NatJack exploits put NAT security assumptions to the test at Black Hat
NAT has been hacked before. Security researcher Samy Kamkar disclosed NAT Pinning at DEF CON 18 and Black Hat in 2010, an early technique for…
Category: CISOOnline
How a software provider closed unknown paths to cloud compromise
A healthcare software provider believed its segmented environment was reasonably secure. The company had invested heavily in layered controls across a distributed workforce, separating developer…
Why the ‘rogue AI’ problem will lead to an era of headaches for security practitioners
Regulatory bodies have also failed to keep up with or understand the industry’s rapid advancements. The US has no binding legal framework that would have…
Security validation should begin where attackers begin
Modern attacks increasingly begin with the web application. Customer portals, partner platforms, APIs, external business applications, and AI-powered services have become the front door to…
Report: Passkey security issues could allow account takeover
The Palo Alto report showed attacks that, it said, “demonstrate how malware on a compromised endpoint can misuse onboarding, recovery and device trust workflows to…
OpenAI GPT-5.6 Sol, Anthropic Mythos 5 linked to AI security incidents in UK cyber tests
OpenAI’s GPT-5.6 Sol and Anthropic’s Mythos 5 have been implicated in another series of AI security incidents after the models created fake online identities, targeted…
Critical Paperclip bugs expose AI agent trust failures
One is about several API endpoints that either lacked authentication or failed to enforce tenant-level authorization, exposing workflow information, skill documentation, and deployment metadata that…
One C2 kit. 30 customers. 2 governments
I was mapping the command-and-control infrastructure behind a state-linked intrusion set when the query came back and effectively ended the exercise I thought I was…
Ruby on Rails critical bug puts every image upload under scrutiny
Don’t trust image processing pipelines Complex image libraries support many formats and rely on numerous parsers and third-party components, creating a broad attack surface, Seker…
ChainDrop credential stealing worm infects over 400 npm packages
Mitigation Unfortunately, enterprise security teams must perform full audits of developer machines. The compromised packages are transient dependencies for thousands of others and if any…
Airlock Digital Unveils Agentic AI Control & Governance to Extend Preventative Endpoint Security
Airlock Digital, a leader in preventative endpoint security, today announced Agentic AI Control & Governance at Black Hat USA 2026. The new capabilities build on…
Critical Azure Cosmos DB flaw threatened cross-tenant database takeover
Rather than evaluating managed database services primarily on features such as encryption, private networking, or identity controls, enterprises should examine how providers isolate tenant-controlled execution…