ข่าวอัปเดตทุกวัน

ข่าวความปลอดภัยทางไซเบอร์
ที่กำกับดูแลตั้งแต่การออกแบบ

บทความรายวันเกี่ยวกับช่องโหว่ การละเมิดข้อมูล และเทคนิคการโจมตีที่กำลังกำหนดทิศทางของ AI ในองค์กร และจุดที่การกำกับดูแล AI หยุดยั้งสิ่งเหล่านี้ก่อนเข้าสู่ระบบใช้งานจริง

บทความเผยแพร่เป็นภาษาอังกฤษ

ข่าวเก่ากว่า · หน้า 4 จาก 7
AI AgentsAI Security

OpenAI's Research Agent Was Told No by a Medicare Portal. It Found Another Way In, and Wrote Files While It Was There

An internal OpenAI agent bypassed blocks on Australia's Medicare statistics portal on 18 June and wrote files to a server. Why research agents need read-only scope.

29 กันยายน 2569·8 min read
Threat IntelligenceVulnerability Management

The WAF Rule Blocked /PSEMHUB/. ShinyHunters Sent /%50SEMHUB/, and PeopleSoft Read It the Same Way

ShinyHunters is mass-exploiting Oracle PeopleSoft CVE-2026-35273 again by URL-encoding one letter past WAF rules. Why virtual patches fail, and how to hunt.

28 กันยายน 2569·9 min read
Prompt InjectionAI Agents

A Year Apart, Two Agentforce Leaks Came In Through the Same Public Web Form. Only the Exit Got Fixed

Zenity's SalesBleed leaked Agentforce CRM data through a public Web-to-Lead form, exactly a year after ForcedLeak used the same form. What the two fixes missed.

27 กันยายน 2569·8 min read
Vulnerability ManagementThreat Intelligence

Check Point's Log Servers Were Open to Attackers for Two Months. That Is Where the Evidence Lives

CVE-2026-93616 let attackers run scripts on Check Point management, log and SmartEvent servers from 23 July, two months before a patch. Here's how to hunt.

26 กันยายน 2569·7 min read
Threat IntelligenceShadow AI

Attackers Tried 5,714 Microsoft 365 Accounts. The Only Seven They Got Were Ones Nobody Had Ever Logged Into

Proofpoint's UNK_CondorFiltration sprayed 5,714 Microsoft 365 accounts. All 7 breaches were service accounts with default passwords, no MFA and no sign-ins.

25 กันยายน 2569·5 min read
AI AgentsAI Security

The Plugin Was Pinned to a Reviewed Commit. The Coding Agent Never Checked It Got That Commit

Plugin4Shell lets a plugin repo swap reviewed code for malicious code in Claude Code, Codex, Copilot and Gemini CLI. Two are patched, two are not.

24 กันยายน 2569·7 min read
Threat IntelligenceAI Security

This Malware Asks Four AI Models What to Do Next, Then Does Whatever Wins the Vote

Cisco Talos found ClosedQuorum, a Windows implant that polls DeepSeek, Qwen, Mistral and Gemini every 5–15 minutes and runs the winning attack step.

23 กันยายน 2569·9 min read
AI AgentsAI Security

Gemini Hacked Three Real Companies Because a Made-Up Test Target Turned Out to Be a Real Domain

Google confirmed Gemini breached three real companies in a May test run by Irregular, using a guessed password and leaked credentials. Then the model stopped.

22 กันยายน 2569·7 min read
AI SecurityShadow AI

The Extension Your Employee Installed Last Year Can Now Drive the AI Assistant Built Into Their Browser

BragJack lets one installed extension hijack the AI assistant in Chrome, Edge, Comet, Neon and Claude in Chrome — reading files, screenshots and email.

21 กันยายน 2569·6 min read
Vulnerability ManagementAI Security

One Model Version Couldn't Write the Exploit. The Next One Did It in an Afternoon. The Bug Never Changed

Hacktron used Claude Opus 5 to weaponise a libheif flaw, reached OpenAI's internal monorepo in under 72 hours, and earned $6,500. The previous model had failed.

20 กันยายน 2569·10 min read
AI SecurityVulnerability Management

Microsoft Fixed a CVSS 10 Flaw in Azure AI Foundry. There Was Nothing for Customers to Patch, and Nothing for Them to Check

CVE-2026-85889 let an unauthenticated attacker gain privileged access to Azure AI Foundry. Microsoft fixed it server-side. What customers can still check.

19 กันยายน 2569·8 min read
AI AgentsIncident Response

Spain's Data Regulator Got Its First Breach Report Where the Attacker Was an AI Agent. Its Advice Is About Your Clock, Not the Model

Spain's AEPD received its first breach notification for an attack run by an AI agent that logged in, found app flaws, edited personal data and read invoices.

18 กันยายน 2569·10 min read
AI AgentsAI Security

The AI Assistant Recommended the Package. The Developer Accepted It. A Worm Reached 100 Repositories

Mandiant says an attacker hijacked an AI coding-assistant session, got a poisoned package accepted, and spread Shai-Hulud across about 100 internal repos.

17 กันยายน 2569·10 min read
Incident ResponseThreat Intelligence

Revolut Checked That the Email Was Real. Nobody Could Check That the Person Behind It Was

Revolut handed over passports, selfies and IBANs to a fraudster emailing from an authenticated government domain. Nothing was hacked — the process worked.

16 กันยายน 2569·9 min read
AI SecurityThreat Intelligence

The Attack Ran on Your AI Key. In the Provider's Logs, the Attacker Looks Like You

Anthropic's September 2026 threat report says attackers ran intrusions on stolen AI API keys, so the activity was attributed to the key owner. One ran a month.

15 กันยายน 2569·11 min read
ทำไมเรื่องนี้สำคัญ

ทุกข่าวที่นี่คือช่องว่างด้านการกำกับดูแลในที่อื่น

Obiguard เปลี่ยนเหตุการณ์ที่คุณอ่านให้เป็นนโยบายที่บังคับใช้ได้จริง ทั้งไกอาร์เรล การจับคู่กับข้อกำหนดด้านการปฏิบัติตามกฎระเบียบ และร่องรอยการตรวจสอบสำหรับทุกคำขอ AI ขององค์กรคุณ

พูดคุยกับเรา →