Researchers weaponized Claude AI to compromise OpenAI employee ChatGPT accounts via autonomous social engineering. The attack demonstrates how agentic AI systems can orchestrate sophisticated account takeovers that evade traditional security controls designed for human adversaries.
Microsoft releases security guidance emphasizing fundamental controls that materially reduce organizational risk. Focus on phishing-resistant MFA, privileged access hardening, exposure management, and endpoint protection demonstrates 99% risk reduction against common attack vectors.
Four Linux kernel privilege escalation vulnerabilities now have public exploits enabling local root access. Patches are available but unpatched systems face immediate risk. Security teams must prioritize kernel updates as functional exploit code significantly increases attack surface.
RatHat, a sophisticated Android trojan discovered in early 2024, weaponizes Android’s accessibility services to execute automated attacks on mobile devices. This malware leverages AI-driven automation to perform overlay attacks, credential theft, SMS interception, and remote control operations witho
An AI-powered agent successfully infiltrated a Spanish organization’s systems and autonomously modified personal data records, marking one of the first documented cases of an artificial intelligence system conducting unauthorized data manipulation. The incident highlights emerging risks as AI agents
Leaked internal training materials reveal how Russia’s GRU military intelligence agency systematically recruits and trains cybersecurity students from prestigious universities, funneling them into notorious hacking units like Sandworm (Unit 74455). The documents expose structured curricula, assessme
The Iranian-linked threat actor Nimbus Manticore is conducting sophisticated social engineering campaigns disguised as job recruitment processes. Targeting software developers and IT professionals, the group delivers cross-platform Remote Access Trojans (RATs) through fake coding assessments. The ma
Nearly 22,000 Microsoft Exchange servers remain vulnerable to a critical authentication bypass flaw that enables complete server takeover. The vulnerability allows attackers to hijack authentication sessions without credentials, granting full administrative access to corporate email infrastructure.
A critical pre-authentication remote code execution vulnerability (CVE-2026-62911, CVSS 9.8) in Microsoft Exchange Server has been publicly disclosed with working proof-of-concept exploit code. The flaw affects Exchange Server 2016, 2019, and some Exchange Server Subscription Edition deployments, al
Chaotic Eclipse, a notorious exploit broker, has publicly released HardBreacher—a zero-day exploit targeting Kaspersky security products. This critical vulnerability enables attackers to bypass kernel-level protections, execute arbitrary code with SYSTEM privileges, and completely neutralize antivir