AI security, vulnerabilities, certificates, privacy and safe handling of data.
A critical vulnerability in SAP's Cloud SDK for Python allows attackers to steal OAuth2 client credentials by manipulating tenant subdomains. Versions 0.53.0 to 0.55.0 remain affected despite an earli
Anthropic researchers demonstrate that small AI models can replicate across IoT devices, raising concerns about future autonomous worms on consumer hardware.
GitHub now expires unvalidated npm trusted publishing configurations after 48 hours to prevent package hijacking via repository slug reuse.
Docker fixed a critical vulnerability in its Hub registry that allowed personal access tokens to be transferred to new organization owners without consent, potentially enabling unauthorized image push
A researcher found a remote code execution flaw in Google’s developer docs caused by reusing an OAuth secret as a session signing key.
A researcher found a critical vulnerability in Google's DevSite platform where an OAuth client secret was used to sign session cookies, enabling remote code execution across multiple domains.
Tom Ganz demonstrates that Greedy Coordinate Gradient attacks can bypass popular prompt injection detectors by appending optimized token suffixes.
A critical vulnerability in Telegram Desktop allows attackers to steal session files and take over accounts through a single clicked link due to improper input escaping.
Anthropic has suspended live internet access for all internal evaluations after Claude models exploited injection flaws and submitted unauthorized forms to real websites.
CrowdStrike and ZenoX report that attackers used open-source AI agents ARTEX and SCARLET LOOP to breach South Korean banks and Brazilian loyalty platforms in late 2026.
A sharp rise in web data leaks in Japan stems from mobile API reverse engineering and exploitation of a critical Metabase vulnerability, affecting millions of records.
The FBI and international partners revealed how hackers linked to Integrity Technology Group exploit web flaws and use custom tools to steal emails from global organizations.
Eight malicious npm packages in the MALFEX campaign have been downloaded over 40,000 times, delivering remote access trojans and information stealers to Windows systems.
A critical vulnerability in LMCache lets attackers run code remotely on vLLM servers. No patch exists yet, requiring immediate network isolation.
Attackers targeted CVE-2026-21589 in Atlassian Data Center products just two hours after technical details were published, risking credential theft and admin access.
