Topic: Security
360 stories · page 1 of 8
Vulnerabilities in models and agents, prompt injection, data leaks, malicious packages, and the defences against them. Alignment research and the way labs test models before release are covered here too.
- TianoCore EDK II UEFI flaw CVE-2026-97631 allows pre-boot code execution
- Tailscale details SSH privilege-escalation flaws, patch targeted for 27 October
- OpenAI says Check Point uses Daybreak to speed up vulnerability research
- FoxIO details three TLS bugs in GoAhead web server, one rated CVSS 9.1
- Bank of America tells customers not to share logins with AI agents
- PHP2Shell: host's IIS rule blocked ColdFusion uploads, and how to find hidden PHP
- Cohere says Alibaba's Qwen3.8-Flash-Next tried to upload a file to Beijing
- Cloudflare reports GLM-5.3 on Workers AI leaked other customers' data in 155 responses
- FOSDEM 2027 Digital Dissident devroom opens call for anti-censorship talks
- AWS finds PHP2Shell exploitation began four days before PHP patches
- OpenAI and Poland's NASK partner on AI safety and security research
- Nine security firms see no successful attacks on new PHP flaws
- Brotli flaw CVE-2026-111497 (Node2Shell) hits Python and other HTTP software
- OpenAI says it will train models on cached and simulated web, not the live internet
- OpenAI's Sam Altman says advanced AI will escape sandboxes, and only alignment works
- OpenAI audit by METR and Redwood finds major monitoring gaps
- Calif teases Signal 1-click and iMessage demos from Hexacon
- Agent Mosaic paper: LLM agents leak confidential conclusions pieced together from allowed documents
- Symantec finds AI agent that hijacks exposed LLMs to run self-sustaining attacks
- Researcher releases ns2jb, a software-only Switch 2 jailbreak built with Codex
- PHP patches two remote code execution holes after disclosure leak
- Meta restores Muse sharing with new URLs after security report
- eMudhra to exit global SSL/TLS certificate business after CA incident
- 1Password launches 1Password for Agents so AI agents can log in without seeing passwords
- SafeDep: LiteLLM 1.107.0 on PyPI shipped a credential stealer and backdoor
- Railway says a third party may have accessed customer secrets, pauses deployments
- OpenAI says GPT Sol 6.1 and GPT-6 Astra agents disabled safety monitoring
- GitLab 19.5.1 patches CVSS 10.0 unauthenticated code execution bug
- Alter launches access control for AI agents: vault, policy, audit
- PHP maintainers plan patches for two severe flaws, tell admins to prepare
- Meta pauses Muse chat sharing after researchers find AI chats on the web
- Group claims it breached PingCAP's TiDB Cloud and took 10.6 TB
- Feds suspect US consulting executive helped run ShinyHunters extortion site
- 333 Tor exit nodes infected with Ebury were intercepting SSH
- WhatsApp help pages hid text telling AI not to name a regulator
- Russian satellite Kosmos 2612 closes to within 500 meters of US imaging satellite ICEYE-X36
- ProjectDiscovery backdoors Qwen2.5-7B to leak credentials via Codex
- Plex Media Server flaws fixed last month now exploited to install malware
- OpenCode breach exposes Console users' API keys, driving up charges on their AI accounts
- Microsoft launches Guardian Agents to watch AI agents, says frontier models can't be trusted
- Hacker breaks into 100+ websites with Cairn AI agents, Norforge finds
- Go blocks eight eMudhra intermediate certificates in crypto/x509
- Danfoss fridge dashboards sat open online before French supermarket attack
- Court keeps accused ex-OpenAI spy detained, citing “Saudi Gov Docs” folder
- Gemini 4 Argon rolls out broadly as DeepMind details safeguards
- Broadcom WiFi bug lets attackers run code on routers, researcher says
- Lean v4.35.0 ships lake check and four extra proof-checking kernels
- Suspected Russian drones hit tankers in Romanian waters, NATO adds counter-drone cover
- Ray-Ban Meta glasses bug recorded conversations without "Hey, Meta"
- OpenAI discloses its models hacked two more sites and drew crypto from a wallet