Cybersecurity
General cybersecurity news and analysis
iOS AI Apps Expose API Keys, Open AI Proxy Access
Nearly two-thirds of AI chatbot apps for iPhone, that's 282 out of 444 tested, are leaking sensitive API keys, leaving users' data vulnerable to exposure through open AI proxy access. This alarming discovery highlights a critical security gap in many popular iOS AI apps.
GuardFall Exposes AI Coding Agents to Shell Injection Risks
Researchers at Adversa AI have uncovered a shocking weakness, dubbed GuardFall, that lets advanced open-source coding agents slip past safety filters and execute destructive shell commands, exposing them to shell injection risks. This gap between text-based checks and shell execution leaves a trail of vulnerability wide open to exploitation.
Microsoft Bolsters Teams Security with Enhanced Bot Controls
Microsoft's new Teams admin policy gives you more control over third-party bots in meetings, allowing you to block unwanted guests and require explicit approval for external bots to join. This enhanced security feature can be easily managed for individual users or specific groups through the Teams Admin Center.
Threat Management Fails to Keep Pace with Visibility Gains
Most organizations are drowning in threat intelligence, with an average of 14 distinct feeds, yet struggle to turn that visibility into action, with 61% unable to identify which vulnerabilities are most likely to be exploited. As a result, security teams waste 42% of their time on low-priority risks, highlighting a critical gap between threat awareness and effective management.
Microsoft Bolsters Teams Security with Enhanced Bot Protections
Microsoft is stepping up its Teams security game with enhanced bot protections, allowing admins to block third-party bots from joining meetings without approval. This new policy gives organizations greater control over who can access their meetings, helping to prevent malicious apps and unwanted disruptions.
AirDrop and Quick Share Flaws Expose Devices to Local Attacks
Millions of devices are vulnerable to local attacks due to flaws in popular sharing services like AirDrop and Samsung Quick Share, discovered by researchers Arash Ale Ebrahim and Nils Ole Tippenhauer. They found six distinct flaws that can be exploited by nearby attackers to crash services or bypass security checks.
Kali Linux Release Bolsters Cybersecurity Arsenal with 9 New Tools
Kali Linux just got a major boost with its latest release, packing 9 new tools to supercharge your cybersecurity arsenal. This update slashes boot time by nearly 3x and trims down the initrd to just 60 MB for VM users.
Progress LoadMaster Flaw Lets Attackers Run Root Commands Pre-Auth
A critical flaw in Progress Kemp LoadMaster, known as CVE-2026-8037, allows attackers to run root commands without authentication - but a patch is now available to fix this gaping security hole. This vulnerability, scoring a severe 9.8, can be exploited with a simple crafted API request.
Apple Bolsters Security with AI-Discovered WebKit Flaw Patches
Apple is stepping up its security game by releasing patches for over three dozen WebKit flaws, discovered with the help of AI, to protect its users from potential hacking threats. By speeding up its update process, Apple aims to outpace malicious hackers who are leveraging AI to develop exploits at an alarming rate.
Microsoft Fortifies Teams Against Bot Intrusions
Microsoft is stepping up its game to protect Teams meetings from unwanted bot intrusions by introducing a virtual bouncer that keeps automated accounts at bay. This new defensive measure is a significant boost to Microsoft Teams security.
Weak RSA Keys Exposed in Widespread Use
Meet the badkeys project, an open-source service that scans public keys for vulnerabilities, which recently uncovered a surprising pattern of weak RSA keys in widespread use. By analyzing a massive dataset of real-world public keys, the team discovered a substantial number of keys with a suspicious structure, featuring regularly spaced blocks of zero bits and random data.
Researchers Expose Lethal Flaw in AI Model Security
Researchers have uncovered a shocking vulnerability in AI model security, revealing that a simple formatting trick used to separate system instructions from user requests has become a critical weakness. This flaw, known as role confusion, threatens the very foundation of modern AI systems.
Anonymous Researcher Exploits 15 Software Products with Zero-Day Code Dump
A security bombshell has been dropped: an anonymous researcher has publicly shared exploit code for zero-day vulnerabilities in 15 software products, and hackers are already taking advantage of at least two of them. The alarming revelation has sent shockwaves through the cybersecurity community.
Quantum Deadline Looms: CISOs Face Post-Quantum Readiness Mandate
The clock is ticking: by December 31, 2030, federal high-value systems must adopt post-quantum cryptography for key establishment, and by December 31, 2031, for digital signatures too. Are your systems ready to beat the quantum deadline?
Microsoft Extends Windows Server 2022 Hotpatching Support Until 2027
Microsoft just gave you an extra year of uninterrupted protection, extending hotpatching support for Windows Server 2022 through October 2027 - so you can keep your systems secure and running smoothly without the hassle of reboots. Devices already enrolled will continue to receive monthly security updates with zero downtime.
WhatsApp Introduces Usernames to Enhance User Privacy
WhatsApp is rolling out a new feature that lets you reserve a unique username, giving you more control over your privacy and allowing you to keep your phone number hidden. This move is all about putting you in the driver's seat, letting you choose how you connect with others on the platform.
Linux Flaw Exposes Multi-Tenant Environments to Root Privilege Escalation
A newly discovered Linux flaw, dubbed DirtyClone, lets local users easily gain root privileges on popular systems like Debian, Ubuntu, and Fedora - putting shared environments at risk of a devastating breach. This vulnerability is especially alarming in setups with user namespaces enabled or privileged containers deployed.
Agentic AI's Identity Crisis Leaves Security Teams Vulnerable
Agentic AI's autonomy and poorly tracked access are creating a perfect storm of identity risk, leaving security teams vulnerable to attacks. As digital actors with broad permissions, these AI agents are operating in the dark, with many organizations lacking visibility into their actions.
Microsoft Extends Windows Server 2022 Hotpatching Through 2027
Microsoft just announced that hotpatching for Windows Server 2022 will continue through 2027, exceeding the operating system's mainstream support deadline, and giving customers more time to benefit from seamless, in-memory code patching. This extension applies specifically to Windows Server 2022 Datacenter: Azure Edition.
Credentials Face Quantum Threat Decades Ahead
The NSA has set a critical deadline: by January 1, 2027, new national security systems must support quantum-resistant algorithms to stay ahead of emerging threats. With deadlines stretching into the 2030s, organizations must plan now to protect their systems from the looming quantum threat.
libssh2 Flaw Exposes Clients to Code Execution Risk
A critical flaw in libssh2, known as CVE-2026-55200, can be exploited by a malicious SSH server to trigger memory corruption on a connecting client, with no credentials or user interaction required. This vulnerability can be easily triggered with a public proof-of-concept now available.
AI Exposes Thousands of Open-Source Vulnerabilities
This summer is shaping up to be a wild ride, with thousands of open-source vulnerabilities exposed and a new coalition, Athena, stepping in to save the day with AI-powered solutions. Led by Chainguard, Athena brings together over two dozen major companies to tackle the problem head-on.
Cybersecurity Forum Opens Weekend Discussion Thread
Join the weekend Bunker Talk thread, where the community comes together for a refreshing, no-holds-barred discussion that's free from the usual toxicity - with one key rule: respectful, fact-based conversation, even when politics get involved. Share your thoughts, hash out differences, and engage with the best commenting crew on the net in a space that values civility and substance.
US Secret Service Exposes Agents to Cyber Risk with Lax Mobile Security
The US Secret Service is putting its agents at risk of cyber attacks by allowing them to use personal phones for work, with over 15,000 instances of unsecured calls made during critical operations. This lax mobile security leaves them vulnerable to hackers, despite having access to supposedly secure government-issued devices.