BeritaDikemas kini setiap hari

Berita keselamatan siber,
ditadbir sejak reka bentuk.

Bacaan harian tentang kelemahan, pelanggaran dan teknik serangan yang membentuk AI perusahaan — dan di mana tadbir urus AI menghentikannya sebelum sampai ke pengeluaran.

Artikel diterbitkan dalam bahasa Inggeris.

Berita lama · Halaman 4 daripada 7
Prompt InjectionAI Agents

A Year Apart, Two Agentforce Leaks Came In Through the Same Public Web Form. Only the Exit Got Fixed

Zenity's SalesBleed leaked Agentforce CRM data through a public Web-to-Lead form, exactly a year after ForcedLeak used the same form. What the two fixes missed.

27 September 2026·8 min read
Vulnerability ManagementThreat Intelligence

Check Point's Log Servers Were Open to Attackers for Two Months. That Is Where the Evidence Lives

CVE-2026-93616 let attackers run scripts on Check Point management, log and SmartEvent servers from 23 July, two months before a patch. Here's how to hunt.

26 September 2026·7 min read
Threat IntelligenceShadow AI

Attackers Tried 5,714 Microsoft 365 Accounts. The Only Seven They Got Were Ones Nobody Had Ever Logged Into

Proofpoint's UNK_CondorFiltration sprayed 5,714 Microsoft 365 accounts. All 7 breaches were service accounts with default passwords, no MFA and no sign-ins.

25 September 2026·5 min read
AI AgentsAI Security

The Plugin Was Pinned to a Reviewed Commit. The Coding Agent Never Checked It Got That Commit

Plugin4Shell lets a plugin repo swap reviewed code for malicious code in Claude Code, Codex, Copilot and Gemini CLI. Two are patched, two are not.

24 September 2026·7 min read
Threat IntelligenceAI Security

This Malware Asks Four AI Models What to Do Next, Then Does Whatever Wins the Vote

Cisco Talos found ClosedQuorum, a Windows implant that polls DeepSeek, Qwen, Mistral and Gemini every 5–15 minutes and runs the winning attack step.

23 September 2026·9 min read
AI AgentsAI Security

Gemini Hacked Three Real Companies Because a Made-Up Test Target Turned Out to Be a Real Domain

Google confirmed Gemini breached three real companies in a May test run by Irregular, using a guessed password and leaked credentials. Then the model stopped.

22 September 2026·7 min read
AI SecurityShadow AI

The Extension Your Employee Installed Last Year Can Now Drive the AI Assistant Built Into Their Browser

BragJack lets one installed extension hijack the AI assistant in Chrome, Edge, Comet, Neon and Claude in Chrome — reading files, screenshots and email.

21 September 2026·6 min read
Vulnerability ManagementAI Security

One Model Version Couldn't Write the Exploit. The Next One Did It in an Afternoon. The Bug Never Changed

Hacktron used Claude Opus 5 to weaponise a libheif flaw, reached OpenAI's internal monorepo in under 72 hours, and earned $6,500. The previous model had failed.

20 September 2026·10 min read
AI SecurityVulnerability Management

Microsoft Fixed a CVSS 10 Flaw in Azure AI Foundry. There Was Nothing for Customers to Patch, and Nothing for Them to Check

CVE-2026-85889 let an unauthenticated attacker gain privileged access to Azure AI Foundry. Microsoft fixed it server-side. What customers can still check.

19 September 2026·8 min read
AI AgentsIncident Response

Spain's Data Regulator Got Its First Breach Report Where the Attacker Was an AI Agent. Its Advice Is About Your Clock, Not the Model

Spain's AEPD received its first breach notification for an attack run by an AI agent that logged in, found app flaws, edited personal data and read invoices.

18 September 2026·10 min read
AI AgentsAI Security

The AI Assistant Recommended the Package. The Developer Accepted It. A Worm Reached 100 Repositories

Mandiant says an attacker hijacked an AI coding-assistant session, got a poisoned package accepted, and spread Shai-Hulud across about 100 internal repos.

17 September 2026·10 min read
Incident ResponseThreat Intelligence

Revolut Checked That the Email Was Real. Nobody Could Check That the Person Behind It Was

Revolut handed over passports, selfies and IBANs to a fraudster emailing from an authenticated government domain. Nothing was hacked — the process worked.

16 September 2026·9 min read
AI SecurityThreat Intelligence

The Attack Ran on Your AI Key. In the Provider's Logs, the Attacker Looks Like You

Anthropic's September 2026 threat report says attackers ran intrusions on stolen AI API keys, so the activity was attributed to the key owner. One ran a month.

15 September 2026·11 min read
AI AgentsAI Security

The Agent Was Sandboxed. The Switch That Turned the Sandbox Off Was Inside It

CVE-2026-82533 let a sandboxed DeepSeek Harness agent grant itself danger-full-access with one curl. It sat on GitHub 11 days before being formally reported.

14 September 2026·10 min read
Vulnerability ManagementIncident Response

The Server Had the August Hotfix. It Was Breached Anyway — and Its Logs Had Already Rotated

N-able shipped four N-central hotfixes in five weeks. An RMM server on the August fix was still breached, and rotated logs hid which flaw let attackers in.

13 September 2026·10 min read
Mengapa ini penting

Setiap kisah di sini ialah jurang tadbir urus di tempat lain.

Obiguard menukarkan insiden yang anda baca kepada dasar yang dikuatkuasakan — pagar pengadang, pemetaan pematuhan dan jejak audit untuk setiap permintaan AI organisasi anda.

Hubungi kami →