NewsUpdated daily

Cybersecurity news,
governed by design.

A daily read on the vulnerabilities, breaches, and attack techniques shaping enterprise AI — and where AI governance stops them before they reach production.

Older news · Page 3 of 5
Vulnerability ManagementIncident Response

The Server Had the August Hotfix. It Was Breached Anyway — and Its Logs Had Already Rotated

N-able shipped four N-central hotfixes in five weeks. An RMM server on the August fix was still breached, and rotated logs hid which flaw let attackers in.

September 13, 2026·10 min read
AI SecurityShadow AI

Six Chinese AI Labs Distilled US Models Through Cut-Price API Resellers. Other Customers' Prompts Were the Camouflage

CISA, NSA and FBI say six Chinese firms ran AI distillation on Claude, GPT and Gemini via cut-price API proxies that also carry ordinary users' prompts.

September 12, 2026·11 min read
Prompt InjectionAI Security

Your Filter, Your Staff and Your AI Summariser Each Read a Different Email. Attackers Now Write for All Three

Microsoft saw 2.37M daily phishing emails split lure words with invisible Unicode. Forcepoint's hidden HTML rewrote an AI email summary in 10 of 10 runs.

September 11, 2026·11 min read
Threat IntelligenceVulnerability Management

The Fix Was Public on August 7. It Reached Your Browser Four Weeks Later. Four Espionage Groups Used the Gap

Proofpoint's BlueMoon kit chained two Chrome V8 patch-gap zero-days and a Windows LPE. Four China-nexus espionage clusters ran identical code within a week.

September 10, 2026·9 min read
AI SecurityThreat Intelligence

The Malware Put a Weapons Jailbreak at the Top of the File So the Scanner Would Refuse to Read It

Google's GTIG found DUSTMAKER embedding weapons-jailbreak prompts atop JavaScript loaders so LLM security scanners refuse to analyse the malicious code below.

September 9, 2026·11 min read
Shadow AIAI Security

The Backdoor Asked for Cookies, Every Tab and Every Site. So Does the AI Assistant Your Staff Installed Last Month

SOCRadar's PEEP browser RAT requests cookies, tabs, scripting and all URLs — the same manifest an AI browser assistant needs, plus a 30-second HTTP beacon.

September 8, 2026·8 min read
Vulnerability ManagementAI Security

JetBrains Told Customers to Treat the Outputs of Their Own AI Compute Runs as Untrusted. Almost Nobody Can List Which Runs Those Were

Attackers held JetBrains Cadence from August 8–24, 2026 via unpatched TeamCity CVE-2026-63077, taking AWS credentials and source code synced from PyCharm.

September 7, 2026·10 min read
Threat IntelligenceIncident Response

The Backdoor Did Not Hide From Your Monitoring. It Edited the Numbers Your Monitoring Reads

Rapid7 Labs found ted, a DPRK-linked implant compiled into HAProxy 2.8.12 at two South Korean firms. It subtracts its own traffic from the proxy's counters.

September 6, 2026·10 min read
Vulnerability ManagementAI Security

Three of the Seven Flaws CISA Added This Week Were AI Infrastructure — and the Attackers Went Straight for the API Keys

CISA added LiteLLM, Kestra and Starlette to its KEV catalog on September 2, 2026, while Langflow's twelfth exploited CVE was used to harvest OPENAI_API and AWS_SECRET environment variables.

September 5, 2026·10 min read
AI AgentsVulnerability Management

The Model Never Saw It. The Agent Ran It Anyway — Before the Trust Prompt Appeared

Manifold Security's GitSpawn abuses core.fsmonitor to run attacker code in seven AI coding agents. Four of eight findings were still unpatched on September 1, 2026.

September 4, 2026·10 min read
AI SecurityThreat Intelligence

Three Labs Shipped Autonomous Zero-Day Discovery in Two Days. The Vetting Happens at Their Door, Not Yours

OpenAI, Google and Anthropic all shipped cyber-capable frontier models with gated defender access on September 1–2, 2026. Astra is the first model OpenAI has rated Critical.

September 3, 2026·9 min read
Vulnerability ManagementAI Security

The Registry That Hosted the Agent Message Board Now Hands Out Admin Tokens to Anyone Who Asks

CVE-2026-82329, a CVSS 9.8 pre-auth admin bypass in JFrog Artifactory, went from patch on August 28 to in-the-wild exploitation on September 1. It is not in CISA KEV.

September 2, 2026·10 min read
Threat IntelligenceAI Agents

The Ransomware Operator Left the Transcript Behind — and It Shows an AI Agent Doing the Lateral Movement

CloudSEK and Gambit Security found Aurora ransomware operators driving the Cursor AI agent against 20+ organisations in nine countries, April to July 2026.

September 1, 2026·7 min read
AI AgentsPrompt Injection

Nothing in the Conversation Was Malicious. The Agent Assembled the Attack Out of Three Harmless Pieces

ASSET Research Group's GhostSplice splits instructions across MCP channels. Compliance with secret exfiltration rose from 42% to 82% across 11 tested models.

August 31, 2026·9 min read
AI AgentsVulnerability Management

Your Ticketing System Became Your AI Runtime. Then It Shipped Three CVSS 10.0 Pre-Auth Flaws

ServiceNow disclosed three CVSS 10.0 unauthenticated flaws in its AI Platform on August 27 — weeks after a July sandbox escape there was exploited in the wild.

August 30, 2026·8 min read
Why this matters

Every story here is a governance gap somewhere else.

Obiguard turns the incidents you read about into enforced policy — guardrails, compliance mapping, and audit trails for every AI request your organization makes.

Talk to us →