AI Security Roundup

** Jan 13, 2026 ** Ravie Lakshmanan Vulnerability / Network Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a high-severity security flaw …

ISC Stormcast For Tuesday, January 13th, 2026 https://isc.sans.edu/podcastdetail/9764

** Jan 12, 2026 ** Ravie Lakshmanan Vulnerability / Workflow Automation Threat actors have been observed uploading a set of eight packages on the npm registry that masqueraded as integrations …

** Jan 12, 2026 ** Ravie Lakshmanan Hacking News / Cybersecurity This week made one thing clear: small oversights can spiral fast. Tools meant to save time and reduce friction turned into easy entry …

A new wave of GoBruteforcer attacks has targeted databases of cryptocurrency and blockchain projects to co-opt them into a botnet that’s capable of brute-forcing user passwords for services such …

Corrupting LLMs Through Weird Generalizations Fascinating research: Weird Generalization and Inductive Backdoors: New Ways to Corrupt LLMs . Abstract LLMs are useful because they generalize so well. …

Cybersecurity researchers have shed light on two service providers that supply online criminal networks with the necessary tools and infrastructure to fuel the pig butchering-as-a-service (PBaaS) …

** Jan 12, 2026 ** Ravie Lakshmanan Artificial Intelligence / Healthcare Anthropic has become the latest Artificial intelligence (AI) company to announce a new suite of features that allows users of …

ISC Stormcast For Monday, January 12th, 2026 https://isc.sans.edu/podcastdetail/9762

YARA-X’s 1.11.0 release brings a new feature: hash function warnings. When you write a YARA rule to match a cryptographic hash (either the full file content or a part of it), what’s …

** Jan 10, 2026 ** Ravie Lakshmanan Cyber Espionage / Malware The Iranian threat actor known as MuddyWater has been attributed to a spear-phishing campaign targeting diplomatic, maritime, financial, …

** Jan 10, 2026 ** Ravie Lakshmanan Cybercrime / Financial Crime Europol on Friday announced the arrest of 34 individuals in Spain who are alleged to be part of an international criminal organization …

Friday Squid Blogging: The Chinese Squid-Fishing Fleet off the Argentine Coast The latest article on this topic. As usual, you can also use this squid post to talk about the security stories in the …

** Jan 09, 2026 ** Ravie Lakshmanan Virtualization / Vulnerability Chinese-speaking threat actors are suspected to have leveraged a compromised SonicWall VPN appliance as an initial access vector to …

** Jan 09, 2026 ** Ravie Lakshmanan Email Security / Threat Intelligence Russian state-sponsored threat actors have been linked to a fresh set of credential harvesting attacks targeting individuals …

Palo Alto Crosswalk Signals Had Default Passwords Palo Alto’s crosswalk signals were hacked last year. Turns out the city never changed the default passwords . Tags: hacking , infrastructure , …

** Jan 09, 2026 ** The Hacker News Artificial Intelligence / Enterprise Security As organizations plan for 2026, cybersecurity predictions are everywhere. Yet many strategies are still shaped by …

** Jan 09, 2026 ** Ravie Lakshmanan Vulnerability / Endpoint Security Trend Micro has released security updates to address multiple security vulnerabilities impacting on-premise versions of Apex …

** Jan 09, 2026 ** Ravie Lakshmanan Government / Vulnerability Management The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday said it’s retiring 10 emergency directives …

Reverse engineers must have a good understanding of the environment where malware are executed (read: the operating system). In a previous diary, I talked about malicious code that could be executed …

** Jan 09, 2026 ** Ravie Lakshmanan Mobile Security / Email Security The U.S. Federal Bureau of Investigation (FBI) on Thursday released an advisory warning of North Korean state-sponsored threat …

ISC Stormcast For Friday, January 9th, 2026 https://isc.sans.edu/podcastdetail/9760

In yesterday’s podcast, I mentioned “tailsnitch”, a new tool to audit Tailscale configurations. Tailscale is an easy-to-use overlay to Wireguard. It is probably best compared to STUN …

ISC Stormcast For Wednesday, January 7th, 2026 https://isc.sans.edu/podcastdetail/9756

Malicious use of QR codes has long been ubiquitous, both in the real world as well as in electronic communication. This is hardly surprising given that a scan of a QR code can lead one to a phishing …