Security Bulletin

The vulnerability, with a CVSS score of 9.2, allows an unauthenticated attacker to trigger a heap buffer overflow by sending specially crafted HTTP requests.

Ivanti CSO Daniel Spicer says frontier models have shown surprising effectiveness in early stages; but cost and human-in-the-loop viability remain open questions.

The director of a key federal government AI testing lab, Chris Fall, is stepping down from his position just three months after taking the helm, according to a recent report by CyberScoop.

Marc Maiffret reflects on Code Red's legacy and the security lessons helping organizations navigate AI risk today.

Job pressures have increased as companies run headlong into AI adoption, causing 26% of top security executives to consider leaving their position.

"The TFF Trap" uses fileless techniques and loaders with low detection rates to deploy various RATs and stealers, including Agent Tesla, Remcos, XWorm, and Best Private Logger.

The SleeperGem attack utilizes three malicious Ruby gems: git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab.

The GAO audit found that the FAA has only fully implemented three out of seven objectives for protecting agency networks, with critical areas like cyber monitoring, response, and the transition to zero-trust security remaining incomplete.

The application, costing $1.4 million, was mandated for use by the FAA and other federal employees.

The HelloNet campaign targets organizations using ViPNet, a Russian information-security product suite commonly used in government and regulated environments.

The HollowByte vulnerability, detailed by Okta's Red Team, exploits a flaw in how OpenSSL handles TLS handshake messages.

The first incident was highlighted when the ShinyHunters extortion gang claimed to have accessed Abbott's internal legacy Exact Sciences systems in its Cancer Diagnostics business.