Security insights, vulnerability roundups, and updates from the Agent Breach team.
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.
A longstanding use-after-free vulnerability in Linux's SCTP implementation allows local attackers to gain root access and escape containers. Organizations running outdated kernels must apply urgent updates.
Read moreOpenAI has halted internal development of its next-generation AI model Astra due to unexpected advances in cybersecurity capabilities. The move highlights growing concerns around securing highly capable AI systems.
Read moreThe open source community is maturing out of its trusting childhood and into a more security-conscious adulthood. Projects are learning hard lessons about sustainability, oversight, and the risks of blind trust.
Read moreA newly patched pre-authentication XSS vulnerability in WordPress could allow attackers to execute arbitrary PHP code. All versions of the CMS are affected, making immediate updates essential.
Read moreThreat group UNC6671 uses voice phishing to impersonate IT support and steal SaaS login credentials from enterprise employees. The attacks primarily impact financial services, private equity, and professional services firms.
Read moreNew CSS attack techniques can bypass webmail boundaries to steal passwords, tokens, and hijack user sessions. These vulnerabilities affect major platforms including Gmail, Outlook, and Yahoo Mail.
Read moreSecurity researchers discovered that Atlassian's AI assistant Rovo can be manipulated into exfiltrating Jira and Confluence data. The vulnerability allows attacker-controlled instructions to access and transmit sensitive information.
Read moreAttackers are using ClickFix-style social engineering to deliver macOS malware that steals crypto assets and credentials. The Go-based payload targets both Intel and Apple Silicon Macs.
Read moreA recent supply chain attack involved almost 800 rogue npm packages delivering RATs and infostealers across operating systems. These packages used AI-generated typo-squatting techniques to evade detection.
Read moreA high-severity command injection vulnerability in Progress Kemp LoadMaster has been added to CISA's Known Exploited Vulnerabilities list after over 790 exploitation attempts were reported.
Read more