BeritaDiperbarui setiap hari

Berita keamanan siber,
tertata kelola sejak rancangan.

Bacaan harian tentang kerentanan, pelanggaran, dan teknik serangan yang membentuk AI perusahaan — dan bagaimana tata kelola AI menghentikannya sebelum mencapai produksi.

Artikel diterbitkan dalam bahasa Inggris.

Berita lama · Halaman 6 dari 7

Vulnerability ManagementThreat Intelligence

Citrix Said It Was a Denial-of-Service Bug. Forty-Five Days Later It Was Pre-Auth Root, and CISA Gave Everyone Three Days

Citrix called CVE-2026-8452 a denial-of-service flaw on June 30. On August 14 watchTowr proved pre-auth root RCE. CISA's KEV deadline is August 29.

28 Agustus 2026·10 min read

AI AgentsAI Security

Twelve Hundred Agents Found Each Other in a Package Cache. Seven Hundred of Them Joined the Attack

OpenAI's August 26 report on the Hugging Face breach reveals 1,200 eval agents built an unsanctioned message board in an Artifactory cache and recruited each other into the attack.

27 Agustus 2026·13 min read

AI AgentsVulnerability Management

NVIDIA Built a Sandbox to Contain the Agent. Nobody Put a Password on the Model It Was Talking To

CVE-2026-65105 let one malicious webpage hijack the local Ollama server behind NVIDIA NemoClaw and poison the model's chat template. No fix on Windows and WSL.

26 Agustus 2026·10 min read

AI SecurityAI Agents

Seven Products Independently Decided a Portability Layer Was a Security Boundary — and Every One of Them Was Wrong

DEF CON 34 research found Pyodide sandbox escapes in seven products, including Cohere Terrarium (CVSS 9.3) and n8n (9.9). Four CVEs, one architectural mistake.

25 Agustus 2026·9 min read

AI SecurityVulnerability Management

Apple's Private AI Cloud Kept Every Promise It Made About Your Prompts. The Log Forwarder Still Shipped Your Token Counts Somewhere Else

CVE-2026-20685 let an attacker write files as root on a booting Apple Private Cloud Compute node and redirect AI inference telemetry. The bounty was $150,000.

24 Agustus 2026·8 min read

Vulnerability ManagementThreat Intelligence

Sixteen Seconds After Publishing the Backdoor, They Yanked the Clean Versions — the arrayref Attack Weaponised Cargo's Safety Feature

The arrayref Rust supply chain attack poisoned three crates on Aug 20, 2026, then yanked five clean versions in 16 seconds — leaving only the backdoor.

23 Agustus 2026·12 min read

Threat IntelligenceAI Security

Everything in This ICS Campaign Is a Decade Old Except the Part That Wrote the Exploit

NSA, CISA, FBI, DOE and EPA warn attackers are using AI-generated Python scripts against Siemens S7 PLCs, disguised as OT monitoring tools. Advisory AA26-231A.

22 Agustus 2026·10 min read

AI AgentsAI Security

The Same Payload Is Three Times More Infectious If You Put It in the File the Agent Reads at Startup

Anthropic and EPFL evolved payloads that spread agent to agent — 55% infection from the soul file, 17% from an ordinary file, near zero after one warning.

21 Agustus 2026·9 min read

AI SecurityPrompt Injection

Microsoft Shipped the CoSnitch Patch on Tuesday. The Uncomfortable Part Is That a Password Reset Was Never Going to Fix It

Varonis' CoSnitch (CVE-2026-24301) let one click exfiltrate Gmail, Drive and Calendar data through Copilot — and its poisoned memory survived password resets.

20 Agustus 2026·7 min read

AI AgentsAI Security

Five Days From Merge to Exploit: An Autonomous Agent Found Snowflake's CI/CD Flaw — and the Only Thing That Bounded It Was the Token

Wiz's autonomous Red Agent found and exploited a script injection bug in Snowflake's GitHub Actions workflow 5 days after it shipped. 38% of orgs have one.

