorry Dave, I can't do that harmful thing - unless you ask me in code
More fun with AI jailbreaks, this time at the workflow level
Hackers exploit Roundcube flaw to spy on academic researchers
A China-linked threat cluster has been exploiting vulnerable Roundcube servers at U.S. and Canadian universities to steal credentials and deploy backdoor malware. [...]
Allstate Insurance quits Broadcom, alleges vengeful license audit on the way out
CA and VMware both suing insurance giant
AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers
Sophos looked at a week of its own endpoint data and found that AI coding agents such as Claude Code, Cursor, and OpenAI Codex are setting off detection rules written to catch huma…
Entra passkey enrollment vishing targets Microsoft 365 users
A threat actor has been targeting organizations across multiple sectors with voice-based fake security requests that ask Microsoft 365 users to enroll a new Entra passkey. [...]
Vidar Infostealer Hammers SMBs via Malvertising Campaign
A financially motivated operation uses lures of cracked or pirated software to deliver a two-for-one malware combo for data theft and cryptomining.
Infoblox acquires Kentik, adding network observability to its DNS and DDI platform
Infoblox announced today that it has entered into a definitive agreement to acquire Kentik, combining Infoblox’s authoritative DNS, DHCP, and IP address management (IPAM) data with…
Accenture Confirms Data Breach After Hacker Claims Source Code Theft
The professional services giant says it contained the incident, remediated its source, and experienced no operational or service delivery impact. The post Accenture Confirms Data B…
AI memory crunch takes a bite out of PC shipments
IDC warns smaller players may struggle as DRAM drought drags on
Tool promises to make lazy academics' AI-written papers sound more human
Startup insists it's not trying to help anyone cheat the system - honest!
China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors
Cisco says the threat actor behind the LapDogs campaign has expanded its SOHO router malware toolkit with LongLeash, DogLeash, and JarLeash backdoors. The post China-Linked APT Exp…
Police intercept tipsy teens after Waymo snitches for shooting Orbeez out of the car
Armed response and canine support called in for troublemaking duo ratted out by driverless car’s array of cameras
New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware
AI coding assistants have a habit of making things up. Ask one to fetch a popular tool, and it will sometimes hand back a real-sounding name for a project that does not exist. New…
Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS
Ubiquiti has shipped updates to address multiple critical security flaws impacting UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi OS that could result in privile…
3 Ways AI Powers Service Desk Attacks and How to Prevent Them
Specops Software explains how AI is making service desk impersonation attacks more convincing, personalized, and scalable, along with practical steps organizations can take to stre…
Bug in top AI coding agents shows that Unix-era security headaches never really die
'GhostApproval' problem highlights human-in-the-loop fails
China tells devs to ditch Claude Code over 'backdoor code' fears
National vulnerability database claims monitoring mechanism can forward Chinese users' data to remote servers
Webinar Today: Why Email Security Keeps Failing
Join the webinar as we break down why email-layer defenses alone can’t keep pace with the modern phishing ecosystem. The post Webinar Today: Why Email Security Keeps Failing appear…
New Ghost Phishing Wave Is Breaking Traditional Email Security
A recent EvilTokens campaign targeting businesses across the US and Europe is exposing a new email security blind spot. This “ghost phishing” technique keeps the malicious page hid…
SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users
A new banking fraudulent operation is targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges using ClickFix lures. The activity cluster, t…
Ex-NASA boss points out small flaw in Moon landing plan: No lander
Jim Bridenstine says Artemis 'extraordinarily complicated' compared to the days of Apollo and the Saturn V
Felons, Fraudsters Flog Offensive Cybersecurity Startup
A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convict…
Unexpected Windows bloat is due to bug, not by design
Mystery of the disappearing storage solved (for some)
Google Dialogflow CX Bug Allowed Attackers to Hijack AI Conversations
The "Rogue Agent" vulnerability could have enabled attackers to silently manipulate AI conversations, exfiltrate data, and compromise every Dialogflow CX agent within the same Goog…