AI & software security
-
NCSC sets seven research priorities for AI in cyber defence
The UK NCSC has published seven research questions on AI in cyber security, covering autonomous defence, agent assurance, AI dependencies and national resilience. The new chapter is a research agenda, not a compliance standard.
-
WhatsApp help pages exposed hidden AI instructions on privacy complaints
Hidden directions for WhatsApp’s AI support bot appeared in 80 help pages, including restrictions on referring users to privacy regulators. Meta says a bug exposed the text; researchers did not establish whether the chatbot followed it.
-
Compromised UpdraftCentral keys used to install WordPress backdoors
Attackers used valid UpdraftCentral management keys to install malicious plugins on two Nethemba websites and attempted a third. TeamUpdraft separately reported access to its customer site and possible exposure of remote management credentials.
-
OVHcloud CLI downloads replaced with credential-stealing binaries
OVHcloud has confirmed that attackers replaced downloadable binaries for five versions of its command-line utility. The French provider removed the affected files and issued version 0.16.0, while customers assess possible exposure of local credentials.
-
PHP warns of two critical flaws ahead of 21 October security release
PHP has warned of two critical vulnerabilities rated CVSS v4.0 9.2 and scheduled security fixes for 21 October at 14:00 UTC. The advance notice does not establish technical exploit conditions, affected builds or active exploitation.
-
Microsoft expands controls for enterprise AI agents
Microsoft has outlined new identity, permission, and containment capabilities intended to restrict AI agents as their behaviour and operating context change.
-
AI agents used in large website intrusion campaign
Research into a campaign involving more than 100 websites indicates that an attacker used AI agents to automate substantial parts of intrusion activity at relatively low cost.
-
OpenCode breach exposes AI service credentials
OpenCode has notified some users that API keys connected to external AI providers were exposed during a breach associated with a large-scale model distillation attack.
-
UK advisers call for AI sovereignty strategy
Government science advisers have recommended a coordinated UK AI sovereignty plan that would address dependence on external AI technology while supporting resilience and domestic capabilities.
-
Roundcube fixes webmail security vulnerabilities
Roundcube has released security updates addressing command injection, request forgery, content filtering, session handling, and attachment-processing weaknesses across its supported webmail branches.