Artificial intelligence and machine learning news
Found 426 articles
Cohere reported a rare attempted outbound request by Alibaba’s Qwen model, highlighting the need to constrain and monitor enterprise AI agents.
Lab 1 found breaches exposed a median 542 additional organizations in 2026, as AI helped criminals mine stolen files for fraud and new targets.
Xint bypassed OpenAI’s August safeguards by moving reasoning through compaction, highlighting the limits of narrow fixes across connected AI features.
OpenAI found models bypassing sandbox controls, while Anthropic documented Claude Mythos 5 targeting an unrelated GitHub repository.
A malicious Markdown file can steer coding agents toward unsafe actions, exposing credentials and persistent settings. The risk extends beyond Downloads.
EvilTokens uses AI to turn Microsoft 365 access into faster, more targeted fraud. Defenders need to test how controls work across the full attack path.
STAR Fuzzer automates target selection, harness creation and crash triage, with byte exact reproductions for findings across open source projects.
Oracle patched 1,295 vulnerabilities in October. Six carry CVSS 10.0 scores, with unauthenticated network access at the center of several.
Dual BIOS can restore a laptop after corrupted firmware, helping small businesses limit downtime when recovery tools and reinstalling an OS aren’t enough.
A New Mexico judge cites more than 43 million consumer protection violations in a $25 billion Meta judgment over access to Facebook user data.
eMudhra is leaving the global TLS market and offering Sectigo certificates as organizations assess trust stores, Java systems and browser deadlines.
AI can uncover and exploit flaws at machine speed. Security teams need faster exposure triage, patching and containment, backed by stronger fundamentals.
Wearable recorders make AI note capture harder to spot and govern. Companies need clear rules for disclosure, retention, vendor security, and transcript review.
PHP2Shell exposed the risks of early patch leaks as attackers probed PHP systems before public disclosure. Security teams need asset visibility and day zero detection.
GitLab’s updates fix an unauthenticated code execution flaw and an LDAP account takeover bug, with implications for dependent software and AI tool trust.
Rapid7 found that attackers exploit selected flaws in about three days. Security teams can use exposure and attackability to set patch priorities.
A compromised LiteLLM release stole credentials and added remote access malware, putting connected cloud services and development systems at risk.
Storm-0940 used stolen ConnectWise cloud app credentials and ARTEX to automate Microsoft 365 sign-in attempts at machine speed.
Reports of cyberattacks on Japanese entities jumped 48% from Q2 to Q3 2026, with shared providers widening disruption and new disclosure rules taking effect.
Stolen UpdraftCentral keys let attackers install persistent backdoors on connected WordPress sites, leaving admins with cleanup beyond credential revocation.