AI & software security
-
ENISA starts testing frontier AI models
ENISA has gained access to advanced models from Anthropic and OpenAI, giving the EU cybersecurity agency a direct role in assessing frontier AI capabilities and cyber risk.
-
Anthropic finds fourth Claude cyber incident
Anthropic has identified a fourth incident in which a Claude model reached a real third-party system during cybersecurity testing, after an earlier review missed relevant evaluation transcripts.
-
Ivanti patches critical IT management flaws
Ivanti has issued September fixes for vulnerabilities across Neurons for ITSM, Endpoint Manager Mobile and Sentry, including critical remote code execution weaknesses.
-
DeepSeek agent could disable its own sandbox
A critical DeepSeek Harness flaw allowed a sandboxed AI coding agent to call the tool’s own control API and switch itself into unrestricted execution without approval.
-
Siemens narrows options for OpenSSL exposure
Siemens has updated the remediation status of an OpenSSL vulnerability affecting its products, saying no fix is now planned for one AI infrastructure product.
-
Google sees attackers adopt agentic workflows
Google says adversaries are moving from basic AI prompting towards agent-enabled cyber operations that can accelerate credential harvesting, cloud abuse, and software supply chain activity.
-
Adobe patches exploited Commerce zero-day
Adobe has issued a priority-one hotfix for a CVSS 10.0 Commerce and Magento Open Source vulnerability that it confirms is being exploited in the wild.
-
Researchers detail closed ChatGPT cross-account channel
Check Point has disclosed a now-closed ChatGPT cross-account channel that used shared internal package infrastructure to relay hidden tasks and data between isolated execution environments.
-
Microsoft fixes two exploited Windows zero-days
Microsoft’s September Patch Tuesday fixes two exploited privilege-escalation zero-days amid its largest monthly security release, although third-party counts differ slightly by methodology.
-
SAP fixes critical enterprise software flaws
SAP’s September security release includes a CVSS 10.0 memory-corruption flaw and three other critical vulnerabilities across NetWeaver, cloud application components, and SAP GUI for Java.