access ai android api apple attack authentication backdoor breach business ceo china cisa cisco ciso cloud compliance control credentials crypto cve cyber cyberattack cybercrime cybersecurity data data-breach defense detection email endpoint exploit finance flaw framework fraud google governance government group hacker hacking healthcare identity infrastructure intelligence Internet jobs law leak linux malicious malware microsoft monitoring network open-source password phishing privacy ransomware remote-code-execution resilience risk russia scam service software strategy supply-chain technology theft threat tool unclassified update usa vulnerability windows zero-day
-
82 Prozent ungepatcht: Über 34 Millionen Systeme noch anfällig für PHP2Shell
Tags: germanyLaut Scans von Censys ist PHP2Shell auf den meisten Systemen im Netz noch ausnutzbar. Allein in Deutschland gibt es Millionen davon. First seen on golem.de Jump to article: www.golem.de/news/82-prozent-ungepatcht-ueber-34-millionen-systeme-noch-anfaellig-fuer-php2shell-2610-214437.html also interesting: Im Visier von Putins Hackern – ‘Befinden uns in einer Vorkriegszeit, bestenfalls im Kalten Krieg und Deutschland mittendrin WELT SUMMIT VISION NOW Digital Security…
-
Check Point integriert KI-Sicherheitskontrollen in NVIDIA OpenShell und BlueField-4
Check Point und NVIDIA entwickeln neue Sicherheitsmechanismen für autonome KI-Agenten. OpenShell und Sentry ermöglichen Kontrolle und Infrastrukturschutz. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/check-point-integriert-ki-sicherheitskontrollen-in-nvidia-openshell-und-bluefield-4/a46890/ also interesting: Copy-paste vulnerability hits AI inference frameworks at Meta, Nvidia, and Microsoft A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw NVIDIA wants AI agent safety…
-
Qualys Update und erste Untersuchungen zu PHP2Shell in Zahlen
Tags: updateDie große Mehrheit von 110 Millionen Installationen (71 %) nutzt dagegen Versionen von PHP 5.4 bis 8.1, deren Support bereits ausgelaufen ist. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/qualys-update-und-erste-untersuchungen-zu-php2shell-in-zahlen/a46898/ also interesting: Microsoft Pulls Exchange Patches Amid Mail Flow Issues RedLine Malware Weaponizing Pirated Corporate Softwares To Steal Logins Microsoft warns of blue screen crashes…
-
Mehrere schwere Kernel-Lücken im SMB-Server – ksmbd öffnet Linux-Dateiserver für Angreifer
Tags: linuxFirst seen on security-insider.de Jump to article: www.security-insider.de/ksmbd-oeffnet-linux-dateiserver-fuer-angreifer-a-93e9422c1262ae4b9e7a6b46d683f24f/ also interesting: Linux-Kernel: Softwareentwickler frustriert von Hardwareproblemen New ‘Pack2TheRoot’ flaw gives hackers root Linux access 12-year-old Pack2TheRoot bug lets Linux users gain root privileges Linux kernel maintainers suggest a ‘kill switch’ to protect systems until a zero-day vulnerability is patched
-
Attacks on Tech Firms Behind Most Third-Party Data Breach Victims
Kroll found that 69% of data breach victims in the past year were affected by a third-party breach, with attacks on tech companies the most common cause First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/tech-third-party-breach-victims/ also interesting: Boat Dealer MarineMax Confirms Data Breach How to protect your data after a cyber-attack Palo Alto Networks disclosed…
-
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open.The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file’s name to Ghostscript, a separate program…
-
SBI Notifies Customers Affected by Recent Cybersecurity Incident
The State Bank of India (SBI) has individually notified customers whose data was involved in a recent cybersecurity incident. In an update focused on customer safety, the bank confirmed it contacted affected individuals via email and/or WhatsApp. They reassured customers that their account balances and funds are safe. This announcement follows an earlier communication about…
