Microsoft has addressed a significant bug affecting the Windows Update Standalone Installer (WUSA) that prevented users from successfully installing critical security patches and feature updates. The issue, which caused installation failures across multiple Windows versions, has been resolved throug
Kazuar, a sophisticated .NET-based backdoor attributed to Russian APT group Secret Blizzard (formerly Turla), has undergone significant evolution since its discovery in 2017. Recent analysis reveals the malware has transformed into a highly modular espionage platform with plugin-based architecture,
A counterfeit Perplexity AI Chrome extension was discovered intercepting user search queries and address bar inputs, redirecting traffic through attacker-controlled domains. The malicious extension mimicked the legitimate Perplexity AI service, exploiting user trust to harvest browsing data and pote
Microsoft security researchers have uncovered a critical attack vector where threat actors poison Model Context Protocol (MCP) tool descriptions to manipulate AI agents into exfiltrating sensitive data. This novel technique exploits how AI agents interpret natural language instructions embedded in t
Salesforce has disabled the Klue competitive intelligence application from its AppExchange marketplace following reports of OAuth token abuse that potentially exposed sensitive customer data. The incident involved improper handling of authentication tokens, allowing unauthorized access to Salesforce
Organizations accumulate security debt by deferring vulnerability remediation, creating compounding risk over time. The most critical subset—exposed vulnerabilities accessible from the internet or within critical attack paths—demands immediate prioritization. This article examines how to identify, c
Microsoft has enhanced Defender’s detection capabilities to monitor abuse of the Remote Procedure Call (RPC) protocol, a communication mechanism frequently exploited by threat actors for lateral movement and privilege escalation. This update addresses a long-standing blind spot in Windows security m
Critical NGINX vulnerability CVE-2026-8711 lets remote attackers execute malicious code via heap overflow. Unauthenticated exploitation possible. Patch now.
Recent testing reveals that large language models (LLMs) consistently fail to validate factual accuracy, accepting completely fabricated data as legitimate input. Despite advanced prompting techniques, AI models demonstrate they’re fundamentally code-based systems with inherent limitations that cann
Grafana confirms unauthorized GitHub token breach — attackers downloaded codebase and attempted extortion. No customer data compromised.