AI Security Roundup

** Ravie Lakshmanan ** Oct 03, 2026 Cyber Espionage / Artificial Intelligence The U.K.’s domestic intelligence and security agency has warned that more than 100 academics have helped China boost …

ISC Stormcast For Friday, October 2nd, 2026 <https://isc.sans.edu/podcastdetail/10120>

Multihashing is one of those cryptographic tasks that’s easy not to think about too much. This is unfortunate, because multihashing is a common stumbling point when cryptographers try to use hashes. …

How American Political Campaigns Are Using AI—and What They’re Spending on the Tools This essay was written with Nathan E. Sanders, and originally appeared in The Guardian . New campaign finance …

Unidentified Flock Cameras in Florida St. Lucie County in Florida discovered ( alt link ) a dozen Flock cameras whose ownership it can’t identify, and that the county government had not permitted. I …

Friday Squid Blogging: EU is Trying to Fight Unregulated Squid Fishing The EU is recommending import controls to combat unregulated squid fishing in the Southwest Atlantic. I’m not optimistic. As …

** Ravie Lakshmanan ** Oct 02, 2026 Vulnerability / Enterprise Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet …

** Ravie Lakshmanan ** Oct 02, 2026 Mobile Security / Android Google has announced a new security measure that limits access to Android’s accessibility services to verified applications …

The quarterly board meeting is two weeks out. The security team is pulling exports from the identity provider, the cloud posture tool, the vulnerability scanner, the SIEM and the EDR console. Someone …

OpenAI has parted ways with three members of its safety team after they leaked private information in violation of company policies, The Wall Street Journal reported . “We have parted ways with …

** Swati Khandelwal ** Oct 02, 2026 Vulnerability / Application Security A critical flaw in GitLab’s AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the …

** Ravie Lakshmanan ** Oct 02, 2026 Vulnerability / Cloud Security Dell has released security updates to address multiple critical security flaws in Dell Container Storage Modules (CSM) that could be …

Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The activity, which has targeted government and policy …

ISC Stormcast For Thursday, October 1st, 2026 <https://isc.sans.edu/podcastdetail/10118>

Threat Actors do not always use top-notch techniques or very complex malware to perform their attacks. Sometimes, they just abuse of existing applications… I received a very simple phishing …

I Want Better Reporting on AI Genie Behavior AI systems are regularly completing tasks in ways that their prompters don’t want or intend. Some of them are disturbing, and some of them are dangerous. …

Connected Cars Are a Surveillance Platform Researchers at Northeastern University, in collaboration with Consumer Reports , evaluated how much modern cars spy in their drivers: > The new …

Security researchers have published the first public proof-of-concept for CVE-2026-86950 , an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals. …

** Ravie Lakshmanan ** Oct 01, 2026 Artificial Intelligence / Vulnerability OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly …

** Ravie Lakshmanan ** Oct 01, 2026 Artificial Intelligence / AI Safety Google on Wednesday announced its latest frontier artificial intelligence (AI) model, Gemini 4 Argon , that it said is being …

** Ravie Lakshmanan ** Oct 01, 2026 Vulnerability / Network Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting …

** Ravie Lakshmanan ** Oct 01, 2026 Vulnerability / Web Security Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to …

Every security leader at a bank, insurer, or asset manager has had a version of this conversation: Security wants to eliminate a class of vulnerabilities. Engineering explains what it would take to …

** Ravie Lakshmanan ** Oct 01, 2026 Hacking News / Cybersecurity News This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an …

Police in Spain have arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on …