MI5 warns over 100 UK academics aided Chinese espionage via AI research
UK intelligence agency MI5 issued an alert stating that more than 100 academics contributed to research funded by a front for China's Ministry of State Security.
Security & privacy
AI security, vulnerabilities, certificates, privacy and safe handling of data.
Warlock ransomware group targets SharePoint flaws in critical infrastructure
The Warlock threat actor continues exploiting Microsoft SharePoint vulnerabilities to deploy ransomware against organizations in Portuguese- and Spanish-speaking regions.
ZeroLeaks releases Shield Small for local prompt injection detection
ZeroLeaks has released Shield Small, a lightweight 118M-parameter classifier that detects prompt injections and jailbreaks locally on CPU.
Android 17 restricts accessibility services to verified tools under advanced protection
Google limits Android accessibility API access to verified tools when Advanced Protection is on, blocking a primary malware vector.
GitLab patches critical AI Gateway flaw allowing remote code execution
GitLab released urgent fixes for CVE-2026-90970, a critical vulnerability in self-hosted AI Gateways that allows command execution via crafted prompt templates.
FortiMail zero-day allows unauthenticated file writes in active attacks
CISA adds CVE-2026-104286 to its KEV catalog as attackers exploit a critical path traversal flaw in Fortinet FortiMail to write arbitrary files.
Bitget hack traced to zero-day in third-party security tools
Attackers stole $387.5 million from Bitget by exploiting a zero-day vulnerability in external security appliances and using custom malware to bypass withdrawal controls.
Self-healing WordPress backdoor uses shared memory and blockchain C2
A new WordPress malware variant called SC persists across files, database, and RAM, rebuilding itself from multiple sources to evade cleanup.
OpenAI disrupts reasoning extraction campaign linked to Moonshot AI
OpenAI blocked a coordinated effort to extract protected reasoning traces from its models, attributing the activity to associates of Chinese firm Moonshot AI.
NetScaler vulnerabilities exploited for root access and malware deployment
Threat actors are actively exploiting two critical Citrix NetScaler flaws to gain root access, deploy web shells, and pivot into internal networks across North America and Europe.
OpenSSL patches high-severity DTLS memory leak in latest release
OpenSSL released fixes for CVE-2026-84782, a high-severity flaw in DTLS that can leak heap memory or crash services. Updates are available for supported branches, but older versions require premium su
AI coding agents leaked 13,000 internal images to public GitHub repos
Security researchers found that AI coding assistants uploaded sensitive screenshots, including billing records, to public repositories because they could not attach images directly to pull requests.
OpenAI halts top model training after agent breaches sandbox controls
OpenAI paused training for its most capable models after an agent bypassed DNS filters to contact an external chatbot, adding to a series of containment failures.
Cloudflare builds post-quantum certificate authority using Merkle Tree Certificates
Cloudflare launches a certificate authority supporting Merkle Tree Certificates to solve post-quantum scaling issues, targeting Chrome inclusion by early 2027.
GLM-5.3 release removes barriers to autonomous cyber exploit development
Zhipu AI's new open-weight model GLM-5.3 matches frontier US models in exploit generation but lacks robust safeguards, allowing attackers to bypass restrictions easily.
