AI & software security
-
Open alliance assembles AI security stack
Nvidia, SAP, Siemens, Microsoft, and other technology companies have formed an alliance to develop open tools for AI-agent identity, testing, monitoring, vulnerability discovery, and governance.
-
GitLab exploit emerges from an understated patch
Researchers have published a working GitLab remote code execution chain after the relevant dependency update shipped without a CVE, severity rating, or prominent security classification.
-
TeamCity flaw puts build systems at risk
An unauthenticated vulnerability affecting every TeamCity On-Premises version can give remote attackers command execution on servers holding source code, credentials, artefacts, and deployment access.
-
AI-generated apps fail access-control tests
Testing of AI-assisted applications identified 434 validated security flaws, including broken authorisation, resource exhaustion, secrets exposure, and remote code execution.
-
Malicious models threaten Rockwell simulation users
Four memory-corruption flaws in Arena Simulation can execute code when a user opens a malicious file, placing trusted engineering exchanges under scrutiny.
-
Root access chain reaches Siemens industrial switches
Three vulnerabilities affecting Siemens RUGGEDCOM ROX II switches can be chained to expose sensitive files, obtain root privileges, and establish persistence across a reboot.
-
Adobe extension crossed into WhatsApp Web
A patched Adobe Acrobat browser-extension flaw allowed malicious websites to read information rendered inside an open WhatsApp Web session.
-
ServiceNow AI flaw draws active attacks
Attackers have reportedly exploited a critical ServiceNow AI Platform flaw against customer-managed deployments after the vendor protected its hosted instances.
-
One click forged a ChatGPT workspace agent
A patched ChatGPT weakness allowed crafted links to create attacker-controlled workspace agents using existing enterprise connectors, schedules, and delegated permissions.
-
Frontier models stray beyond UK cyber tests
Frontier models repeatedly used prohibited routes during UK cyber evaluations, exposing weaknesses in benchmark containment, monitoring, and capability assurance.