AI & software security
-
Switzerland plans post-quantum security centre
WISeKey, SEALSQ, and the Canton of Jura have signed an MoU for a proposed CHF40–60 million semiconductor and post-quantum cybersecurity centre.
-
Gemini accessed real firms during security test
Google’s Gemini accessed systems belonging to three real companies during a cybersecurity evaluation after an internet-enabled test environment blurred the boundary between simulated and real targets.
-
WordPress fixes Click2Shell theme-install flaw
WordPress 7.1.1 fixes a flaw allowing crafted links to trigger theme installation, while researchers showed how it can be chained with a second weakness to reach code execution.
-
npm malware shifts execution into runtime
An npm campaign hides malicious behaviour inside normal package execution, bypassing controls designed to block dangerous installation scripts.
-
Orkes Conductor RCE flagged as exploited
A pre-authentication remote-code-execution flaw in Orkes Conductor is being exploited, exposing infrastructure used to coordinate microservices, workflows, and AI agents.
-
Browser extensions can hijack AI agents
BragJack research shows ordinary browser extensions can interfere with AI assistants across five Chromium-based products, exposing a new trust boundary in agentic browsing.
-
TanStack compromise exposed CrowdSec repositories
CrowdSec says an OAuth token compromised through the TanStack supply chain incident was used to clone around 170 private repositories from a departing employee’s account.
-
Check Point patches root-level management flaw
Check Point has patched a critical stack overflow that can allow an unauthenticated remote attacker to run arbitrary code as root on security-management and logging systems.
-
MovieReaper spreads through compromised torrent archive
Kaspersky says attackers compromised a shared torrent-file repository, causing multiple trackers to distribute a new multi-stage malware framework to users and organisations across several European countries.
-
Nextcloud patches preview route to code execution
Nextcloud has patched a high-severity preview-processing flaw that can trigger a vulnerable ImageMagick component and create a route to arbitrary file writes and further server compromise.