OWASP Releases GenAI LLM Top 10 2026 \u2014 Prompt Injection Remains Number One Risk
Summary OWASP has released the 2026 edition of the GenAI LLM Top 10, a comprehensive list of the most critical security risks facing generative AI and large language model deployments.…
OpenAI\u2019s Next AI Model Astra Shows Cyber Performance Strong Enough to Trigger Pause
Summary OpenAI\u2019s next-generation AI model, designated “Astra,” demonstrated cyber offensive capabilities so advanced during internal testing that it triggered an internal safety pause before public release. The model\u2019s ability to…
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA
Summary Researchers have discovered novel attack vectors that can recover synced passkey private keys or bypass phishing-resistant multi-factor authentication (MFA), undermining one of the strongest defenses against credential theft attacks.…
Kimsuky Builds Offline AI Stack to Automate Phishing and Malware Development
Summary North Korean APT group Kimsuky has constructed an offline AI infrastructure to automate phishing campaign generation and malware development, marking a significant evolution in adversary emulation capabilities. The group\u2019s…
TrueConf Server Flaws Exploited to Install PhantomCore Backdoor \u2014 Supply Chain Compromise
Summary Threat actors have successfully exploited vulnerabilities in TrueConf\u2019s server infrastructure to replace legitimate client installers with the PhantomCore backdoor, representing a supply chain compromise of a widely deployed enterprise…
AI-Generated Patches Fail Half the Time \u2014 Critical Findings for Defensive Teams
Summary A comprehensive study examining over 6,000 AI-generated software patches has found that even when AI-generated patches “work” \u2014 meaning they resolve the targeted vulnerability \u2014 they introduce new bugs,…
Metabase SQL Zero-Day Exploited in Wild \u2014 Admin Access Without Authentication
Summary A critical zero-day vulnerability in Metabase, the popular open-source data analytics platform, is being actively exploited in the wild to gain administrative access without authentication. The vulnerability, assigned a…
Valve Notifies Steam Hardware Customers of a Data Breach
Summary Valve, the company behind the Steam gaming platform and Steam Deck hardware, has notified customers who purchased Steam hardware that a data breach has exposed their personal and payment…
North Carolina Ports Confirm Cyberattack Disrupting Operations
Summary North Carolina\u2019s port infrastructure has confirmed it was the target of a cyberattack that disrupted shipping and logistics operations. The port system \u2014 which handles a significant portion of…
LexisNexis Shuts Down Services After Suspicious Activity on Servers
Summary LexisNexis, one of the world\u2019s largest providers of legal, regulatory, and business information databases, proactively shut down its services after detecting suspicious activity on its servers. The decision to…