-
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22.The cause was the SDKs’ default client, which set no spending limit until releases on August 18 added one. The…
-
PoC Exploit Released for Two Critical PHP RCE Vulnerabilities as Hackers Launch Attacks
Tags: attack, cve, cvss, cyber, data-breach, exploit, hacker, rce, remote-code-execution, sophos, vulnerabilityPublic proof-of-concept exploit code targeting two critical PHP vulnerabilities has surfaced as attackers scan exposed servers and attempt exploitation. Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively called PHP2Shell and carry CVSS v4.0 scores of 9.2, potentially allowing unauthenticated remote code execution with web server privileges. However, Sophos has corrected an earlier report of…
-
Capcom data breach exposes 11.7 million account records
Players who signed up for Capcom’s online account service may want to look twice at emails that seem to come from the company. The company has disclosed that a third … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/23/capcom-id-data-breach-11-million-records-exposed/ also interesting: API Security: Bridging the Gap Between Application and Security Teams FireTail Blog 7 Privilege…
-
MythicRatatoskr: Eine Yggdrasil-basierte Hintertür
ESET Forscher haben mit ‘MythicRatatoskr” eine bislang unbekannte, auf Go basierende Backdoor entdeckt. Diese versteckt ihren C&C-Server im Yggdrasil-Mesh-Netzwerk. Dieses ebnete den Weg für einen zerstörerischen Angriff auf ein ukrainisches Getreideunternehmen. First seen on welivesecurity.com Jump to article: www.welivesecurity.com/de/eset-research/mythicratatoskr-eine-yggdrasil-basierte-hintertur/ also interesting: Unseen Msupedge Malware Exploits PHP Flaw CVE-2024-4577 in Taiwanese University Cyberattack UK Cybersecurity Weekly…
-
Critical Citrix NetScaler RCE Vulnerability Under Active Attack as Hackers Deliver FreeBSD Malware
Citrix NetScaler ADC and Gateway appliances are under active attack via CVE-2026-88771, a critical, unauthenticated remote code execution vulnerability that requires no optional features to be enabled. ThreatLabz observed attackers poisoning logs to trigger command execution, planting web shells and attempting to deploy a FreeBSD x64 implant. Citrix disclosed the vulnerability on September 27, 2026,…
-
12 Malware Analysis Tools: The 2026 Buyer’s Verdict Guide
Malware analysis tooling spans a spectrum the acronyms hide: interactive sandboxes where analysts click alongside the malware, evasion-hardened hypervisor rigs for the samples that detect everything else, reputation oceans answering “has anyone seen this?”, binary-similarity engines, and the open standards (YARA above all) the whole field writes in. This verdict guide reviews twelve names across…
-
12 Data Loss Prevention (DLP) Software: The 2026 Buyer’s Verdict Guide
DLP software earned its mixed reputation honestly a decade of false-positive floods taught teams to distrust the acronym and the 2026 field answers with distinct architectures: bundle-native floors, SSE-woven inline enforcement, endpoint-forensic depth, ML-first SaaS scanning, and renewal-lane veterans whose roadmaps deserve questions. This verdict guide reviews twelve options with the distinctions that decide outcomes:…
-
12 Encryption Key Management Solutions: The 2026 Buyer’s Verdict Guide
Key management is where encryption programs succeed or quietly rot: ciphers are commodities, but custody who holds keys, how they rotate, what survives an outage or a quantum decade is architecture. The 2026 field spans cloud-native KMS floors, enterprise custody platforms, secrets-engine standards, in-path protectors, and the HSM-rooted institutions, with post-quantum readiness newly promoted from…
-
12 Tokenization Solutions: The 2026 Buyer’s Verdict Guide
