Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial …
AI Security Roundup
Daily AI security roundup covering malware, vulnerabilities, defensive research, cloud risk, and incident response signals from trusted technical sources.
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with …
Friday Squid Blogging: Squid on a Stick at the New York State Fair Looks tasty . As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog …
Automobile Camouflage to Hide from Flock Cameras Not sure it’s practical, but it’s certainly striking . Tags: AI , cars , privacy , surveillance Posted on September 7, 2026 at 7:06 AM • 25 Comments
Stealing AI Reasoning Traces Interesting research: “ Stealing Reasoning Traces from Proprietary LLM APIs “: > Abstract: > Leading large language model providers now conceal their models’ …
Claude Fable Solves a Historical Cipher Claude Fable 5.1 solved a 370-year-old cipher in forty-four minutes. This tracks with what I wrote about AIs doing mathematics: It’s good at things that involve …
AIs as Modern Genies This essay was written with Barath Raghavan, and originally appeared in Lawfare . In April, an artificial intelligence (AI) agent conducting a routine task at a company hit a …
Driver’s License Data for Sale A database of 153 million drivers licenses is for sale on the dark web. Brian Krebs has more detail . Tags: cars , dark web , data breaches , databases Posted on …
U.S. cybersecurity and intelligence agencies have accused China-based artificial intelligence (AI) companies of conducting “systematic extraction” of proprietary functionalities and …
** Ravie Lakshmanan ** Sep 09, 2026 Vulnerability / Browser Security Google on Tuesday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in …
A flaw in DeepSeek Harness , DeepSeek’s open-source tool for running AI coding agents on a developer’s machine, let a sandboxed agent turn off its own sandbox with a single command. The …
Bitcoin wallet company Alby has warned of a critical flaw in Alby Hub that could have let an attacker take over a wallet and send its funds, but only where the owner had made the Hub reachable from …
** The Hacker News ** Sep 09, 2026 Security Operations / Artificial Intelligenc A major vulnerability is disclosed. The alert lands immediately. Then comes the harder question: Are we actually …
Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create “stolen keys” that grant illicit access to tools from model providers like …
Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows …
The U.S. Department of Justice (DoJ) on Wednesday announced coordinated actions aimed at an illicit online marketplace called Xinbi Guarantee that offered scam services, including seizing Telegram …
We found and reported a bug in Provenance Blockchain, a public proof-of-stake chain built on Cosmos SDK , that lets any user grant themselves admin control over marker accounts without holding a …
Black Hat State of Security Vendors Andy Ellis has a roundup of the security vendors at Black Hat this year. > Key Takeaways: We have entered into an AI world. While nearly half of booths didn’t …
** The Hacker News ** Aug 25, 2026 Attack Surface Management Vulnerability management has been a staple of security programs since the dawn of the cybersecurity discipline. The symbiotic relationship …
Cybersecurity researchers are calling attention to a new campaign that employs FTP banners as dead drop resolvers ( DDRs ) to deliver two previously unreported remote access trojans (RATs) tracked as …
** Ravie Lakshmanan ** Aug 25, 2026 Vulnerability / Web Security Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign …
** Ravie Lakshmanan ** Aug 25, 2026 Phishing / Threat Intelligence Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing …
ai-security
EN
WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android
** Ravie Lakshmanan ** Aug 25, 2026 Authentication / Password Security Meta on Tuesday announced a set of WhatsApp account security features, including support for multiple passkeys to a single …
Thousands of companies have been affected by the Mirage2FA campaign from 2024 to 2026. The commercial phishing-as-a-service toolkit targets Microsoft 365 accounts by abusing legitimate login flows and …
** Swati Khandelwal ** Aug 25, 2026 Vulnerability / AI Security Marimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied …