5+ day, 22+ hour ago   (383+ words) A security researcher has published details of what appears to be a zero-day privilege escalation exploit in CrowdStrike. The individual, identified by their online moniker “Nightmare Eclipse” (aka Infinite Nightmare, MSNightmare) posted the details to GitHub on September 3. “FalconFlank is…...

1+ week, 3+ day ago   (1553+ words) As frontier AI models supercharge vulnerability research, open-source security faces an existential challenge: an explosion of AI-generated vulnerability reports, flooding an already understaffed field. Industry leaders are responding with a new generation of security coalitions. AI-fatigue in the open-source community…...

2+ week, 3+ day ago   (465+ words) One major security challenge with generative AI, and particularly AI agents, is making these systems prove what they really did. The Linux Foundation aims to address this challenge through a new open standard for AI runtime evidence that helps make AI…...

2+ week, 4+ day ago   (371+ words) A phishing platform dubbed ZeroTokens allows attackers live visibility into victim sessions and the ability to change subsequent prompts in real time, allowing attacks to adapt in real time while targeting credentials and financial information. The platform allowed an operator…...

2+ week, 4+ day ago   (310+ words) A large-scale malware-spreading scheme targeting Minecraft players has continued to evolve despite the takedown of the threat actor’s malicious infrastructure in July. In a new report, researchers at McAfee shared that over 6300 attempts to access malicious sites linked to the…...

2+ week, 5+ day ago   (501+ words) A fake Codex download campaign has used sponsored search results, legitimate Google Sites pages and ClickFix instructions to trick macOS users into executing malware. In a technical write-up published on August 24, Cato Networks researchers said they found the campaign directing…...

2+ week, 5+ day ago   (296+ words) Security researchers have claimed that over 9300 leaked AWS keys which surfaced between August 2022 and August 2026 are still active, including hundreds with full admin rights. Truffle Security said its scanners found 64,024 unique AWS key pairs across 431,875 public findings: git history, Hugging…...

3+ week, 1+ day ago   (537+ words) A new version of the notorious Agent Telsa malware contains new features designed to evade detection and steal credentials, KnowBe4 research has identified. The cybersecurity firm provided a detailed analysis of the Agent Tesla version 4 infostealer, which was observed being dropped…...

3+ week, 2+ day ago   (316+ words) Two vulnerabilities in JFrog Artifactory have been found which allow anonymous or low-privileged users to manipulate package metadata without modifying the underlying artifacts, creating a potential route to software supply chain compromise. Oligo Security reported the flaws to JFrog on…...

3+ week, 4+ day ago   (246+ words) Security researchers at Wiz, part of Google Cloud, have discovered a critical script injection vulnerability in one of Snowflake’s public repositories on GitHub that GitHub’s Advanced Security missed. The discovery has been attributed to Wiz Research’s Red Agent, an autonomous,…...