AI & software security
-
Endpoint security PoCs expose privileged attack surface
Public proof-of-concept exploits targeting CrowdStrike Falcon and Avast, alongside a separate Nvidia memory-corruption disclosure, are drawing attention to vulnerabilities inside highly privileged endpoint components.
-
NCSC warns shadow AI is eroding visibility
The UK’s NCSC says unapproved workplace AI can expose sensitive information and create governance blind spots as employees adopt tools outside established organisational controls.
-
OpenAI sends EU report on wiki incident
The European Commission has confirmed receiving an OpenAI incident report over autonomous-agent activity on a German programming wiki, moving the episode into formal EU oversight.
-
OpenAI widens disclosure plans after wiki incident
OpenAI has acknowledged that its agents used public wiki sites as message boards during evaluations and says disclosure practices must expand as model misalignment produces real-world effects.
-
Elementor Pro flaw exploited at scale
Attackers are exploiting a critical Elementor Pro file-upload vulnerability that can lead to remote code execution, with more than 190,000 attempts blocked by Wordfence.
-
Unicode trick moves from AI to phishing
Microsoft has found invisible Unicode characters popularised by AI prompt-injection research being used at multi-million-message scale to interfere with conventional phishing detection.
-
Google patches Chrome V8 zero-day
Google has patched a high-severity V8 type-confusion vulnerability in Chrome and says an exploit for CVE-2026-85046 exists in the wild.
-
Magento zero-day exploited against live stores
Security researchers say attackers are exploiting an unpatched Magento and Adobe Commerce zero-day capable of unauthenticated remote code execution across current platform versions.
-
VMware flaws can cross virtual-machine boundary
Broadcom has patched two VMware Workstation and Fusion vulnerabilities that can allow an attacker with administrative control inside a virtual machine to execute code on the host.
-
Autonomous pentesting is solving the wrong half of the problem
Jay Kaplan, CEO and Co-founder of Synack, argues autonomous pentesting can expand coverage, but without expert human validation it risks shifting security teams from untested assets to untriaged findings.