AI & software security
-
Mistral releases adaptable AI safety model
Mistral has released a three-billion-parameter safety classifier that applies natural-language policies to text and images without retraining the underlying model.
-
AvePoint links data classification to recovery
AvePoint is linking continuously updated sensitivity classification with sequenced recovery, although its new Kinetic Classification capability remains in private preview.
-
ChainDrop worm compromises 400 npm packages
A self-propagating credential-stealing worm has reached more than 400 npm packages, turning compromised publishing identities into a mechanism for further software supply chain infection.
-
Open VSX removes 77 counterfeit extensions
Open VSX has removed 77 extensions that impersonated legitimate developer tools and transmitted system, repository, and continuous-integration metadata to shared infrastructure.
-
CrowdStrike sees exploitation within 48 hours
CrowdStrike says 88% of the exploitation it observed involving vulnerabilities with public proof-of-concept code occurred within two days of release.
-
Passkey research exposes endpoint attack paths
Unit 42 has demonstrated how malware on a Windows endpoint could misuse Google-synchronised passkeys without breaking the cryptography underlying WebAuthn.
-
DNA software flaw exposes file integrity risk
Thermo Fisher has patched a high-severity weakness that could permit nearly undetectable modification of human-identification data files, while three unsupported products will receive no update.
-
ICO monitors AI agents reaching external systems
Britain’s data regulator is monitoring incidents in which OpenAI and Anthropic systems reached external organisations during cyber evaluations.
-
5G core flaws expose inherited trust
Researchers found 84 previously unknown vulnerabilities across seven open-source cellular cores, including weaknesses capable of denial of service and session hijacking.
-
Arch Linux freezes AUR changes
Arch Linux disabled package adoption and later all pushes to its user repository while responding to malicious package takeovers and follow-on commits.