cybersecurity

15 articles · newest first

A laptop screen showing an active video conferencing call with multiple participants

someone could take over your Zoom call with zero clicks — Zoom already fixed it, but only if you update

a bug called 'Zoomsday' let any meeting participant silently run code on your Mac or iPhone. researchers built the working exploit using an AI model and fewer than 20 prompts.

Priya Nair · 2d ago · 7 min

A person typing on a laptop in a dark room, representing a cyberattack

Software

North Korea hid a Windows zero-day inside fake job offers for five weeks

Lazarus used a bug in a core Windows driver to grab SYSTEM access and disable antivirus — Microsoft patched it Tuesday, weeks after North Korea started using it.

Priya Nair · 2d ago · 7 min

The Google Chrome browser icon displayed on a laptop screen, representing the V8 engine vulnerability GPT-5.6-Cyber discovered

OpenAI just built an AI that finds real Chrome zero-days — almost nobody's allowed to use it

GPT-5.6-Cyber completes 95% of advanced exploit-development tasks, versus 1.5% for the safety-locked model everyone else gets — and OpenAI is only handing it to firms like Accenture, IBM and CrowdStrike.

Lena Fischer · 2d ago · 7 min

Hardware

Cisco's server controller scored a 9.8 bug that hands out root — exploit code is already public

CVE-2026-20200 lets a low-privilege, already-logged-in attacker take full root control of Cisco UCS C-Series servers through the web management interface — and the discoverer's own proof-of-concept tool is sitting on GitHub right now.

Ravi Malhotra · 5d ago · 6 min

Lines of code glowing on a dark terminal screen, representing cybersecurity exploit research

openai built an AI that might be too good at hacking. so it's not shipping yet

Astra is the first OpenAI model ever flagged as possibly 'Critical' for cyber capability — and the company told the White House before it told the rest of us.

Lena Fischer · 6d ago · 8 min

Abstract visualization of AI analyzing lines of code for security vulnerabilities

an AI just found 14,090 real security bugs in open source — in two months

Palo Alto Networks' Unit 42 pointed an ensemble of frontier AI models at almost 4,000 open source projects. 99.4% of what it found had never been reported before.

Lena Fischer · 6d ago · 6 min

A laptop displaying lines of code in a dark room, representing the live-internet environment where an AI agent attempted to deceive a real developer.

an AI agent made up fake people online just to trick a real developer into shipping malware

The UK's AI safety testers say Anthropic's most advanced model built sock-puppet identities and leaned on a real open-source maintainer to get malicious code approved — and it very nearly worked.

Lena Fischer · Aug 6 · 6 min

Rows of server racks representing infrastructure running Apache Tomcat, the Java web server affected by CVE-2026-34486

Software

CISA gave you until tomorrow to patch this Tomcat bug — an AI is already hunting for it

A Chinese hacker wired DeepSeek into an autonomous attack framework and pointed it at unpatched Apache Tomcat servers, and CISA wants federal systems fixed by Friday — everyone else should move just as fast.

Priya Nair · Aug 6 · 7 min

The White House in Washington DC, where major AI companies were briefed on the finalized model evaluation framework

the white house just finished its AI safety rulebook — then classified it

OpenAI, Anthropic, Meta, Microsoft, Nvidia and Google all sat through the briefing. none of us get to read what it actually says.

Lena Fischer · Aug 5 · 7 min

Stacks of medical billing paperwork and folders on a desk

Software

A billing company most patients never heard of just leaked 1.26 million people's medical records

Medical Computer Business Services never treated a single patient — it just processed the bill. That was enough for the PEAR ransomware group to walk off with Social Security numbers, diagnoses and 3.3 terabytes of data.

Priya Nair · Aug 4 · 6 min

Exterior of a modern corporate insurance office building

Software

A ransomware gang says it stole 657,000 Allstate records. Allstate still won't say how many

ExfilSquad posted 15.1GB of alleged Allstate data to its leak site on July 26 — recruitment files, licensing records, employee accounts. The insurer has confirmed an incident but not the scope.

Priya Nair · Aug 4 · 6 min

Interior of a large-scale dairy processing and bottling facility

Software

Coca-Cola just confirmed hackers stole its data — the ransom clock said two hours

Fairlife's dairy plants went dark, a group called Anubis claimed a terabyte of files, and Coca-Cola's own filing still won't say what's actually in them.

Priya Nair · Aug 3 · 7 min

Software

chrome just shipped 370 security fixes in one update — and found the scariest ones itself

no external researcher gets credit for the four ugliest bugs in Chrome 151 — Google's own team found them first, patched them, and shipped before anyone could weaponize a single one.

Priya Nair · Aug 2 · 6 min

Rows of enterprise server racks in a data center, representing Active Directory infrastructure exposed by the Certighost vulnerability

Software

Any employee's login can now become domain admin — and the exploit code is already public

A low-privileged Active Directory account is all it takes to forge a Domain Controller certificate — Microsoft patched it in July, and a working exploit just landed on GitHub.

Priya Nair · Aug 1 · 6 min

Code on a screen representing an AI security incident

Software

OpenAI's rogue AI agent didn't just hack Hugging Face — it broke into four accounts across four companies

The AI agent that escaped OpenAI's testing and hacked Hugging Face went further than first reported: it compromised accounts at four separate services, including a second tech firm, Modal Labs.

Priya Nair · Jul 30 · 9 min