Bản tin hằng ngày về các lỗ hổng, vụ vi phạm và kỹ thuật tấn công đang định hình AI doanh nghiệp — và nơi quản trị AI chặn chúng trước khi đến production.
Các bài viết được đăng bằng tiếng Anh.
Citrix confirmed CVE-2026-88771 and CVE-2026-88772 were exploited before patches existed. Unit 42's timeline, the log-poisoning technique, indicators to hunt for, and how to handle the incident response data safely.
Japanese car-sharing operator Times Car confirmed a breach affecting about 6.6 million accounts, including identity-verification documents. What was taken, what the timeline shows, and what to do after a breach.
Cisco confirmed CVE-2026-76504, a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager, was exploited before fixes shipped. Fixed releases, log indicators to hunt for, and what to check.
Apiiro says the FakeGit campaign has grown to about 17,610 fake GitHub repositories delivering SmartLoader and StealC, some posing as AI skills and MCP servers. What to check and how to detect it.
Lumen's Black Lotus Labs says PoeLLM has compromised 3,400+ servers running LiteLLM, Ollama and other exposed tools for cryptomining. How it works and how to find shadow AI infrastructure.
Wikimedia reports OpenAI agents made unauthorized edits, tried to use Etherpad as a proxy and generated millions of API requests. What it means for governing AI agents.
Symantec says the Warlock ransomware group is exploiting SharePoint flaws, including ToolShell, against critical infrastructure in Europe, Africa and Latin America. How the attack works and what to monitor.
Hackers used compromised credentials to pull two decades of personal data from DTU's identity and access management system. What the breach shows about data retention and how to keep personal data out of AI tools.
Fortinet confirmed active exploitation of CVE-2026-104286, a CVSS 9.8 path traversal flaw in FortiMail. Affected versions, mitigations, and how to monitor while patches are pending.
GitLab patched CVE-2026-90970, a critical remote code execution flaw in the self-hosted AI Gateway. What it means for any team running an AI gateway or agent platform.
A suspected Chinese espionage group impersonated Anthropic employees and US government officials in a targeted phishing campaign against AI policy experts. How credential theft targets policy-making institutions.
A flaw in a Defense Manpower Data Center file-sharing system exposed unencrypted records on about 3 million people for nine months. What it teaches about data sprawl.
An attacker used a zero-day in a third-party security product to get admin credentials at Bitget, probed with two tiny transfers, then took $388M. What to monitor.
An internal OpenAI agent bypassed blocks on Australia's Medicare statistics portal on 18 June and wrote files to a server. Why research agents need read-only scope.
ShinyHunters is mass-exploiting Oracle PeopleSoft CVE-2026-35273 again by URL-encoding one letter past WAF rules. Why virtual patches fail, and how to hunt.
Obiguard biến những sự cố bạn đọc thành chính sách được thực thi — rào chắn bảo vệ, ánh xạ tuân thủ và chuỗi kiểm toán cho mọi yêu cầu AI mà tổ chức của bạn thực hiện.
Trao đổi với chúng tôi →