Lucian Constantin

The company — whose recent vulnerabilities have been hit with zero-day and n-day exploits — also released three patches for flaws in FortiOS and FortiAP.

An LLM-powered system found 4 security bugs, including a critical one in the web server's URL rewrite module.

Attackers performed an email takeover attack on a dormant maintainer account and published new node-ipc versions containing credential stealing malware.

Cybercriminals paid between $5,000 and $9,000 to make their malware harder to detect on Windows, highlighting its effectiveness and a shift in how the cybercrime market operates.

The ChromaToast vulnerability can be exploited by forcing the ChromaDB API server to fetch and load maliciously crafted AI models before authentication is checked.

CISA has added the Microsoft Malware Protection Engine and Microsoft Defender Antimalware Platform vulnerabilities to its KEV catalog, suggesting exploitation in the wild.

Reported over three years ago and allegedly still not properly fixed, the vulnerability enables attacks to execute JavaScript across browser restarts.

Cisco researchers show how leading AI models wither under realistic multi-turn attacks, calling into question the value of vendors’ single-prompt safety benchmarks.

What the industrialization of exploitation means for defenders

WithSecure concludes that the Greyvibe group used LLMs to generate custom malware, backend infrastructure and phishing lures in order to target organizations in Ukraine as part of Russian intelligence gathering efforts.