ข่าวอัปเดตทุกวัน

ข่าวความปลอดภัยทางไซเบอร์
ที่กำกับดูแลตั้งแต่การออกแบบ

บทความรายวันเกี่ยวกับช่องโหว่ การละเมิดข้อมูล และเทคนิคการโจมตีที่กำลังกำหนดทิศทางของ AI ในองค์กร และจุดที่การกำกับดูแล AI หยุดยั้งสิ่งเหล่านี้ก่อนเข้าสู่ระบบใช้งานจริง

บทความเผยแพร่เป็นภาษาอังกฤษ

ข่าวเก่ากว่า · หน้า 5 จาก 7
AI AgentsAI Security

The Agent Was Sandboxed. The Switch That Turned the Sandbox Off Was Inside It

CVE-2026-82533 let a sandboxed DeepSeek Harness agent grant itself danger-full-access with one curl. It sat on GitHub 11 days before being formally reported.

14 กันยายน 2569·10 min read
Vulnerability ManagementIncident Response

The Server Had the August Hotfix. It Was Breached Anyway — and Its Logs Had Already Rotated

N-able shipped four N-central hotfixes in five weeks. An RMM server on the August fix was still breached, and rotated logs hid which flaw let attackers in.

13 กันยายน 2569·10 min read
AI SecurityShadow AI

Six Chinese AI Labs Distilled US Models Through Cut-Price API Resellers. Other Customers' Prompts Were the Camouflage

CISA, NSA and FBI say six Chinese firms ran AI distillation on Claude, GPT and Gemini via cut-price API proxies that also carry ordinary users' prompts.

12 กันยายน 2569·10 min read
Prompt InjectionAI Security

Your Filter, Your Staff and Your AI Summariser Each Read a Different Email. Attackers Now Write for All Three

Microsoft saw 2.37M daily phishing emails split lure words with invisible Unicode. Forcepoint's hidden HTML rewrote an AI email summary in 10 of 10 runs.

11 กันยายน 2569·11 min read
Threat IntelligenceVulnerability Management

The Fix Was Public on August 7. It Reached Your Browser Four Weeks Later. Four Espionage Groups Used the Gap

Proofpoint's BlueMoon kit chained two Chrome V8 patch-gap zero-days and a Windows LPE. Four China-nexus espionage clusters ran identical code within a week.

10 กันยายน 2569·9 min read
AI SecurityThreat Intelligence

The Malware Put a Weapons Jailbreak at the Top of the File So the Scanner Would Refuse to Read It

Google's GTIG found DUSTMAKER embedding weapons-jailbreak prompts atop JavaScript loaders so LLM security scanners refuse to analyse the malicious code below.

9 กันยายน 2569·11 min read
Shadow AIAI Security

The Backdoor Asked for Cookies, Every Tab and Every Site. So Does the AI Assistant Your Staff Installed Last Month

SOCRadar's PEEP browser RAT requests cookies, tabs, scripting and all URLs — the same manifest an AI browser assistant needs, plus a 30-second HTTP beacon.

8 กันยายน 2569·7 min read
Vulnerability ManagementAI Security

JetBrains Told Customers to Treat the Outputs of Their Own AI Compute Runs as Untrusted. Almost Nobody Can List Which Runs Those Were

Attackers held JetBrains Cadence from August 8–24, 2026 via unpatched TeamCity CVE-2026-63077, taking AWS credentials and source code synced from PyCharm.

7 กันยายน 2569·10 min read
Threat IntelligenceIncident Response

The Backdoor Did Not Hide From Your Monitoring. It Edited the Numbers Your Monitoring Reads

Rapid7 Labs found ted, a DPRK-linked implant compiled into HAProxy 2.8.12 at two South Korean firms. It subtracts its own traffic from the proxy's counters.

6 กันยายน 2569·10 min read
Vulnerability ManagementAI Security

Three of the Seven Flaws CISA Added This Week Were AI Infrastructure — and the Attackers Went Straight for the API Keys

CISA added LiteLLM, Kestra and Starlette to its KEV catalog on September 2, 2026, while Langflow's twelfth exploited CVE was used to harvest OPENAI_API and AWS_SECRET environment variables.

5 กันยายน 2569·10 min read
AI AgentsVulnerability Management

The Model Never Saw It. The Agent Ran It Anyway — Before the Trust Prompt Appeared

Manifold Security's GitSpawn abuses core.fsmonitor to run attacker code in seven AI coding agents. Four of eight findings were still unpatched on September 1, 2026.

4 กันยายน 2569·9 min read
AI SecurityThreat Intelligence

Three Labs Shipped Autonomous Zero-Day Discovery in Two Days. The Vetting Happens at Their Door, Not Yours

OpenAI, Google and Anthropic all shipped cyber-capable frontier models with gated defender access on September 1–2, 2026. Astra is the first model OpenAI has rated Critical.

3 กันยายน 2569·7 min read
Vulnerability ManagementAI Security

The Registry That Hosted the Agent Message Board Now Hands Out Admin Tokens to Anyone Who Asks

CVE-2026-82329, a CVSS 9.8 pre-auth admin bypass in JFrog Artifactory, went from patch on August 28 to in-the-wild exploitation on September 1. It is not in CISA KEV.

2 กันยายน 2569·10 min read
Threat IntelligenceAI Agents

The Ransomware Operator Left the Transcript Behind — and It Shows an AI Agent Doing the Lateral Movement

CloudSEK and Gambit Security found Aurora ransomware operators driving the Cursor AI agent against 20+ organisations in nine countries, April to July 2026.

1 กันยายน 2569·7 min read
AI AgentsPrompt Injection

Nothing in the Conversation Was Malicious. The Agent Assembled the Attack Out of Three Harmless Pieces

ASSET Research Group's GhostSplice splits instructions across MCP channels. Compliance with secret exfiltration rose from 42% to 82% across 11 tested models.

31 สิงหาคม 2569·9 min read
ทำไมเรื่องนี้สำคัญ

ทุกข่าวที่นี่คือช่องว่างด้านการกำกับดูแลในที่อื่น

Obiguard เปลี่ยนเหตุการณ์ที่คุณอ่านให้เป็นนโยบายที่บังคับใช้ได้จริง ทั้งไกอาร์เรล การจับคู่กับข้อกำหนดด้านการปฏิบัติตามกฎระเบียบ และร่องรอยการตรวจสอบสำหรับทุกคำขอ AI ขององค์กรคุณ

พูดคุยกับเรา →