Security Bulletin

The Athena coalition, led by Chainguard, will leverage artificial intelligence to proactively address vulnerabilities in open source code.

Adversaries could plant a malicious repository that can execute arbitrary code and steal cloud credentials by exploiting the vulnerability, which showcases growing MCP risk.

By fighting AI with AI, teams can stay one step ahead in the great innovation race.

Rising threats from third-party actors are forcing institutions to play defense to protect student data from ransomware and other attacks.

One of the flaws, DirtyClone, is a variant of the DirtyFrag vulnerability class.

The operation, a collaboration between Poland's Cybercrime Bureau (CBZC) and U.S. agencies including the FBI and Homeland Security Investigations, targeted a group accused of breaching telecommunications partners and hijacking email accounts.

CL-STA-1062 employs a hybrid toolkit, combining open-source tools like SoftEther VPN, Mimikatz, and VNT with a newly discovered custom backdoor named TinyRCT.

As outlined in CyberScoop, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has canceled a contract with Penlink that utilized ad-surveillance technologies to track Americans' locations.

STOCKSTAY, written in .NET and utilizing the Windows Forms framework, communicates with its command-and-control (C2) server via a secure WebSocket connection.

The attack exploited a zero-day vulnerability in Oracle PeopleSoft, an enterprise resource planning software.

The cyberattack on Jaguar Land Rover (JLR), a major UK employer, caused production to halt for months, resulting in an estimated $2.5 billion loss to the British economy and necessitating a £1.5 billion government bailout.