Recent testing reveals that large language models (LLMs) consistently fail to validate factual accuracy, accepting completely fabricated data as legitimate input. Despite advanced prompting techniques, AI models demonstrate they’re fundamentally code-based systems with inherent limitations that cann
Security researchers have discovered a critical zero-click vulnerability in Google’s Pixel 10 Visual Processing Unit (VPU) driver that allows attackers to gain root access with merely five lines of code. The exploit chain, dubbed “When a Door Closes, a Window Opens,” bypasses multiple security layer
Maine’s Office of the Attorney General temporarily suspended its data breach notification portal after discovering fraudulent breach filings claiming VRChat and Discord had exposed millions of user records. The incident exposed critical flaws in the state’s breach reporting system, including lack of
A former IT employee of a U.S. school district has been sentenced to jail for launching retaliatory cyberattacks against their previous employer. The attacks disrupted educational operations, compromised system integrity, and highlighted the significant insider threat posed by disgruntled former emp
A newly discovered attack technique called “Agentjacking” allows threat actors to hijack AI coding assistants and force them to execute malicious code from attacker-controlled servers. The attack exploits the autonomous nature of AI agents that can read files, execute commands, and make decisions wi
A Ukrainian national has pleaded guilty in U.S. federal court to participating in the notorious Conti ransomware operation, one of the most prolific cybercrime syndicates in recent history. Following his extradition, the defendant admitted to deploying ransomware, exfiltrating sensitive data, and fa
BugHunter, a new open-source bug bounty toolkit leveraging Claude AI and free AI providers, has been released to the security community. The tool automates vulnerability discovery, reconnaissance, and exploit generation workflows by integrating large language models into traditional security testing
A sophisticated Chinese APT group maintained unprecedented access to a target organization’s authentication infrastructure for ten years, allowing them to compromise an air-gapped network through hijacked authentication flows. The attackers embedded themselves so deeply within the identity and acces
A critical pre-authentication remote code execution (RCE) vulnerability chain has been discovered in Splunk Enterprise, allowing unauthenticated attackers to compromise systems and access sensitive database information. The exploit chain bypasses authentication mechanisms entirely, providing attacke
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Oracle PeopleSoft Enterprise PeopleTools to its Known Exploited Vulnerabilities (KEV) catalog, signaling active exploitation in the wild. The flaw, tracked as CVE-2022-21587, allows unauthenticated