Aggregated from vendor advisories, security research, and industry publications.
A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them, driving it into projects the attacker has no rights to reach and quietly leaking what it finds. The flaw is in Microsoft's official Azure DevOps MCP server, and it works because one of its tools returns pull request descriptions without a prompt-injection guardrail the company had
OpenAI on Tuesday said a combination of its artificial intelligence (AI) models, including GPT-5.6 Sol and an "even more capable pre-release model," was behind the security inciden…
Arista Networks is looking to simplify data protection at the edge of enterprise networks with a new security package that combines branch office security with SD-WAN connectivity …
IPv6+ could make it easier to censor netizens or block traffic, and Beijing is already exporting it
Sandboxed experiment found itself a zero day, escaped onto the open internet and validated scary predictions about rogue agents
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one's television into an always-on residential proxy node.…
Hey Uncle Sam, if you thought GPT-5.6 and Claude Fable 5 were scary, get a load of Kimi K3
Authorities in Germany and the U.S. dismantled the central infrastructure of Kratos, a phishing-as-a-service (PhaaS) platform with global reach, and its developer was arrested in I…
A large-scale operation dubbed 'FakeGit' is pushing SmartLoader and StealC malware through 7,600 malicious GitHub repositories that accumulated more than 14 million downloads. [...…
Researchers pointed to fragmentation of the ransomware ecosystem, the emergence of new attackers, and expansion of attacks on less defended organizations.
The latest large language models have high false-positive rates and fail to take into account the context of scans, leading to more work for AppSec professionals.
Don't call them chatbots
Hackers are actively exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to steal machine keys and maintain access even after affected servers are patched.…
Trust but verify doesn't work when verification is difficult
Don't worry - it can attack ground targets, too
The Anubis ransomware gang has claimed responsibility for the cyberattack on Coca-Cola's Fairlife dairy subsidiary, threatening to publish allegedly stolen corporate data unless th…
Apple has moved to address a security flaw in its Hide My Email service that enabled users' real email addresses to be unmasked, effectively undermining the feature's privacy guara…
_Techa_Tungateja_Alamy.png?width=720&quality=80&disable=upscale)
A Russian-speaking actor, "Trim," dismantled publicly available frontier models and integrated them with offensive security tools.
AWS' me-south-1 region has been offline for months, so more like beating a dead cloud
Some enterprises are finding reasons to pull back from a cloud-first IT strategy and run workloads in on-premises data centers. John and Johna dig into why companies are making the…
New executive order calls for end-to-end visibility into defense supply chains, including software dependencies, foreign ownership and cyber-related supplier risks. The post Trump …
The open-weight Antares models are designed to pinpoint known vulnerabilities in codebases faster and at a fraction of the cost of larger AI models. The post Cisco Launches Low-Cos…
Regulator refuses to budge on $7B guarantee for nearly 1 GW campus being developed with Vantage and OpenAI
Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious…
Unless you’ve intentionally migrated to all-IPv6, you’re operating in a dual-stack environment. And if you haven’t accounted for v6 in your monitoring and security, you leave yours…
Alleged developer arrested in Indonesia after more than 200 servers slain
Hidden text on a web page was enough to make Kiro, AWS's agentic coding IDE, rewrite its own configuration file and run an attacker's code on a developer's machine, with no approva…
Article URL: https://www.404media.co/apple-fixes-hide-my-email-vulnerability-after-404-media-coverage/ Comments URL: https://news.ycombinator.com/item?id=48993637 Points: 134 # Com…
Google's DeepMind on Tuesday announced the release of Gemini 3.5 Flash Cyber, a specialized artificial intelligence (AI) model built atop 3.5 Flash that's designed to discover, val…
If your AI Factory sells tokens, why not optimize token emission?