4276 articles
4276 ARTICLES
Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.
Pull the certificate off the flash of a Shark RV2320EDUS robot vacuum, and you can run root commands on other people’s Shark vacuums across the same AWS region: watch the camera, drive the robot, read the map of the house, and take the Wi-Fi password in plaintext. A researcher publishing under the handle tokay0 put the method online on Monday, having tested it only against vacuums he
OpenAI has disclosed details of GPT-Red, an internal automated red-teaming model that scales prompt injection vulnerability discovery with an aim to fix issues before the tools are deployed widely. “GPT‑Red is a strong red-teamer, and our previous models are highly vulnerable to its prompt injection attacks,” the artificial intelligence (AI) company said. “We use GPT‑Red to adversarially train
Zoom has released security updates for a critical security flaw impacting Zoom Workplace for Windows that could facilitate account takeover. The vulnerability, tracked as CVE-2026-53412 (CVSS score: 9.8), affects Zoom Workplace for Windows before version 7.0.0 and Zoom Workplace VDI Client for Windows before version 7.0.10, 6.6.15, and 6.5.18 in their respective branches. “Improper Input
Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This analysis breaks down the attack chain, payload delivery, and recommended defenses. The post Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery appeared first on Microsoft Security Blog.
TELEPUZ is a modular malware that emerged through CLICKFIX-VIDAR attacks in April. We reverse-engineered it to show you the infrastructure and evasion techniques that matter.
How to implement proper consent management to allow users to consciously authorize your applications.
Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more. The post The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) appeared first on Unit 42.
The rapid adoption of cloud technologies has brought significant security challenges for organizations of all sizes. According to recent studies, over 70% of enterprises now operate in hybrid or multi-cloud environments, with 93% employing a multi-cloud strategy[1]. This complexity requires robust security tools, but opinions vary on the best deployment method—agent-based, agentless, or a combination of both. Agent-based and agentless cloud security approaches offer distinct benefits and
Enterprises have spent two decades building real discipline around human identity: provisioning, least privilege, access reviews, clean deprovisioning. AI agents arrived faster than that discipline could be extended to them, so a population of powerful new identities is now operating ahead of the controls meant to govern it. An agent acts within the identity it is given, and that identity is often over-provisioned from the start, carrying broad, inherited, or standing access well beyond
In a Zero Trust architecture, the foundational rule is simple: “You cannot protect what you cannot see.” Organizations are rapidly adopting Artificial Intelligence, leading to a sprawling ecosystem of Large Language Models (LLMs), internal machine learning models, third-party APIs, training datasets, and vector databases. This rapid expansion creates two major security blind spots: Lack of Visibility: IT and Security teams often do not know what AI assets exist, where they a…
Security and finance teams both care deeply about risk, but they define and measure it differently. Security leaders often lead with controls, frameworks, and technical severity, while finance executives focus on outcomes like revenue, predictability, and cost containment. But when security conversations don’t clearly connect to financial impact, budget requests can stall. Framing risk in a way that aligns with executive priorities can help security leaders bridge the cross-departm…