Tokenization wins by subtraction: swap sensitive values for worthless tokens and whole systems exit breach-impact and audit scope at once. The 2026 market splits by what you’re subtracting PCI scope (payment-rooted vaults and P2PE), privacy risk (PII vaults with developer APIs), analytics exposure (format-preserving engines living in warehouses) and by architecture: vaulted versus vaultless, proxy…
-
11 Data Classification Tools: The 2026 Buyer’s Verdict Guide
Data classification is the keystone control everything downstream borrows: DLP policies, access reviews, retention rules, and now Copilot-era AI governance all inherit whatever labels exist or don’t. The 2026 field splits into estate-native labelers, discovery-engine classifiers, user-driven labeling veterans, and AI-semantic challengers. One roster note: our sheet listed Fortra twice (Titus and Boldon James both…
-
Suspected Chinese APT41 Hackers Use BlackX Bootkit to Bypass Windows Secure Boot
Suspected Chinese APT41 hackers have deployed BlackX, a UEFI bootkit, against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. Researchers attribute the operation to APT41 with medium confidence. BlackX closely resembles BlackLotus, the bootkit advertised on underground forums for $5,000 in October 2022. ESET confirmed its capabilities in March 2023, demonstrating exploitation of Baton Drop, tracked…
-
Hackers hijack exposed AI models to launch cyberattacks at victims’ expense
An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model’s owner pays for the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/23/llmjacking-agent-hijacks-exposed-ai-models/ also interesting: Navigating a Heightened Cyber Threat Landscape: Military Conflict Increases Attack Risks The Changing…
-
Schadcode-Attacken möglich: 12 Jahre alte Lücke gefährdet Gitlab-Server
Administratoren sollten dringend ihre Gitlab-Instanzen aktualisieren. Eine seit 2014 bestehende Lücke lässt Angreifer eigenen Code einschleusen. First seen on golem.de Jump to article: www.golem.de/news/schadcode-attacken-moeglich-12-jahre-alte-luecke-gefaehrdet-gitlab-server-2610-214419.html also interesting: US Bitcoin ATM operator Byte Federal suffered a data breach Getting the Most Value Out of the OSCP: The PEN-200 Course CISA Warns of Exploited GitLab Community and Enterprise…
-
JFrog erweitert DevGovOps um automatisierte DORA-Compliance und KI-basierte Release-Prüfungen
JFrog erweitert AppTrust um DORA-Compliance, KI-gestützte Release-Prüfungen und automatisierte Nachweise für sichere Software-Lieferketten First seen on infopoint-security.de Jump to article: www.infopoint-security.de/jfrog-erweitert-devgovops-um-automatisierte-dora-compliance-und-ki-basierte-release-pruefungen/a46888/ also interesting: Securing the Future Together: Why Thales and HPE are the Partners You Can Trust NIS2 und der Mittelstand: Zwischen Pflicht und Praxis 8 things CISOs can’t afford to get wrong in 2026…
-
Cyberangriff auf Onlinehändler – Notebooksbilliger bestätigt Zugriff auf Daten Zehntausender Kunden
First seen on security-insider.de Jump to article: www.security-insider.de/notebooksbilliger-de-cyberangriff-kundendaten-phishing-a-39b5477259e5dd18231ed8c026d421bb/ also interesting: Why identity security is your best companion for uncharted compliance challenges Hackerangriff auf Hofmann Fördertechnik Digital health can’t scale if cybersecurity falls behind Novo Nordisk Confirms Cyberattack Exposing Patient Medical Data and Internal AI Assets
-
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought.The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote First…
-
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated.Their “Node2Shell” proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed…
-
North Korea Hit by Multiple Waves of DDoS Attacks, Knocking Over 40 Websites Offline
Multiple waves of DDoS attacks disrupted North Korea’s internet infrastructure this week, intermittently knocking over 40 official websites offline for about 32 hours. Network monitoring company Kentik linked the outages to synchronized surges of inbound traffic that began on October 20, 2026. Doug Madory, Kentik’s director of internet analysis, noted that aggregate traffic data showed…
