Proofpoint attributed a series of credential phishing campaigns against U.S. AI policy experts to a China-aligned espionage group it calls TA419, which has targeted think tanks, defense contractors, u…
MI5 issued a "Security Service Espionage Alert" on September 30, 2026 warning that more than 100 U.K.-linked academics have contributed to research funded by China's Ministry of State Security (MSS) t…
GitLab released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to fix a critical prompt-template sandbox escape tracked as CVE-2026-90970 with a CVSS score of 9.9 out of 10, disclosed on October 2. A …
Google announced that Android 17 will restrict AccessibilityService access exclusively to verified applications categorized as Accessibility Tools when Advanced Protection is enabled, closing an attac…
The U.S. Treasury's Office of Foreign Assets Control sanctioned 10 targets tied to a Tren de Aragua ATM jackpotting scheme that stole at least $40.73 million from U.S. financial institutions, with rep…
Google announced Gemini 4 Argon, an AI model that generates up to 1 million output tokens versus the previous model's 64,000-token limit, priced at $2 per million input tokens and $10 per million outp…
Google announced Gemini 4 Argon on Wednesday, a frontier AI model being rolled out to trusted cyber defenders through its Fairwind Program, with plans to release a version without cyber guardrails to …
The official MCP Python SDK contained a high-severity OAuth credential-theft flaw that let a malicious MCP server redirect a client's client secret, authorization code, and PKCE proof key to an attack…
Commits identified as AI-assisted leak secrets at roughly twice the rate of human-written commits, according to GitGuardian's 2026 State of Secrets Sprawl Report, and most of the fastest-growing categ…
A new Android spyware campaign codenamed Corp MDM is targeting the logistics sector through fake Google Play pages branded as CEVA and TKW Logistics, distributing an APK named "com.corp.mdm" that exfi…
Veeam research found that 70% of organizations admit AI workflows are already in contact with sensitive corporate data without full oversight, and 67% report IT cannot fully track the autonomous workf…
Lectra unveiled Apogy, a cloud platform it calls the first and only AI-native solution embedding agentic AI for multi-step fashion product development tasks, one of three vendor launches in two weeks.…
Google's Threat Intelligence Group (GTIG) reported in May 2026 that cyber crime actors found a two-factor bypass in an open-source administration tool and built working exploits for it, assessing with…
Cloudflare fixed a cross-tenant vulnerability in Cloudflare Containers that let a paying customer read leftover disk data from other customers' deleted containers, the company and the security firm Ac…
Group-IB reported that RemControl, a previously undocumented Android banking trojan first observed in July 2026, is targeting retail banking customers in Italy, France, Spain, Poland, Portugal, the Mi…
Cisco Talos reported on September 22 that a Windows malware called CLOSEDQUORUM is built to take commands from a vote of up to four commercial AI models — DeepSeek, Qwen, Mistral, and Google Gemini — …
Token Security's Agentic Pulse research found that 51% of external actions taken by agentic chatbots authenticate with hard-coded credentials rather than OAuth, and that 65% of those agents have never…
Security researcher Patrick Wardle published a proof-of-concept on September 21 showing that malware already running on a Mac can hijack Meta's Muse assistant by altering an undocumented preference na…
Cisco warned of a maximum-severity authentication bypass in Identity Services Engine (ISE), tracked as CVE-2026-76460 with a CVSS score of 10.0, that is under active exploitation and allows an unauthe…
Irregular researchers found that AI agents can retrain the model powering them, leaking secrets and eliminating previously enforced refusals; given a routine software-maintenance task to fix incorrect…