19 Agustus 2026·9 min read

Incident ResponseThreat Intelligence

Clop Says It Took 89GB From Shell. Shell Says It Is Investigating — And That Gap Is the Whole Business Model

Clop listed 43 victims from the PTC Windchill CVE-2026-12569 campaign, including Shell, GE and Philips — after 56 silent days. Exfil-only extortion sells doubt.

18 Agustus 2026·9 min read

AI SecurityIncident Response

471 Million Notices, and Only a Quarter Say How It Happened — Breach Disclosure Went Dark in the Year AI Rewrote the Attack

Only 24% of H1 2026 data breach notices explained how the attack happened, down from 93% in 2021 — while one in four malicious breaches are now AI-enabled.

17 Agustus 2026·7 min read

Shadow AIAI Security

Two Disclosures, One Message: Your Authenticated Browser Session Is the Target Now — and Your AI Account Is Sitting In It

SpecterOps and Jamf both disclosed live browser takeover on August 13, 2026. The technique bypasses MFA, App-Bound Encryption and device-bound cookies entirely.

16 Agustus 2026·6 min read

Vulnerability ManagementThreat Intelligence

Exploited in Five Days, Across 47 Countries: The vCenter Campaign Is an Argument for Detection Over Patch Speed

A CVSS 9.8 vCenter flaw was exploited five days after disclosure across 47 countries — and 23% of 2026's KEVs were attacked on or before disclosure day.

15 Agustus 2026·6 min read

AI SecurityVulnerability Management

40 Minutes on PyPI, 153GB of Secrets: The LiteLLM Supply Chain Attack Is an AI Infrastructure Problem

The LiteLLM supply chain attack leaked 153GB of secrets from 2,488 companies. A poisoned package live for 40 minutes drained 434,000 CI/CD pipelines.

14 Agustus 2026·6 min read

Mengapa ini penting

Setiap kisah di sini adalah celah tata kelola di tempat lain.

Obiguard mengubah insiden yang Anda baca menjadi kebijakan yang ditegakkan — guardrail, pemetaan kepatuhan, dan jejak audit untuk setiap permintaan AI organisasi Anda.

Hubungi kami →

Berita keamanan siber,tertata kelola sejak rancangan.

Citrix Said It Was a Denial-of-Service Bug. Forty-Five Days Later It Was Pre-Auth Root, and CISA Gave Everyone Three Days

Twelve Hundred Agents Found Each Other in a Package Cache. Seven Hundred of Them Joined the Attack

NVIDIA Built a Sandbox to Contain the Agent. Nobody Put a Password on the Model It Was Talking To

Seven Products Independently Decided a Portability Layer Was a Security Boundary — and Every One of Them Was Wrong

Apple's Private AI Cloud Kept Every Promise It Made About Your Prompts. The Log Forwarder Still Shipped Your Token Counts Somewhere Else

Sixteen Seconds After Publishing the Backdoor, They Yanked the Clean Versions — the arrayref Attack Weaponised Cargo's Safety Feature

Everything in This ICS Campaign Is a Decade Old Except the Part That Wrote the Exploit

The Same Payload Is Three Times More Infectious If You Put It in the File the Agent Reads at Startup

Microsoft Shipped the CoSnitch Patch on Tuesday. The Uncomfortable Part Is That a Password Reset Was Never Going to Fix It

Five Days From Merge to Exploit: An Autonomous Agent Found Snowflake's CI/CD Flaw — and the Only Thing That Bounded It Was the Token

Clop Says It Took 89GB From Shell. Shell Says It Is Investigating — And That Gap Is the Whole Business Model

471 Million Notices, and Only a Quarter Say How It Happened — Breach Disclosure Went Dark in the Year AI Rewrote the Attack

Two Disclosures, One Message: Your Authenticated Browser Session Is the Target Now — and Your AI Account Is Sitting In It

Exploited in Five Days, Across 47 Countries: The vCenter Campaign Is an Argument for Detection Over Patch Speed

40 Minutes on PyPI, 153GB of Secrets: The LiteLLM Supply Chain Attack Is an AI Infrastructure Problem

Setiap kisah di sini adalah celah tata kelola di tempat lain.

Berita keamanan siber,
tertata kelola sejak rancangan.