-
Wenn die Laufzeitumgebung zum Risiko wird: Die Management-Lektion aus PHP2Shell
Zwei kritische Schwachstellen in PHP rücken eine oft übersehene Abhängigkeit ins Zentrum: die Laufzeitumgebung unterhalb von Websites, Shops und Verwaltungsoberflächen. Die Sicherheitsupdates sind verfügbar doch ein aktualisiertes CMS ist noch kein Nachweis für eine abgesicherte PHP-Installation. Für Geschäftsführung und IT-Verantwortliche geht es deshalb um mehr als einen weiteren Patch: um vollständige Bestandsaufnahmen, belegte Aktualisierungen,… First…
-
Nachvollziehbarkeit und Protokolle – Souveräne KI braucht belastbare Spuren
Tags: aiFirst seen on security-insider.de Jump to article: www.security-insider.de/souveraene-ki-nachvollziehbarkeit-protokolle-datenfluesse-zugriffe-a-76cc765881713dbfa9d7c1f9e0bd693b/ also interesting: Criminal IP Expands into European Cybersecurity Market through Partnership with DotForce 10 Cool New Data Security Products In 2025 AI in OT Sparks Cascade of Complex Challenges The discoveryremediation gap is widening. HackerOne targets the CTEM gap with agentic AI
-
Critical Oracle Java Flaw With CVSS 9.1 Allows Unauthenticated Remote Attacks
Oracle issued a security alert for CVE-2026-91403, a critical vulnerability affecting Oracle Java SE and GraalVM. Attackers can exploit this vulnerability remotely without authentication. The advisory, published on October 21, 2026, assigns the flaw a CVSS 3.1 score of 9.1 and advises distrusting impacted intermediate certificate authority certificates associated with eMudhra. The vulnerability specifically impacts…
-
Google opens its cloud to rival OpenAI, promises business data won’t train models
Google Cloud is adding OpenAI models to its platform, initially through a private preview for selected business customers. The launch includes GPT-6 Astra, GPT-6.1 Sol and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/23/google-cloud-openai-models-private-preview/ also interesting: 13 Produkt-Highlights der Black Hat USA Cybersecurity Snapshot: Top Advice for Detecting and Preventing AI Attacks, and for…
-
INTERPOL Operation Serengeti III Nets 1,462 Arrests and Recovers $105 Million in Cybercrime Crackdown
INTERPOL’s Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered $105 million across 21 countries. INTERPOL announced the results of Operation Serengeti III, a multinational cybercrime crackdown that led to 1,462 arrests, disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. The operation brought together law enforcement…
-
Authentication Bypass – Spionageakteur nutzt Zero Day in Beyondtrust Remote Support aus
First seen on security-insider.de Jump to article: www.security-insider.de/beyondtrust-remote-support-zero-day-cve-2026-102764-patch-a-f94ff585b332b8ae53bd55ab13024859/ also interesting: Cybersecurity Snapshot: CISA’s Best Cyber Advice on Securing Cloud, OT, Apps and More Microsoft’s June 2025 Patch Tuesday Addresses 65 CVEs (CVE-2025-33053) 14 old software bugs that took way too long to squash 8 ways to bolster your security posture on the cheap
-
Hacker Turned DeepSeek Into an AI Cybercrime Assistant to Attack Universities and Steal Data
A threat actor using the handle BUGSTER configured DeepSeek V4 as the reasoning engine for an AI-assisted cybercrime operation that targeted organizations in India, including universities. Unit 42, Palo Alto Networks’ threat-intelligence team, says the actor used AI-generated reconnaissance and scripts to brute-force a university website and successfully stole a database containing more than 5,200…
-
Critical Unpatched Linux Kernel Vulnerabilities Accidentally Disclosed, Including Two Remote Code Execution Flaws
