Malicious npm Packages That Evade Defenses This is an impressive piece of malware . Its sophistication says nation-state to me, but there is no direct evidence and certainly no attribution. Tags: …
AI Security Roundup
Daily AI security roundup covering malware, vulnerabilities, defensive research, cloud risk, and incident response signals from trusted technical sources.
Friday Squid Blogging: Participatory Squid Dissection in October in Tennessee I feel like someone who reads this blog will want to go to this : > Families are invited to dive into the fascinating …
** Ravie Lakshmanan ** Sep 25, 2026 Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and …
** Swati Khandelwal ** Sep 24, 2026 Vulnerability / Mobile Security A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special …
** Ravie Lakshmanan ** Sep 25, 2026 Vulnerability / Email Security The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in …
ai-security
EN
Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data
A flaw in Cloudflare Containers let a paying customer read data that other customers’ containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday. …
Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. “At 18:31 UTC on September 24, 2026, Bitget’s security …
Security leaders keep debating whether AI will produce an entirely new class of cyberattack. The nearer change is quieter and already visible: AI has made a failed attack cheap to retry. The routine …
** Ravie Lakshmanan ** Sep 25, 2026 Malware / Social Engineering Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a …
ai-security
EN
ISC Stormcast For Monday, September 21st, 2026 https://isc.sans.edu/podcastdetail/10102, (Mon, Sep 21st)
ISC Stormcast For Monday, September 21st, 2026 <https://isc.sans.edu/podcastdetail/10102>
ai-security
EN
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
** Ravie Lakshmanan ** Sep 25, 2026 Malware / Supply Chain Attack Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after …
Microsoft Security Research published an interesting blog post " TerminalFix campaign deploys a reverse tunnel through multistage intrusion " about a malware campaign. The aspect that I want …
ai-security
EN
ISC Stormcast For Tuesday, September 22nd, 2026 https://isc.sans.edu/podcastdetail/10104, (Tue, Sep 22nd)
ISC Stormcast For Tuesday, September 22nd, 2026 <https://isc.sans.edu/podcastdetail/10104>
This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804 , that I and 14 others reported. This issue is an incomplete fix for …
Born out of academia and raised in corporate IT departments, the Security Assertion Markup Language (SAML) authentication protocol continues to be a staple in these organizations. However, it’s time …
Reverse-Engineering Flock Cameras Hackers captured a Flock camera and got a look (alternate link ) at the software: > While much of the automatic license plate reader’s (ALPR) most sensitive …
Three researchers at the security firm Hacktron used Anthropic’s Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal …
** Ravie Lakshmanan ** Sep 21, 2026 Malware / Social Engineering The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based “much smaller …
Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript . “ChainScript has appeared under multiple build names, …
** Ravie Lakshmanan ** Sep 21, 2026 Endpoint Security / Malware Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed to …
** Swati Khandelwal ** Sep 21, 2026 Data Privacy / Regulatory Compliance Google has been fined €403 million for breaking the EU’s data protection law, the GDPR, in the way three of its features …
ai-security
EN
⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
A browser. A plugin. A package. A login screen. Normal stuff. That is basically the problem this week. The trouble keeps showing up inside things people already trust: code that takes a bad turn, old …
Friday Squid Blogging: On Squid Egg Sacs Short essay about squid egg sacs. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog …
ai-security
EN
Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR
A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and …
The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 countries and siphoned funds or account credentials from over …