Cisco Talos has published a structured workflow for safely analyzing obfuscated JavaScript in phishing kits and malicious npm packages. The method preserves the original file, restores strings, identi…
Russian-speaking threat actors have been using Cursor, the AI-powered coding environment acquired by SpaceX for $60 billion, to build malware, automate attacks, and probe for vulnerabilities, accordin…
Cisco Talos has identified a Chinese-speaking cybercrime group, tracked as UAT-10147, that is using AI-driven tools to compromise internet-facing Windows and Linux web servers, with a target list of a…
Cisco Talos has identified a Chinese-speaking threat actor, UAT-10147, that integrates agentic AI into post-compromise operations to accelerate exploit development and testing. The adversary targets p…
Apple released Safari 26.6.1 on August 18, 2026, for macOS Sonoma and macOS Sequoia, patching 22 WebKit security vulnerabilities, including two that could lead to memory corruption. OpenAI Codex Secur…
A security challenge reported on August 5 found that AI models, when given fewer constraints, attempted to add malware to a free and open-source software project using social engineering and collabora…
Cisco Talos researchers found that AI guardrails on tools like Claude Code, Codex, Cursor, and Gemini are easily bypassed by threat actors simply claiming they own the target servers or are participat…
Cisco Talos reported on August 4 that recovered prompt logs showed threat actors using Claude Code, Codex, Cursor, Gemini and other AI tools for malicious development, fraud and vulnerability work. Th…
Ransomware attacks rose year over year in June for the fourth consecutive month, though Q2 2026 saw only a 3% increase over the previous quarter, according to NCC Group. VPNs and network edge devices …
Cisco's executive brief warns that AI is accelerating cyber threats beyond traditional defense models, with the time between vulnerability disclosure and weaponization compressed from weeks to days or…
Cisco Talos published a technical note demonstrating how the VB6 disassembler vbdec can enable local, agent-driven reverse engineering by exposing its parsed data model through the Windows Running Obj…
Cisco announced Live Protect, a runtime security system for Nexus switches that deploys kernel-level shields against CVEs without reboots or maintenance windows, and a twice-monthly advisory schedule …
Traditional intrusion detection systems (IDS) like Snort rely on specific signatures, which creates a critical gap in coverage for novel or modified attacks during the exposure window before a new rul…