“We discovered that it is possible to create an AI-driven computer worm, using only small, free AI models, that can autonomously identify each machine’s unique weak points (including vulnerabilities just reported by industry and misconfigurations such as reused passwords) and… Read More "AI worm prototype shows attackers don’t need Mythos to take over your network"
WhatsApp has asked a US court to hold a blacklisted spyware firm in contempt, after claiming it has violated a permanent injunction banning it from targeting users. The messaging giant said on June 8 that it “successfully disrupted” social engineering… Read More "WhatsApp Discovers NSO Group-Linked Spearphishing Attempts"
An APT group linked to the Iranian government pretended to be a Chaos ransomware affiliate in order to provide plausible deniability for geopolitical espionage and prepositioning, Rapid7 has claimed. The security vendor made the revelations in a new report published… Read More "Iran-Linked APT Posed as Chaos Ransomware Member in Espionage Campaign"
Google on Monday announced a Chrome 149 update that patches 74 vulnerabilities, including a zero-day that has been exploited in the wild. The exploited vulnerability is tracked as CVE-2026-11645. It has been described as a high-severity out-of-bounds read/write issue in… Read More "Google Patches 5th Chrome Zero-Day Exploited in 2026"
Ravie LakshmananJun 09, 2026Vulnerability / Artificial Intelligence The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as… Read More "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE"
Notably, the campaign exploited the popular C++ library ensmallen, as well as packages in the computational biology, bioinformatics, and genotype-phenotype analysis ecosystems. The most novel thing about this malware is its combination of advanced tactics, noted David Shipley of Beauceron… Read More "Meet Hades: The malware that lies to AI security agents"
Critical infrastructure (CI) operators have been urged to plan for the ability to disconnect from third-party networks and recover compromised systems in the event of a cyber-attack sooner rather than later. The call came from the US Cybersecurity and Infrastructure Security… Read More "CISA Urges CI to Make Plans to Remain Active if hit by Cyber-Attack"
If the agent finds a way to access internal emails and documents from Finance and shares the answer with the end user, and that end user then copies and pastes that information into an email sent to some investors, or… Read More "OpenAI’s Lockdown Mode is trying to solve the problem that it created"
A Windows malware toolkit has been observed stealing SMS messages and one-time passwords (OTPs) from victim machines by hijacking Microsoft’s Phone Link application, sidestepping the need to directly compromise a target’s mobile device. The activity has been ongoing since at… Read More "CloudZ Malware Abuses Phone Link to Steal SMS OTPs"
Low-skilled threat actors are abusing legitimate generative AI (Gen AI) platforms in growing numbers to create highly convincing phishing campaigns, Cofense has warned. The security vendor said that it has observed a number of campaigns based around v0[.]dev, a powerful GenAI… Read More "Researchers Spot Uptick in Use of Vercel for Phishing Campaigns"
