TECHNOLOGY · AI · CYBERSECURITY · THE SYSTEMS SHAPING BUSINESSPage 7 of 8: earlier stories.
Researchers leaked a Linux root password hash in minutes by abusing stale branch predictions left behind when code is rewritten at runtime.
Glow Security's PixelLeak research traces the exposures to agents working around a missing image-upload API when preparing pull requests.
The volunteer group says the agent chose its own next moves at machine speed but was noisy enough to sabotage its own attack.
Huntress traced at least 40 infections to a lure that began with a sponsored Google result and a Custom GPT hosted on chatgpt.com.
A public proof of concept turned a targeted espionage campaign against Citrix gateways into internet-wide scanning, with fewer than 10% of about 42,000 exposed hosts fixed.
An intruder used a flaw in a file-sharing system to reach unencrypted personnel data for roughly nine months before the Pentagon agency noticed in July.
Thousands of machines ran the poisoned installer, but the China-based operators planted the modular backdoor on only about a dozen chosen targets.
The fix covers a critical bug in its Advanced Forms tool used by about 50 organizations, and the company says it found no sign of exploitation.
A Times review of leaked samples found family contacts, PreCheck-linked IDs and counterintelligence postings, and an internal memo assumes every employee is affected.
The Japanese car-sharing service says intruders took names, birthdates, driver's license details and ID document images, though not credit card data.
Exposed tables held valet customers' license plates, plaintext passwords and private messages, as AI-built apps ship without row-level security.
Cleafy found about 100 deployments of the malware-as-a-service console since April, with its newest version asking Gemini to rank infected phones.
Two compromised service principals, one with credentials left in a public GitHub issue, were enough to delete resources across more than 100 storage accounts in about seven minutes.
Reports say ShinyHunters took drug-test results and psychiatric reports through a PeopleSoft flaw, and the group wants a correction, not a ransom.
CVE-2026-86950 lets a malicious file run code on older iPhones and Macs; Apple says it may have been used against specific people before iOS 27.
Zenity Labs hid instructions in Web-to-Lead submissions that made Agentforce leak CRM data through image requests and send phishing messages over Slack.
A one-character encoding trick lets the extortion group slip past firewall rules that many PeopleSoft customers adopted instead of patching after a June zero-day wave.
Titan never checked JWT signatures, so a forged admin token opened a public SQL endpoint to 17 databases holding an estimated 17.3 trillion rows.
Two Tokyo rail-linked groups disclosed separate intrusions over the same weekend, one exposing member emails and the other disrupting hotel and retail payment systems.
Suppliers and national agencies had quietly told customers to pull NetScaler appliances offline before Citrix confirmed attacks and shipped fixes for eight flaws Sunday.
The multimillion-shekel deal targets staff pasting patient data into public chatbots and rogue AI agents, and Check Point plans to sell the resulting platform to others.
Manifold Security found yoursite.com and your-domain.com in about 359,000 GitHub files; two of 24 real-browser visits, both on macOS, ended on scam pages that static checks never flagged.
An analysis of the Russian-language forum’s first three years finds a tiny active core and 205 aliases that later surface on XSS, RAMP and BreachForums.
Socket says release tags for two actions-cool workflows still pointed to May’s malicious code when the repositories returned on Sept. 16.