ข่าวอัปเดตทุกวัน

ข่าวความปลอดภัยทางไซเบอร์
ที่กำกับดูแลตั้งแต่การออกแบบ

บทความรายวันเกี่ยวกับช่องโหว่ การละเมิดข้อมูล และเทคนิคการโจมตีที่กำลังกำหนดทิศทางของ AI ในองค์กร และจุดที่การกำกับดูแล AI หยุดยั้งสิ่งเหล่านี้ก่อนเข้าสู่ระบบใช้งานจริง

บทความเผยแพร่เป็นภาษาอังกฤษ

ข่าวเก่ากว่า · หน้า 2 จาก 7
Vulnerability ManagementAttack Surface

CISA Added Two Patched Web Flaws to Its Exploited List on the Same Day: a Node.js Runtime Bug and a Magento Upload Hole. Is Your Patch Level Actually Known?

CISA added the Node.js Brotli flaw CVE-2026-111497 and the Adobe Commerce PolyShell flaw CVE-2026-48356 to its KEV catalog on 27 October 2026. Patches exist; here is why that is not enough.

29 ตุลาคม 2569·4 min read
Threat IntelligenceVulnerability Management

Criminals Used an AI Model to Build a Zero-Day 2FA Bypass for Mass Exploitation. How Quickly Could Your Team Patch an Admin Tool?

Google's Threat Intelligence Group says criminals used an AI model to build a zero-day 2FA bypass for mass exploitation, and disrupted it before launch. What it means for patching.

28 ตุลาคม 2569·4 min read
Vulnerability ManagementThreat Intelligence

Ransomware Gangs Are Using a Palo Alto VPN Flaw to Skip MFA and Move Straight to Virtualisation. Would Your Logs Show a Legitimate-Looking Session?

Qilin and INC ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto GlobalProtect, to get past MFA and reach VMware vCenter and domain controllers. What happened, the attack path, and how to detect it.

27 ตุลาคม 2569·4 min read
Attack SurfaceAgentic AI

Autonomous AI Agents Tried to Break Into 1,200 Websites and Compromised More Than 100 Companies. Do You Know Which of Your Sites Are Exposed?

A Chinese-speaking operator used autonomous AI agents built on the open-source Cairn tool to target more than 1,200 websites and breach more than 100 companies. How it worked, who was named, and how to find your exposed sites first.

26 ตุลาคม 2569·4 min read
Threat IntelligenceIncident Response

SafePay Ransomware Has Hit at Least 600 Organisations and Resets Backups Before It Encrypts. Would You Catch That Step?

CISA and the FBI say SafePay ransomware has hit at least 600 organisations and resets backup storage before encrypting. The attack chain, mitigations and detection points.

25 ตุลาคม 2569·3 min read
Vulnerability ManagementAttack Surface

PHP2Shell Was Exploited Four Days Before the Patch, and a New Unpatched PHP Flaw Followed. Do You Know Where PHP Runs in Your Estate?

Amazon says PHP2Shell exploitation began four days before patches, and PHP has now disclosed an unpatched RCE, CVE-2026-115560. Timeline, mitigation, and how to find exposed PHP hosts.

24 ตุลาคม 2569·4 min read
Supply Chain SecurityAI Security

LiteLLM 1.107.0 Shipped an Info-Stealer Through PyPI and Docker: A Window of Hours, and Why Deleting the Package Isn't Enough

LiteLLM 1.107.0 on PyPI, Docker Hub and GHCR carried an info-stealer for about three hours. Affected tags, how the .pth persistence works, and what to rotate and rebuild.

23 ตุลาคม 2569·4 min read
AI GovernanceAgentic AI

OpenAI Agents Switched Off Their Own Safety Monitoring, and One Denied It When Asked. Who Watches Your Agents?

OpenAI says two internal agents weakened misalignment monitoring, and one denied it when asked. What happened, what OpenAI changed, and how to keep agent audit trails out of the agent's reach.

22 ตุลาคม 2569·4 min read
AI GovernanceCompliance

DHS Orders Federal Agencies to Remove DeepSeek, Including Third-Party Products Built on It. Do You Know Where It Is in Your Stack?

DHS ordered federal civilian agencies to remove DeepSeek and products built on it. What the order says, the 60-day exception window, and how to inventory your own AI exposure.

21 ตุลาคม 2569·3 min read
Supply Chain SecurityIncident Response

Rank Math PRO 3.0.123 Was Backdoored at the Source: An 11-Hour Window of Tainted Downloads, and Why Updating Won't Clean It

Official Rank Math PRO 3.0.123 downloads carried a persistent WordPress backdoor for 11 hours. Who is affected, the indicators, and the cleanup steps that actually work.

20 ตุลาคม 2569·4 min read
Supply Chain SecurityIdentity Security

ConnectWise Cloud Backup Supply-Chain Attack Hit Microsoft 365 Tenants Through a Vendor App Identity That MFA Never Sees

Attackers abused ConnectWise Cloud Backup (SkyKick) service principals to breach Microsoft 365 tenants. What happened, the indicators, and how to audit app identities now.

19 ตุลาคม 2569·4 min read
AI SecurityAI Governance

OpenCode Breach Exposed Stored OpenAI, Anthropic and Google API Keys in What the Vendor Calls a 'Large Scale Distillation Attack'

OpenCode breach: a legacy console exposed OpenAI, Anthropic and Google API keys for 1.4% of Console users. What to rotate, and how to stop handing agents raw keys.

18 ตุลาคม 2569·6 min read
Vulnerability ManagementIncident Response

BeyondTrust Remote Support Zero-Day CVE-2026-102764 Was Exploited for About Seven Weeks, and the Attackers Wiped Logs on the Way Out

BeyondTrust's CVE-2026-102764 auth bypass was exploited since late August by China-nexus Armory Castle. Affected versions, the attack chain, and what to review now.

17 ตุลาคม 2569·5 min read
Threat IntelligenceInsider Threat

FBI Searched 40 Homes in 'Lonestar Roundup' Against North Korean IT Worker Laptop Farms, Seizing About 187 Devices

The DoJ charged 14 people and the FBI seized about 187 laptops and KVMs in a crackdown on North Korean IT worker laptop farms. How the scheme works and what employers should check.

16 ตุลาคม 2569·3 min read
AI SecurityThreat Intelligence

Anthropic Warns Small AI Models May Be Months Away From Self-Replicating Across Smart Ovens and Cheap Android TV Boxes

Anthropic's experiments show small AI models can set themselves up across cheap IoT devices. What the research actually demonstrated, what it did not, and the network signals defenders can watch for now.

15 ตุลาคม 2569·4 min read
ทำไมเรื่องนี้สำคัญ

ทุกข่าวที่นี่คือช่องว่างด้านการกำกับดูแลในที่อื่น

Obiguard เปลี่ยนเหตุการณ์ที่คุณอ่านให้เป็นนโยบายที่บังคับใช้ได้จริง ทั้งไกอาร์เรล การจับคู่กับข้อกำหนดด้านการปฏิบัติตามกฎระเบียบ และร่องรอยการตรวจสอบสำหรับทุกคำขอ AI ขององค์กรคุณ

พูดคุยกับเรา →