The Hacker NewsJun 17, 2026Attack Surface Management Breaches don’t always start with a zero-day. An exposed admin panel can get brute-forced, or credentials reused from a previous attack. But when a vulnerability does drop — like MongoBleed earlier this year,… Read More "The Top 10 Attack Surface Exposures in 2026"
A study conducted during Infosecurity Europe 2026 has found that AI-powered attacks at scale are the biggest security concern facing many cybersecurity professionals. The survey of 168 cybersecurity leaders across various sectors conducted by Filigran during the three-day event found… Read More "AI Threats and Alert Fatigue Challenge Cybersecurity Teams"
Password, secret, and access management solutions provider 1Password announced this week that it has acquired Apono, an Israel-based company that specializes in just-in-time access governance for humans, machines, and AI agents. Financial details have not been officially disclosed, but Calcalist… Read More "1Password Acquires Apono in Reported $250M-$300M Deal"
For security teams, the findings never stop, but confidence in knowing which ones matter is becoming harder to maintain. The problem is no longer visibility. It’s validation. Security teams must decide which findings warrant action while operating under constant pressure… Read More "Adversarial Exposure Validation Turns Security Visibility into Confident Prioritization"
A design flaw in the Vertex AI software development kit (SDK) for Python, Google Cloud’s managed platform for building, training, and deploying AI agents, could allow hijacking and poisoning of models outside of a developer’s own Google Cloud project. According… Read More "Google’s Vertex AI SDK could allow RCE through bucket squatting"
Security researchers have uncovered a coordinated campaign designed to steal developers’ AI-related API keys via malicious plugins. Aikido Security found at least 15 integrated development environment (IDE) plugins on the JetBrains Marketplace which had slipped past security checks and have now… Read More "Fifteen JetBrains Marketplace Plugins Steal API Keys"
A new backdoor deployed as part of a recent DragonForce ransomware attack is using Microsoft Teams relay servers for command-and-control (C&C), according to Broadcom’s Symantec and Carbon Black threat hunter team. The DragonForce group has been active since 2023, operating… Read More "Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack"
Cybersecurity researchers have flagged a “coordinated malware campaign” on the JetBrains Marketplace that has published no less than 15 malicious plugins capable of exfiltrating artificial intelligence (AI) provider keys. “Every plugin poses as an AI coding assistant built on DeepSeek… Read More "Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats"
The structural problem is straightforward. Organizations faced a median of 16 CISA Known Exploited Vulnerabilities in 2025, up from 11 the year before. Only 26% were fully remediated, down from 38%. Defenders are caught in Alice’s Red Queen Race. AI… Read More "What 22,000 breaches teach us about incident preparedness"
The Ukrainian government can now activate emergency EU cyber support to respond to large-scale cyber-attacks and cyber incidents affecting one of its organizations and businesses. Despite not being an EU member state yet, Ukraine’s inclusion in the EU Cybersecurity Reserve was… Read More "EU Security Experts to Support Ukrainian Orgs in Case of Cyber-Attacks"
