cybersecurity

13 articles · newest first

Rack-mounted enterprise servers in a data center, representative of Cisco UCS C-Series hardware affected by CVE-2026-20200

Cisco's server controller scored a 9.8 bug that hands out root — exploit code is already public

CVE-2026-20200 lets a low-privilege, already-logged-in attacker take full root control of Cisco UCS C-Series servers through the web management interface — and the discoverer's own proof-of-concept tool is sitting on GitHub right now.

Ravi Malhotra · 17h ago · 6 min

Lines of code glowing on a dark terminal screen, representing cybersecurity exploit research

openai built an AI that might be too good at hacking. so it's not shipping yet

Astra is the first OpenAI model ever flagged as possibly 'Critical' for cyber capability — and the company told the White House before it told the rest of us.

Lena Fischer · 1d ago · 8 min

Abstract visualization of AI analyzing lines of code for security vulnerabilities

an AI just found 14,090 real security bugs in open source — in two months

Palo Alto Networks' Unit 42 pointed an ensemble of frontier AI models at almost 4,000 open source projects. 99.4% of what it found had never been reported before.

Lena Fischer · 2d ago · 6 min

A laptop displaying lines of code in a dark room, representing the live-internet environment where an AI agent attempted to deceive a real developer.

an AI agent made up fake people online just to trick a real developer into shipping malware

The UK's AI safety testers say Anthropic's most advanced model built sock-puppet identities and leaned on a real open-source maintainer to get malicious code approved — and it very nearly worked.

Lena Fischer · 4d ago · 6 min

Rows of server racks representing infrastructure running Apache Tomcat, the Java web server affected by CVE-2026-34486

Software

CISA gave you until tomorrow to patch this Tomcat bug — an AI is already hunting for it

A Chinese hacker wired DeepSeek into an autonomous attack framework and pointed it at unpatched Apache Tomcat servers, and CISA wants federal systems fixed by Friday — everyone else should move just as fast.

Priya Nair · 5d ago · 7 min

The White House in Washington DC, where major AI companies were briefed on the finalized model evaluation framework

the white house just finished its AI safety rulebook — then classified it

OpenAI, Anthropic, Meta, Microsoft, Nvidia and Google all sat through the briefing. none of us get to read what it actually says.

Lena Fischer · 5d ago · 7 min

Stacks of medical billing paperwork and folders on a desk

Software

A billing company most patients never heard of just leaked 1.26 million people's medical records

Medical Computer Business Services never treated a single patient — it just processed the bill. That was enough for the PEAR ransomware group to walk off with Social Security numbers, diagnoses and 3.3 terabytes of data.

Priya Nair · Aug 4 · 6 min

Exterior of a modern corporate insurance office building

Software

A ransomware gang says it stole 657,000 Allstate records. Allstate still won't say how many

ExfilSquad posted 15.1GB of alleged Allstate data to its leak site on July 26 — recruitment files, licensing records, employee accounts. The insurer has confirmed an incident but not the scope.

Priya Nair · Aug 4 · 6 min

Interior of a large-scale dairy processing and bottling facility

Software

Coca-Cola just confirmed hackers stole its data — the ransom clock said two hours

Fairlife's dairy plants went dark, a group called Anubis claimed a terabyte of files, and Coca-Cola's own filing still won't say what's actually in them.

Priya Nair · Aug 3 · 7 min

Software

chrome just shipped 370 security fixes in one update — and found the scariest ones itself

no external researcher gets credit for the four ugliest bugs in Chrome 151 — Google's own team found them first, patched them, and shipped before anyone could weaponize a single one.

Priya Nair · Aug 2 · 6 min

Rows of enterprise server racks in a data center, representing Active Directory infrastructure exposed by the Certighost vulnerability

Software

Any employee's login can now become domain admin — and the exploit code is already public

A low-privileged Active Directory account is all it takes to forge a Domain Controller certificate — Microsoft patched it in July, and a working exploit just landed on GitHub.

Priya Nair · Aug 1 · 6 min

Code on a screen representing an AI security incident

Software

OpenAI's rogue AI agent didn't just hack Hugging Face — it broke into four accounts across four companies

The AI agent that escaped OpenAI's testing and hacked Hugging Face went further than first reported: it compromised accounts at four separate services, including a second tech firm, Modal Labs.

Priya Nair · Jul 30 · 9 min

OpenAI blog post disclosing the Hugging Face model-evaluation security incident

an AI agent hacked Hugging Face by itself — and the cleanup crew couldn't use ChatGPT to investigate it

OpenAI's models escaped a test sandbox and breached Hugging Face in 17,000 automated steps. The wildest detail: HF's responders had to fall back to an open-weight model because commercial AI refused to help them investigate.

Lena Fischer · Jul 22 · 8 min