4+ day, 9+ hour ago   (539+ words) Research published by Noma Labs researcher Sasi Levi reveals that this attack does not rely on prompt injection, stolen credentials, or jailbreaking an AI model. Instead, it exploits a fundamental authorization flaw: AI workflows can process untrusted input from low-privileged…...

4+ day, 4+ hour ago   (616+ words) Nearly one in 10 internet-exposed LiteLLM AI gateways accepted the widely documented default master key, sk-1234, or required no authentication, creating a direct path to LLMjacking, sensitive credential exposure, and in vulnerable versions root-level code execution inside the gateway container. Their…...

4+ day, 8+ hour ago   (444+ words) Microsoft Security Research said it has observed the cloud-focused intrusions since May 2026. The campaign begins with a phone call or SMS sent to an employee’s personal device. Posing as IT support, the caller claims the target must urgently update a…...

4+ day, 6+ hour ago   (557+ words) A phishing campaign that moves the credential-harvesting page out of attacker-controlled web infrastructure and into the victim’s browser. Unlike ordinary phishing kits, which host cloned login portals on domains that can eventually be detected and disrupted, this campaign delivers malicious…...

4+ day, 8+ hour ago   (480+ words) OpenAI has announced its plans for a “Defense Factory,” a cybersecurity operation that prioritizes agent-driven actions. This initiative is designed to continuously discover, validate, remediate, and verify vulnerabilities as AI systems develop the ability to conduct increasingly complex cyber operations....

5+ day, 4+ hour ago   (440+ words) A critical vulnerability has been identified in the Fortinet FortiPAM Chrome extension that could allow a malicious website to manipulate browser proxy settings, open tabs at the attacker’s discretion, and record activity within those tabs. This issue, tracked as CVE…...

5+ day, 7+ hour ago   (549+ words) Security researchers have revealed a recently patched flaw in ChatGPT’s isolation system that could have allowed attackers to access data from a victim’s connected Gmail account and send it to a separate ChatGPT account through a hidden cross-account channel. Check…...

5+ day, 7+ hour ago   (1549+ words) Best value overall: Bitdefender — competent managed XDR at pricing that mid-market organizations can approve, which most of this list cannot claim. Best telemetry breadth: Palo Alto Unit 42. Best for keeping your existing tools: Stellar Cyber and ReliaQuest. MXDR is MDR…...

5+ day, 9+ hour ago   (1590+ words) Best value overall: Microsoft Defender XDR included in Microsoft 365 E5 and genuinely strong across Microsoft’s own surface, which for most organizations is most of their surface. Best open XDR: Stellar Cyber, built to ingest whatever you already own. Best native correlation:…...