2+ day, 18+ hour ago   (391+ words) The company says traditional defenses may no longer be sufficient as long-running AI agents can chain exploits and scale attacks using increasingly available open-weight models. Modern AI agents can operate for extended periods, retain knowledge across sessions, and build a…...

3+ day, 11+ hour ago   (445+ words) Security researchers at Proofpoint have named the kit “BlueMoon,” identifying its use by at least four distinct threat clusters since late August 2026, with the majority showing a suspected China nexus. The first confirmed use came from TA412, also known as Violet…...

3+ day, 14+ hour ago   (310+ words) A critical cross-site scripting vulnerability in the widely used MapLibre GL JS library could expose applications and an estimated 2.7 million users to zero-click attacks. This created an index-shifting condition: once an attribute was removed, the next attribute moved into its…...

3+ day, 14+ hour ago   (585+ words) Two critical flaws in ArangoDB can let an outsider bypass login controls, read or alter database data, and then gain root-level code execution on the underlying host. The attack does not rely on stolen passwords, a user click, or a…...

4+ day, 20+ hour ago   (428+ words) A critical security incident at Coder exposed users of its Terraform module registry to malicious packages designed to steal credentials from cloud development environments. According to Coder’s security advisory, the attacker added unauthorized IP addresses to the infrastructure pool used…...

5+ day, 18+ hour ago   (427+ words) Security researchers have uncovered a significant vulnerability chain in Telerik UI for ASP.NET AJAX, allowing unauthenticated attackers to execute remote code in vulnerable enterprise web applications. Progress Software has indicated that the flaw impacts versions from 2010.1.309 to 2026.2.519. The vulnerability…...

1+ week, 2+ day ago   (397+ words) A security researcher known as Nightmare-Eclipse, who also goes by the names Chaotic Eclipse and MSNightmare, has released a project that claims to take advantage of a security flaw in the CrowdStrike Falcon Sensor. This flaw allows for local privilege…...

1+ week, 3+ day ago   (436+ words) Google has unveiled Gemini 3.8, its latest reasoning and coding model family, introducing a specialized variant called Gemini 3.8 Flash Cyber that is purpose-built to autonomously discover software vulnerabilities and generate working patches for them. The release arrives just three weeks after…...

1+ week, 3+ day ago   (483+ words) A newly disclosed class of vulnerabilities, dubbed GitSpawn, allows a booby-trapped repository to silently execute code on a developer’s machine the moment it is opened with an AI coding agent, no prompt typed, no approval clicked, and in some cases…...

1+ week, 3+ day ago   (383+ words) FreeRDP released version 3.31.0, addressing 22 security flaws and multiple bugs in its open-source Remote Desktop Protocol implementation, and urges users and distributors to update promptly. FreeRDP is widely used by Linux systems, thin clients, remote-access tools, and enterprise applications to connect…...