The European Union Council has announced sanctions against three entities and two individuals for their involvement in cyberattacks targeting critical infrastructure in the region. […]
AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE
Cybersecurity researchers have disclosed details of a new method for exfiltrating sensitive data from artificial intelligence (AI) code execution environments using domain name system (DNS) queries.
In a report published Monday, BeyondTrust revealed that Amazon Bedrock AgentCore Code Interpreter’s sandbox mode permits outbound DNS queries that an attacker can exploit to enable interactive shells
In a report published Monday, BeyondTrust revealed that Amazon Bedrock AgentCore Code Interpreter’s sandbox mode permits outbound DNS queries that an attacker can exploit to enable interactive shells
Tech Giants Invest $12.5 Million in Open Source Security
Anthropic, AWS, Google, Microsoft, and OpenAI fund the Linux Foundation’s long-term security initiatives focused on open source software.
The post Tech Giants Invest $12.5 Million in Open Source Security appeared first on SecurityWeek.
UK Companies House Exposed Details of Millions of Firms
The government agency confirmed the vulnerability could have been exploited to obtain company details and alter records.
The post UK Companies House Exposed Details of Millions of Firms appeared first on SecurityWeek.
LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader
The ransomware operation known as LeakNet has adopted the ClickFix social engineering tactic delivered through compromised websites as an initial access method.
The use of ClickFix, where users are tricked into manually running malicious commands to address non-existent errors, is a departure from relying on traditional methods for obtaining initial access, such as through stolen credentials
The use of ClickFix, where users are tricked into manually running malicious commands to address non-existent errors, is a departure from relying on traditional methods for obtaining initial access, such as through stolen credentials
Surf AI Raises $57 Million for Agentic Security Operations Platform
The company has announced its launch, backed by funding from Accel, Cyberstarts, and Boldstart Ventures.
The post Surf AI Raises $57 Million for Agentic Security Operations Platform appeared first on SecurityWeek.
Top 5 Things CISOs Need to Do Today to Secure AI Agents
AI agents are autonomous actors with real access to data and systems, not just copilots. Token Security explains why identity-based access control is critical to prevent misuse and data exposure. […]
New font-rendering trick hides malicious commands from AI tools
A new font-rendering attack causes AI assistants to miss malicious commands shown on webpages by hiding them in seemingly harmless HTML. […]
Microsoft stops force-installing the Microsoft 365 Copilot app
Microsoft has stopped automatically installing the Microsoft 365 Copilot app on Windows devices outside the European Economic Area (EEA) that have the Microsoft 365 desktop client apps. […]
Robotic Surgery Giant Intuitive Discloses Cyberattack
The company says some of its internal business applications were accessed after an employee fell victim to a phishing attack.
The post Robotic Surgery Giant Intuitive Discloses Cyberattack appeared first on SecurityWeek.