BeritaDiperbarui setiap hari

Berita keamanan siber,
tertata kelola sejak rancangan.

Bacaan harian tentang kerentanan, pelanggaran, dan teknik serangan yang membentuk AI perusahaan — dan bagaimana tata kelola AI menghentikannya sebelum mencapai produksi.

Artikel diterbitkan dalam bahasa Inggris.

Berita lama · Halaman 5 dari 7
AI SecurityShadow AI

Six Chinese AI Labs Distilled US Models Through Cut-Price API Resellers. Other Customers' Prompts Were the Camouflage

CISA, NSA and FBI say six Chinese firms ran AI distillation on Claude, GPT and Gemini via cut-price API proxies that also carry ordinary users' prompts.

12 September 2026·10 min read
Prompt InjectionAI Security

Your Filter, Your Staff and Your AI Summariser Each Read a Different Email. Attackers Now Write for All Three

Microsoft saw 2.37M daily phishing emails split lure words with invisible Unicode. Forcepoint's hidden HTML rewrote an AI email summary in 10 of 10 runs.

11 September 2026·11 min read
Threat IntelligenceVulnerability Management

The Fix Was Public on August 7. It Reached Your Browser Four Weeks Later. Four Espionage Groups Used the Gap

Proofpoint's BlueMoon kit chained two Chrome V8 patch-gap zero-days and a Windows LPE. Four China-nexus espionage clusters ran identical code within a week.

10 September 2026·9 min read
AI SecurityThreat Intelligence

The Malware Put a Weapons Jailbreak at the Top of the File So the Scanner Would Refuse to Read It

Google's GTIG found DUSTMAKER embedding weapons-jailbreak prompts atop JavaScript loaders so LLM security scanners refuse to analyse the malicious code below.

9 September 2026·11 min read
Shadow AIAI Security

The Backdoor Asked for Cookies, Every Tab and Every Site. So Does the AI Assistant Your Staff Installed Last Month

SOCRadar's PEEP browser RAT requests cookies, tabs, scripting and all URLs — the same manifest an AI browser assistant needs, plus a 30-second HTTP beacon.

8 September 2026·7 min read
Vulnerability ManagementAI Security

JetBrains Told Customers to Treat the Outputs of Their Own AI Compute Runs as Untrusted. Almost Nobody Can List Which Runs Those Were

Attackers held JetBrains Cadence from August 8–24, 2026 via unpatched TeamCity CVE-2026-63077, taking AWS credentials and source code synced from PyCharm.

7 September 2026·10 min read
Threat IntelligenceIncident Response

The Backdoor Did Not Hide From Your Monitoring. It Edited the Numbers Your Monitoring Reads

Rapid7 Labs found ted, a DPRK-linked implant compiled into HAProxy 2.8.12 at two South Korean firms. It subtracts its own traffic from the proxy's counters.

6 September 2026·10 min read
Vulnerability ManagementAI Security

Three of the Seven Flaws CISA Added This Week Were AI Infrastructure — and the Attackers Went Straight for the API Keys

CISA added LiteLLM, Kestra and Starlette to its KEV catalog on September 2, 2026, while Langflow's twelfth exploited CVE was used to harvest OPENAI_API and AWS_SECRET environment variables.

5 September 2026·10 min read
AI AgentsVulnerability Management

The Model Never Saw It. The Agent Ran It Anyway — Before the Trust Prompt Appeared

Manifold Security's GitSpawn abuses core.fsmonitor to run attacker code in seven AI coding agents. Four of eight findings were still unpatched on September 1, 2026.

4 September 2026·9 min read
AI SecurityThreat Intelligence

Three Labs Shipped Autonomous Zero-Day Discovery in Two Days. The Vetting Happens at Their Door, Not Yours

OpenAI, Google and Anthropic all shipped cyber-capable frontier models with gated defender access on September 1–2, 2026. Astra is the first model OpenAI has rated Critical.

3 September 2026·7 min read
Vulnerability ManagementAI Security

The Registry That Hosted the Agent Message Board Now Hands Out Admin Tokens to Anyone Who Asks

CVE-2026-82329, a CVSS 9.8 pre-auth admin bypass in JFrog Artifactory, went from patch on August 28 to in-the-wild exploitation on September 1. It is not in CISA KEV.

2 September 2026·10 min read
Threat IntelligenceAI Agents

The Ransomware Operator Left the Transcript Behind — and It Shows an AI Agent Doing the Lateral Movement

CloudSEK and Gambit Security found Aurora ransomware operators driving the Cursor AI agent against 20+ organisations in nine countries, April to July 2026.

1 September 2026·7 min read
AI AgentsPrompt Injection

Nothing in the Conversation Was Malicious. The Agent Assembled the Attack Out of Three Harmless Pieces

ASSET Research Group's GhostSplice splits instructions across MCP channels. Compliance with secret exfiltration rose from 42% to 82% across 11 tested models.

31 Agustus 2026·9 min read
AI AgentsVulnerability Management

Your Ticketing System Became Your AI Runtime. Then It Shipped Three CVSS 10.0 Pre-Auth Flaws

ServiceNow disclosed three CVSS 10.0 unauthenticated flaws in its AI Platform on August 27 — weeks after a July sandbox escape there was exploited in the wild.

30 Agustus 2026·8 min read
Shadow AIIncident Response

Nobody Exploited Anything at McKesson. Two Phone Calls and a Consent Screen Moved 284 Million Records

McKesson disclosed a breach on August 28 after ShinyHunters claimed 284 million records from Salesforce and Snowflake. No CVE, no malware — vishing and a connected app.

29 Agustus 2026·7 min read
Mengapa ini penting

Setiap kisah di sini adalah celah tata kelola di tempat lain.

Obiguard mengubah insiden yang Anda baca menjadi kebijakan yang ditegakkan — guardrail, pemetaan kepatuhan, dan jejak audit untuk setiap permintaan AI organisasi Anda.

Hubungi kami →