NewsUpdated daily
Cybersecurity news,
governed by design.
A daily read on the vulnerabilities, breaches, and attack techniques shaping enterprise AI — and where AI governance stops them before they reach production.
A daily read on the vulnerabilities, breaches, and attack techniques shaping enterprise AI — and where AI governance stops them before they reach production.
The *sshole flaw lets an oversized password log in to password-disabled accounts on musl-based OpenSSH servers such as Alpine. Conditions, the 10.6p2 fix, and what to check.
DigiCert disclosed that a February 2025 server migration exposed an internal system, and an unauthorized account read archived customer data including ID documents. What happened and how to triage the same signal.
mSeven Software says suspicious activity hit the mSecure password manager, and support replies reportedly describe a stolen encrypted cloud database. What is known, what is not, and a response checklist.
VulnCheck saw attackers exploit Node-RED CVE-2026-58115 (CVSS 10) from 30 October, planting a Linux bot and webshells. Siemens SIMATIC IoT2050 devices are affected. What to check.
CrowdStrike links Vapor Panda to AI-agent attacks on 200+ organizations in 14 countries, and DIVD logged an ARTEX agent reaching root in 12 minutes. What machine-speed intrusions look like and how to detect them.
CISA lists GitLab CVE-2026-97229 as exploited; Alpine Linux upgraded yet stayed exposed because Ruby needed patching too. About 2,800 CE instances are public.
WIRED reports an Accenture contractor connected a personal Claude Code agent to a Pentagon CUI system using their own credentials. It ran for about two months and sent passwords and a network map off-network. What that means for AI agent governance.
North Korea's TraderTraitor group is blamed for the record $6.3 billion Binance theft. The entry point was a compromised engineer laptop, and staging began 36 hours before the money moved. What the detection window looked like.
Dream reports a PHP2Shell attack chain that moved from exposed firewall management to an LDAP service account across 25 servers. How the pivot works and what to detect.
CISA added the Node.js Brotli flaw CVE-2026-111497 and the Adobe Commerce PolyShell flaw CVE-2026-48356 to its KEV catalog on 27 October 2026. Patches exist; here is why that is not enough.
Google's Threat Intelligence Group says criminals used an AI model to build a zero-day 2FA bypass for mass exploitation, and disrupted it before launch. What it means for patching.
Qilin and INC ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto GlobalProtect, to get past MFA and reach VMware vCenter and domain controllers. What happened, the attack path, and how to detect it.
A Chinese-speaking operator used autonomous AI agents built on the open-source Cairn tool to target more than 1,200 websites and breach more than 100 companies. How it worked, who was named, and how to find your exposed sites first.
CISA and the FBI say SafePay ransomware has hit at least 600 organisations and resets backup storage before encrypting. The attack chain, mitigations and detection points.
Amazon says PHP2Shell exploitation began four days before patches, and PHP has now disclosed an unpatched RCE, CVE-2026-115560. Timeline, mitigation, and how to find exposed PHP hosts.
LiteLLM 1.107.0 on PyPI, Docker Hub and GHCR carried an info-stealer for about three hours. Affected tags, how the .pth persistence works, and what to rotate and rebuild.
Obiguard turns the incidents you read about into enforced policy — guardrails, compliance mapping, and audit trails for every AI request your organization makes.
Talk to us →