TECHNOLOGY · AI · CYBERSECURITY · THE SYSTEMS SHAPING BUSINESSNewly disclosed flaws, patches and active exploitation.
Google advises organizations to treat any internet-facing appliance that ran a vulnerable version as potentially compromised, then rebuild it and rotate the credentials it held.
CEO Brian Moynihan said the outside workers joined about 3,000 technical staff, a rare look at what AI-driven bug hunting costs once the findings arrive.
Both vendors say there is no workaround, and Cisco warns that intruders with root access to its email appliances may erase traces of their activity.
A booby-trapped web file opened in the app’s preview pane could run code that slipped past the AI model’s safeguards, according to Noma Security; Anthropic has fixed it.
The update to software embedded in billions of devices also removes support for an old Windows file-sharing protocol, a change some users will have to plan around.
Federal agencies have until Friday to patch the Windows Shell flaw, while a critical Outlook bug can run attacker code when an email is merely previewed.
Researchers say intruders reached root on an up-to-date appliance without leaving a web shell, and Ivanti’s own integrity tool may not spot it.
The guidance targets refrigeration, solar, wind and water installations that fall outside Germany's critical-infrastructure rules, the kind of equipment hijacked in France.
Danfoss says many hijacked units were outdated or past end of life, nobody has claimed the attack, and Reuters notes similar disruptions at U.S. military commissaries in August.
The security company’s September figures also show more phishing and a measurable share of employee AI prompts that risk leaking sensitive company data.
The agency wants compromise checks and secret rotation, not just upgrades, even though the new bug is not on its exploited list and Citrix knows of no attacks.
The license plate camera maker can now issue official vulnerability records for its products, while researchers warn that the police agencies relying on them need detail Flock controls.
Intermarché and Coopérative U say hundreds of stores were hit Sunday night into Monday, and Paris prosecutors have opened an investigation that also covers reported fires.
A joint advisory from 10 agencies ties the Beijing contractor's Microscan and FishHub tools to intrusions at a U.S. power company, foreign airports and Taiwanese universities.
Adobe's October bulletins come under the twice-monthly schedule it adopted in July as AI tools surface more bugs, and none of the October flaws is known to be under attack yet.
For about two years, converting an account into an organization quietly moved its access keys to a named owner, a gap that could have let attackers push images under trusted names.
Anyone who claimed a renamed or deleted GitHub repository’s old name could publish to some packages; GitHub has since added a 48-hour expiry, but owners must check their settings.
A crafted pattern in a pipeline file could let an attacker without an account take over the server that holds a company's source code and build secrets.
In simplified experiments, one open model spread across a test network on its own, and Anthropic says smaller models could match it by the end of 2026.
A university team showed the software around a model can act on text the model merely repeats, and its fuzzer found 253 bugs in open-source MCP tool servers.
Microsoft's last reminder gives corporate and school IT teams until Nov. 10 to move remaining 23H2 machines to a supported release, with 25H2 covered into 2028.
Test domains imitating Apple, OpenAI and Okta displayed as ordinary text with valid certificates in Chrome 154, and Gmail showed the fake senders without flagging them.
A senior CISA official says AI-driven bug discovery is outrunning anything seen before, as agencies prepare to fix their riskiest flaws within three days starting in December.