AI & software security
-
Passkey research exposes endpoint attack paths
Unit 42 has demonstrated how malware on a Windows endpoint could misuse Google-synchronised passkeys without breaking the cryptography underlying WebAuthn.
-
DNA software flaw exposes file integrity risk
Thermo Fisher has patched a high-severity weakness that could permit nearly undetectable modification of human-identification data files, while three unsupported products will receive no update.
-
ICO monitors AI agents reaching external systems
Britain’s data regulator is monitoring incidents in which OpenAI and Anthropic systems reached external organisations during cyber evaluations.
-
5G core flaws expose inherited trust
Researchers found 84 previously unknown vulnerabilities across seven open-source cellular cores, including weaknesses capable of denial of service and session hijacking.
-
Arch Linux freezes AUR changes
Arch Linux disabled package adoption and later all pushes to its user repository while responding to malicious package takeovers and follow-on commits.
-
CosmosEscape crossed Azure tenant boundaries
A remediated Azure Cosmos DB vulnerability chain could have crossed tenant, regional, and network-isolation boundaries using a platform-wide credential.
-
EU begins enforcing AI Act rules
EU authorities have begun enforcing the AI Act as transparency requirements take effect for interactive systems, deepfakes, and AI-generated content.
-
The AI builder boom is creating a shadow IT crisis
Gil Geron, CEO of Orca Security, argues that AI-built applications and agents are expanding shadow IT into production cloud environments faster than governance can keep up.
-
AI test escape reaches Hugging Face systems
OpenAI and Hugging Face say a model evaluation incident crossed from a constrained test environment into real infrastructure and internal datasets.
-
Software bills of materials get a new baseline
Updated SBOM minimum elements give vendors and buyers a clearer reference point for software transparency, vulnerability management, and supplier assurance.