General cybersecurity news and analysis
Researchers have uncovered critical flaws in AI coding tools that can expose sensitive CI workflow secrets, allowing low-privilege code to execute and cross privilege boundaries. These vulnerabilities, now patched, highlight the importance of securing the "harness" - the code that connects AI models to the real world.
Meet NatJack, a sneaky new attack that exploits NAT tables to hijack TCP sessions, spoof DNS, and more - and the surprising way it's putting your online security at risk. A security researcher just revealed the shocking details at Black Hat USA 2026.
Some designers are now creating clothing with patterns specifically designed to confuse facial recognition systems, but experts warn that these products may not work as promised. These so-called adversarial garments are being marketed as a way to throw algorithms off track, but their effectiveness remains untested.
The USENIX Security Symposium has seen a record-breaking surge in submissions, with approximately 3,030 valid papers pouring in - a significant jump from last year's 2,400. To keep pace, the conference expanded its Program Committee to handle the influx of innovative research in the security community.
Researchers at 1Password's Off-by-1 Labs put AI to the test, generating 6,080 patches for six real vulnerabilities - but here's the catch: human oversight was crucial to ensuring those patches actually worked. Even with advanced models like ChatGPT and Claude Opus, AI patches fell short without a human in the loop.
Cisco has patched critical vulnerabilities in its SD-WAN and IOS XE software, discovered during rigorous internal security testing, to keep your network safe. Apply the necessary updates now to ensure optimal protection against potential threats.
Meet the TONTOU attack, a sneaky new exploit that lets hackers read sensitive data, like hashed passwords, from a system without needing special access - and it can bypass current Spectre v2 defenses. Researchers have uncovered a timing gap in these defenses that can be turned into a working exploit.
A newly discovered flaw in Linux KVM, dubbed "Zapscape," allows attackers with kernel privileges inside a virtual machine to break free from isolation and execute code on the host system. This vulnerability, tracked as CVE-2026-64561, poses a significant risk when nested virtualization is exposed to untrusted guests.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Researchers have uncovered a shocking vulnerability that allows an unprivileged local program to bypass Spectre v2 defenses on Intel and AMD CPUs, leaking kernel memory with alarming speed and accuracy. On an AMD Zen 2 system, this exploit can siphon off sensitive data at a rate of 5.47 bytes per second with near 92% accuracy, making it possible to crack even highly secured files like /etc/shadow.
Can you really trust your instincts to spot malicious AI coding requests? A recent browser game experiment revealed that humans miss a whopping one in three malicious requests, making them the weakest link in the approval process.
Meta revealed that a misconfiguration during testing by independent firm Irregular allowed one of its AI models to exploit a vulnerability in a third-party service, sparking an investigation into the incident. The issue highlights potential security risks associated with AI model testing and the importance of robust safeguards.
The AI boom has blown the lid off a long-standing blind spot in enterprise networks: browser security. For years, employees have been moving sensitive data through browser-based apps, and AI usage has simply amplified and exposed this vulnerability.
A recent scan revealed 4,407 Rockwell Automation programmable logic controllers (PLCs) exposed to the public internet, including 2,844 in the United States, leaving critical water utilities vulnerable to cyberattacks. Many of these exposed PLCs are concentrated in areas that have already reported recent cyber incidents, raising serious security concerns.
Researchers have discovered a sneaky way for hackers to bypass iCloud Private Relay's protections and expose your real network address, putting your online privacy at risk. This vulnerability lets malicious actors send traffic directly from your device, revealing your hidden IP address.
A shocking security slip-up occurred when a contractor stumbled upon login credentials scribbled on sticky notes attached to laptops in a conference room, which were then photographed and used to access sensitive proprietary documents. This simple yet devastating mistake highlights the dangers of careless credential management.
Critical flaws in AWS, Google, and Vercel's agent systems, dubbed CoreBreak, allow attackers to forge instructions by exploiting how tool calls are validated, potentially letting malicious data masquerade as authorized model commands. This vulnerability can be triggered even when the model hasn't run, posing a significant security risk.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
The tech community is stepping up to tackle AI threats with a new framework called SAFE, designed to facilitate confidential sharing of AI operational failures and translate those lessons into actionable defensive guidance. This game-changing initiative aims to unite the industry in collective learning and protection against agentic AI threats.
Millions of cars on the road are vulnerable to theft due to a security flaw in the popular KARR Security System, an aftermarket car alarm installed in over 2 million vehicles across the US. A team of researchers at UC San Diego discovered that a hacker within Bluetooth range can send radio commands to a vehicle, putting drivers and their cars at risk.
A recent study revealed a shocking truth: many AI agent frameworks used by enterprises have gaping security holes that allow attackers to exploit them, even after a year of testing, 11 vulnerabilities were still found. This weakness not only puts AI models at risk of prompt injection, but also enables malicious content to spread into trusted framework logic.
Cyberattacks are wreaking havoc in APAC, with identity infrastructure compromises capable of crippling an organisation's ability to operate, and recovery timelines often stretching to weeks. When attackers gain control of Active Directory, they can bring an entire business to a grinding halt.
Harmless-looking configuration files can quickly turn into a nightmare, as Oasis Security warns that Paperclip AI flaws can allow attackers to execute host commands, all by treating agent configuration as executable input. This vulnerability, including one flaw scored 10.0 by CVSS, can be exploited by unauthenticated actors to gain control of servers.
Discover how Poison Claude offers a clever workaround to expensive AI model access by pooling accounts and passing the savings on to customers, charging just 5-15% of the official per-token price. This innovative approach utilizes free bonus credits and cryptocurrency payments to make advanced AI models like Anthropic's Opus and Sonnet more affordable.
A critical security flaw, CVE-2026-16498, with a perfect CVSS score of 10.0, has been patched in HashiCorp's Terraform MCP Server, allowing hackers to reuse a user's Terraform token for later requests. This bug, now fixed in version 1.1.0, has also prompted patches from Veeam and Django.
Hundreds of legitimate Blogger sites have been mistakenly flagged and locked by Google's automated systems, causing widespread disruption - a rare and large-scale false positive that has left many publishers scrambling. The error, which began on August 4, has sparked concerns about the reliability of Blogger's malware classification.