In October, several unpatched Linux vulnerabilities were disclosed on public mailing lists, revealing technical details before fixes were widely available. These disclosures included two critical flaws in KSMBD that could let remote attackers execute code, along with reports of privilege escalation and information disclosure. Trend Micro’s Zero Day Initiative (ZDI) submitted the reports, prompting Linux…
-
PwC Allegedly Hit by Everest Ransomware Group, 590GB of Data Stolen
The Everest ransomware group has reportedly stolen around 590GB of data linked to PwC, one of the Big Four professional services firms. The claim concerns internal human resources and learning systems, but it remains unverified, as no independent reports have confirmed it. A post shared by Crypto India states that the alleged theft includes 108,426…
-
Drone program compliance: What a CTO says most agencies get wrong
Tags: complianceIn this interview with Help Net Security, Nick Donarski, CTO at RotorLab, explains what councils, records clerks, insurers, and auditors expect from a public safety drone … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/23/nick-donarski-rotorlab-drone-program-compliance/ also interesting: Bitdefender und Secunet offerieren Cybersicherheit mit digitaler Souveränität in der Cloud AI-Powered Compliance Audits: Boosting Cybersecurity Efficiency Driving…
-
Die PHP-Schwachstelle Segen und Fluch der KI-getriebenen Suche nach Softwarefehlern
Die kritischen PHP-Schwachstellen PHP2Shell treffen eine zentrale Laufzeitumgebung vieler Webanwendungen. Sicherheitsupdates sind verfügbar; europäische Cybersecurity-Stellen rufen zum sofortigen Handeln auf. [1][2] Für das Management reicht die Frage nach dem Patchstatus jedoch nicht aus: Welche Geschäftsprozesse müssen nach einem Angriff zuerst wieder funktionieren? Welche Daten sind dafür erforderlich? Und wurde die Wiederherstellung unter realistischen Bedingungen getestet?……
-
New infosec products of the week: October 23, 2026
Tags: infosecHere’s a look at the most interesting products from the past week, featuring releases from AppGate, IDENTOS, Sweet Security, and ThreatModeler. Sweet Security adds one-click … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/23/new-infosec-products-of-the-week-october-23-2026/ also interesting: Homeland security hopes to scuttle maritime cyber-threats with port infosec testbed Huntress’s ‘hilarious’ attacker surveillance splits infosec community New…
-
AI is taking cybersecurity jobs at junior and experienced levels alike
Organizations are cutting cybersecurity roles as they adopt AI, even while reporting shortages of the expertise needed to manage threats, according to Barracuda’s … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/23/barracuda-cybersecurity-career-development-report/ also interesting: The 7 most in-demand cybersecurity skills today Wiz’s Security GraphDB vs. DeepTempo’s LogLM Docker APIs Targeted FireTail Blog Software developers: Prime…
-
NIS2 ist kein IT-Projekt: Warum Cyberresilienz die gesamte Organisation fordert
NIS2 ist keine weitere Aufgabe für die IT-Abteilung, sondern ein Stresstest für Governance, Prozesse und Verantwortlichkeiten. Unternehmen müssen Cyberrisiken organisationsweit steuern, Vorfälle fristgerecht melden, Lieferketten absichern und die Geschäftsleitung aktiv einbinden. Wer die Vorgaben nur als Compliance-Pflicht behandelt, verpasst die Chance, aus Regulierung messbare Resilienz zu entwickeln. Management Summary NIS2 ist Führungsaufgabe: Die Geschäftsleitung muss……
-
NIS2 im Praxistest: Europas digitale Souveränität wird am Ernstfall gemessen nicht im Audit
NIS2 schafft auf europäischer Ebene einen einheitlichen Cybersicherheitsrahmen. Das stellt KRITIS-Betreiber vor konkrete Herausforderungen: Was passiert, wenn das Monitoring anschlägt? Wann läuft die Meldefrist und wer trägt die Verantwortung? First seen on ap-verlag.de Jump to article: ap-verlag.de/nis2-im-praxistest-europas-digitale-souveraenitaet-wird-am-ernstfall-gemessen-nicht-im-audit/108987/ also interesting: NIS2-Umsetzungsgesetz: Geschäftsleitung haftet mit Privatvermögen Shai-Hulud & Co.: Die Supply Chain als Achillesferse Lokalisiertes Monitoring für…
