The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
296 stories match. Clear filters
-
Companies seeking an MSP doubt their ability to spot cyberattacks
Businesses looking to outsource cybersecurity want providers that can help them recover from attacks, manage AI risks, and explain what security problems mean for their operations, according to Barracuda What MSP Customers Need Next report. What MSP customers need next (Source: Barracuda Networks)…
-
An average of 8 minutes is all hackers need to log in with stolen credentials
Attackers used stolen credentials to log in an average of eight minutes after infection across 27 confirmed infostealer cases, according to a report from Elastic Security Threat Command. Researchers also documented misuse of AI applications to execute commands and digitally signed remote…
-
Brava Security Emerges From Stealth With $15 Million in Funding
Its multi-agent AI platform generates the telemetry an attack would produce to fix gaps in enterprise defenses.
-
Week in review: Refrigeration cyberattacks hit European retailers again, Patch Tuesday forecast
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: The first ten lines of a command policy for AI coding agents In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI…
-
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret…
-
Runaway AI hacking agent behind WorkOS breach after escaping sandbox
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked the company. [...]
-
UK Wades Into Tech Sovereignty Amid AI Policy Changes
The UK is betting on domestic AI and cyber investment to reduce reliance on US tech — but security leaders question whether the funding is too fragmented and too late.
-
AI Gave Your Incident Archive a Second Job
Security records are increasingly being used by vendors to train their models, creating new risks for enterprises.
-
Hackers enlist Artex to scan GitHub repositories for exposed secrets
Agentic AI tools target downstream tenants using stolen credentials, according to Microsoft researchers.
-
Companies struggle to know what normal looks like for AI agents
The inability to establish baselines is complicating the task of securing these autonomous tools, a new report found.
-
OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits
OpenAI on Thursday unveiled GPT‑6 Cyber, which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment. The new model is "more capable at finding and fixing vulnerabilities, and far more…
Also covered by BleepingComputer
-
CEO-spoofing scammers used AI to help steal more than $100 million, feds say
The U.S. is working on extraditing three suspects from Europe in a case involving more than $100 million in fraud from CEO impersonations.
-
OpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the Line
Rated Critical for cybersecurity, OpenAI’s new model beats GPT-5.6 Cyber at exploitation while staying in scope more reliably.
-
Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers
A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test. The attack needs Dispatch, a Claude feature that lets people send tasks from their phone to Claude…
-
OpenAI’s GPT-6 Cyber found 81 Firefox flaws earlier AI testing missed
OpenAI has introduced GPT-6 Cyber, a version of GPT-6 Astra trained to find software vulnerabilities, test how attackers could exploit them, and help develop fixes. The model is designed for authorized security testing of websites and applications. Vulnerability research and security testing…
-
OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions
After its sandbox proxy failed, an internal OpenAI model crafted raw packets and probed AWS services trying to reach the internet.
-
UK Warns Its Critical Infrastructure Faces Grave Risk
Britain's new Labour-led government is making a concerted push to get ahead of the AI risks to its national networks and the industrial complex.
-
Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services
Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users. "While we investigated, we removed access to Reactor and Data Solutions," the company…
-
87% say their AI controls need to work better
The AI running inside large companies has stopped waiting for permission. Across five categories of AI, from chatbots to process automation, more than half of 3,600 business decision-makers say the systems their teams use can act within defined rules without routine review, or finish whole…
-
99% of repository access tokens never expire
Developers, automated tools and AI coding agents hold permissions that can outlast the work they were granted for. Without access reviews, organizations can leave accounts able to copy or change company code after the work ends, according to BlueFlag Security’s The State of Developer Risk 2026…
-
3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million
The trio, who have nicknames that include “Rocky Balboa,” “Superman Cash” and “Fat Boy,” often targeted the companies’ accounting departments.
-
Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts
Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service platforms to steal Microsoft and Google account credentials and authentication sessions. [...]
-
OpenAI’s GPT-6 Astra silently obstructed safety research tasks
OpenAI has disclosed another AI alignment incident where GPT-6 Astra was found to sometimes quietly withhold help on safety research. [...]
-
AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research
An unreleased OpenAI cyber model found and exploited 948 distinct Linux kernel privilege escalation bugs for about $1.2 million.
-
SecurityDataPipeline.com Launches as a New Educational Resource for the AI Era
The ungated resource explains how security data pipelines reduce SIEM ingestion costs, preserve detection coverage, and prepare the data layer for AI-driven security operations.