AI & software security
-
Tenable patches critical Security Center flaws
Tenable has issued stand-alone patches for Security Center and Enclave Security vulnerabilities, including a critical authenticated remote-code execution flaw rated 9.9 under CVSS v3.1.
-
ChatGPT enters EU’s toughest DSA tier
The European Commission has designated ChatGPT as a Very Large Online Search Engine, bringing the service into the Digital Services Act’s enhanced systemic-risk and oversight regime.
-
Missed TeamCity patch exposed JetBrains Cadence
JetBrains says attackers exploited an unpatched TeamCity vulnerability in its Cadence service, exposing customer data, cloud identities, and credentials contained in an older server backup.
-
ServiceNow fixes three maximum-severity flaws
ServiceNow has patched three AI Platform vulnerabilities rated CVSS 10.0 that can expose instance data, enable privilege escalation, or permit arbitrary database operations without authentication.
-
Cursor enters European cyber intrusions
Recovered chat logs show a ransomware operator using Cursor during attacks affecting European organisations, with researchers documenting repeated attempts to bypass the coding agent’s safety controls.
-
Unit 42 finds AI malware mostly experimental
Unit 42 says only a small fraction of more than 400 AI-associated malware samples in its study appeared on production endpoints, underscoring a gap between research artefacts and operational attacks.
-
OpenAI disrupts Russia-origin influence campaign
OpenAI has banned accounts it says very likely originated in Russia and were used to support an elaborate but relatively low-reach covert influence campaign.
-
TRACE targets verifiable AI runtime evidence
The Linux Foundation has taken governance of TRACE, an open specification designed to produce hardware-attested evidence about the runtime behaviour and compliance of AI workloads.
-
Gitea flaw moves into active exploitation
CISA has added a Gitea code-injection flaw to its exploited-vulnerability catalogue, weeks after the self-hosted Git platform released a fix.
-
Oracle flaw moves into active exploitation
A critical Oracle HTTP Server and WebLogic proxy vulnerability first patched in January is now confirmed as actively exploited and has entered CISA’s priority catalogue.