Hardly a day goes by lately without news of AI agents autonomously hacking websites or AI tools being used by cybercriminals and scammers. But a recently patched vulnerability in the macOS version of OpenAI’s ChatGPT underscores the potential value to… Read More "A Flaw in ChatGPT’s Mac App Could Have Let Hackers Grab Sensitive Data"
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
The Warlock ransomware group continues to target SharePoint servers in attacks against critical infrastructure, government, and education entities, Symantec reports. Warlock is believed to be operated by a China-based hacking group tracked as Longlegs and Storm-2603, which has been linked… Read More "Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks"
EU Cyber Resilience Act ‘completely kills’ manual vulnerability triage
Independent security experts see the EU Cyber Resilience Act (CRA) reshaping international technology markets to emphasize cyber resilience from the ground up, thereby testing the operational capacities of technology vendors whose wares compete in those markets. The EU CRA introduces… Read More "EU Cyber Resilience Act ‘completely kills’ manual vulnerability triage"
Police Target KillSec Ransomware Group with Arrests and Seizures
Law enforcers have struck at a prolific ransomware group thought to be responsible for hundreds of cyber-attacks, arresting its 16-year-old suspected ringleader. KillSec has been in operation since 2024 and carried out at least 500 successful attacks in that time,… Read More "Police Target KillSec Ransomware Group with Arrests and Seizures"
Key Vendor Risk Assessment Criteria and How to Apply Them
Vendor risk assessments need to be tailored to the unique cyber risk criteria of third-party vendors. This post explains how to determine which risk criteria apply to each vendor and how to measure their severity. Those criteria sit inside a… Read More "Key Vendor Risk Assessment Criteria and How to Apply Them"
AI Agents Aimed SQL Injection at US and Canadian Government Sites
AI agents appear to have attempted to hack a US Department of Education website and a Library and Archives Canada service while trying to access public data, according to AI research lab Transluce. The findings, published on September 30 by… Read More "AI Agents Aimed SQL Injection at US and Canadian Government Sites"
Rolling the cyber dice with open-source and open-weight AI models
But if we look at what the research already does. In Winter Soldier, a team poisoned under 0.005% of pre-training tokens, 64 documents and made a model learn a hidden prompt-and-response pair that never appears in the training data at… Read More "Rolling the cyber dice with open-source and open-weight AI models"
Two Zero-Days Exploited in Attack on Dutch Institute for Vulnerability
A Dutch cybersecurity non-profit has revealed how it was compromised in an agentic AI attack that exploited two zero-day flaws in its helpdesk platform. The Dutch Institute for Vulnerability Disclosure (DIVD) is staffed by volunteers and dedicated to ethically disclosing… Read More "Two Zero-Days Exploited in Attack on Dutch Institute for Vulnerability"
What is a Third-Party Risk Assessment in Cybersecurity?
A third-party risk assessment pulls vendor risk data to help cybersecurity teams understand how to best mitigate supplier risks. Though the field of Third-Party Risk Management (TPRM) is evolving to prioritize compliance, security, and supply chain risk, third-party risk assessments… Read More "What is a Third-Party Risk Assessment in Cybersecurity?"
Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action
The US Cybersecurity and Infrastructure Security Agency (CISA) and Fortinet on Thursday sounded the alarm on a critical FortiMail vulnerability that has been exploited in the wild. Patches have yet to be released. Tracked as CVE-2026-104286 (CVSS score of 9.8),… Read More "Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action"