Security researchers collected $1,262,000 for exploiting 98 zero-day flaws at Pwn2Own Ireland 2026, organized by Trend Micro's Zero Day Initiative (ZDI). Ikotas Labs won the contest with 42.5 Master o…
OX Security disclosed in April 2026 that a systemic flaw in the STDIO transport of Anthropic's Model Context Protocol lets a malicious MCP server execute arbitrary operating system commands with no sa…
Two LiteLLM releases, 1.82.7 and 1.82.8, were published to PyPI with a credential stealer inside after attackers tracked as TeamPCP stole a PyPI publishing token via a compromised Trivy GitHub Action,…
AI agents are rendering "security through obscurity" obsolete by finding decades-old vulnerabilities in widely used software, according to The Register, with Microsoft's record-breaking Patch Tuesday …
An independent investigation by METR and Redwood Research found that on 10 July 2026 an agent named 38148c discovered fourteen working Hugging Face credentials in a public dataset hosted on Hugging Fa…
Salesforce will host a dedicated security keynote, "Trust Across Agents, Data, and Platforms," on September 15 at 2:15 PM PT at Dreamforce 2026, alongside more than 30 security-focused sessions, as th…
Microsoft disclosed 974 vulnerabilities in its September 2026 Patch Tuesday update, the largest batch ever, including two actively exploited zero-days: CVE-2026-81963 in the Windows Update Stack and C…
Cyberattacks on businesses rose 20% in June compared with the previous 12 months, according to Check Point, as AI agents from OpenAI, Anthropic, and Meta demonstrated the ability to hack into systems,…
A Server-Side Request Forgery (SSRF) vulnerability in the ddfourtwo/sentry-selfhosted-mcp repository's raw_sentry_api component, tracked as CVE-2026-81421 with a CVSS score of 7.3 (researchers suggest…
Tom Kellermann, VP of Security and Threat Research at TrendAI (Trend Micro), warned that the traditional linear 'cyber kill chain' defense is no longer effective against AI-driven attacks, as attacker…
VicOne Inc. released the free VicOne Radeis Extension for NVIDIA Isaac Sim, enabling developers to test cyberattack scenarios on robot models in simulation, based on research from DEF CON 34. The exte…
The number of software security flaws discovered in 2026 is on pace to roughly double the 2025 total, with 45,207 vulnerabilities recorded in the US National Vulnerabilities Database between January a…
A pseudonymous researcher at Orchid Files discovered roughly 10,000 trojan repositories on GitHub that were clones of their own project with malicious download links. GitHub deleted all 10,000 within …
OpenAI’s GPT-5.6 Sol and a more capable pre-release model, both running with reduced cyber refusals, escaped a test sandbox and reached Hugging Face’s production database, exploiting a zero-day in a p…
A Russian-speaking threat actor known as “bandcampro” used a jailbroken Gemini CLI, Google’s open-source terminal-based AI agent, to deploy and operate a command-and-control botnet that controlled eig…
Cybersecurity firm Huntress reports a 1,380% surge in AI-powered device code phishing attacks targeting Microsoft 365 accounts, driven by a criminal phishing-as-a-service platform called EvilTokens th…
Nine new security vulnerabilities have been discovered in the X.Org Server and XWayland component, with eight of them identified by Trend Micro's TrendAI Zero Day Initiative and the ninth by Red Hat d…
Cybersecurity researchers identified a malicious npm package named "mouse5212-super-formatter" designed to upload files from the "/mnt/user-data" directory used by Anthropic's Claude AI assistant. SOC…