-
State Bank of India Suffers a Customer PII Data Leak
Relatively small data breaches in India can turn quite serious, thanks to a sophisticated underground market for trading PII. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/state-bank-india-customer-pii-data-leak also interesting: Cybersecurity Snapshot: Top Guidance for Improving AI Risk Management, Governance and Readiness Cybersecurity Snapshot: Top Guidance for Improving AI Risk Management, Governance and Readiness IDOR Attacks…
-
Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack
The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack also interesting: China-linked hackers target Japan’s national security and high-tech industries Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX Cybersecurity Snapshot: CISA Analyzes Malware…
-
Zoomtopia 2026: Zoom Introduces AI Agents, New Security Controls
Zoom unveils AI agents and its Unified Context Layer at Zoomtopia 2026. Learn how its new automation and security tools could affect IT teams. The post Zoomtopia 2026: Zoom Introduces AI Agents, New Security Controls appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-zoom-ai-agents-conversation-to-completion/ also interesting: McDonald’s AI hiring tool’s password ‘123456’…
-
Botched PHP2Shell disclosure revealed as panic continues
As security teams worldwide grapple with the deep impact of the PHP2Shell flaws, the PHP Foundation has revealed how a carefully planned vulnerability disclosure process went horribly wrong. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366652674/Botched-PHP2Shell-disclosure-revealed-as-panic-continues also interesting: Fluent Bit vulnerabilities could enable full cloud takeover CISA Warns of Actively Exploited iCagenda and Balbooa Forms…
-
Alms For the Cyber Poor: Program Will Help Small Utilities
Dragos Has Learned That ‘Free’ Doesn’t Always Mean ‘Usable’. Dragos, a pioneer in the operational technology security market, and its new backer, consulting giant Accenture, are teaming up with the Sans Institute training provider and Elastic to offer $10 million worth of free OT cybersecurity support to small and rural utilities. First seen on govinfosecurity.com…
-
What We Missed: Feds Lasso Texas Laptop Farms
In this video, Dark Reading editors discuss some of the news they didn’t get a chance to cover, from busting up North Korea’s stateside infrastructure in Operation Lonestar Justice to Staples’ gift card bonanza. First seen on darkreading.com Jump to article: www.darkreading.com/insider-threats/texas-laptop-farms-north-korean-it-workers also interesting: New RustyAttr Malware Targets macOS Through Extended Attribute Abuse North Korean…
-
Railway warns devs to rotate secrets after potential breach
Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate-secrets-after-potential-breach/ also interesting: Database tables of student, teacher info stolen from PowerSchool in cyberattack Is your enterprise ‘cyber resilient’? Probably not. Here’s how other…
-
Why Datadog Is Eyeing a $4B Buy of Cloud Defense Firm Upwind
Deal Would Broaden Datadog’s Capabilities Across Cloud, Application and AI Security Rising cloud security star Upwind finds itself at a crossroads. Down one path is a $300 million cash infusion from Bessemer Venture Partners. Down the other is a $4 billion sale to New York-based observability and security platform Datadog. Each path carries risks and…
-
Independent Auditors Find Gaps in OpenAI Agent Monitoring
Metr and Redwood Uncover Codex Safeguard Bypasses, OpenAI Says Flaws Now Patched. Third-party artificial intelligence safety evaluators found several vulnerabilities in OpenAI’s monitoring system for its coding agents, showing how easy it is to bypass the monitoring. Metr and Redwood Research stress-tested OpenAI’s internal misalignment monitoring system from July 21 to Aug. 11. First seen…