JetBrains says a crafted HTTP request could break TeamCity
The vulnerability carries a CVSS score of 9.8 out of 10 as it requires no authentication or user interaction, making internet-exposed TeamCity servers particularly attractive…
Category: CISOOnline
Scattered Spider case raises Microsoft privacy and transparency concerns
Lupton continues: “It is also possible that Microsoft did not hold a complete browsing history. Investigators could instead have correlated Microsoft device, timestamp, and IP…
Microsoft confirms an AI worm is propagating through Copilot and other MS apps
Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, observed that the same problem with mixed data and instructions occurred in databases decades ago, and…
Coordinated Minnesota water systems cyberattack leaves feds chasing two open questions
“Depending on configuration,” Caveza explains, “an attacker could gain monitoring capability, manipulate what operators see, or in some circumstances modify operational settings.” Fortunately, manual safety…
Critical Ruflo flaw lets attackers hijack AI agents through exposed MCP bridge
The researchers said the bridge’s /mcp endpoint accepts tool invocations without authentication. In a proof-of-concept demonstration, they used Ruflo’s terminal_execute tool to obtain command execution…
AI agents gain access to financial workflows amid growing governance gaps
“For decades, governance focused on controlling who could access a system,” said Susan Stapleton, GRC expert at Pathlock. “AI agents introduce a different challenge: understanding…
Russian hackers turn Exchange flaw into ‘half-click’ mailbox takeover
“TA488 used intentionally vague message lures with no call-to-action for the targeted user,” Proofpoint said. The messages resembled routine informational updates, including material on supply…
Risk-based patching is the future. AI made it table stakes
CISA’s new Binding Operational Directive (BOD) 26-04 marks one of the most important changes to federal vulnerability management in years. Rather than requiring agencies to…
CISA unveils a six-step blueprint for isolating critical infrastructure during cyberattacks
It’s also important to identify connections that might lower trust or increase network vulnerability, such as those to carrier-provided networks, or Wi-Fi, satellite, radio point-to-point,…
OpenAI rogue AI agent’s attack expanded beyond Hugging Face
The autonomous AI agent that escaped during OpenAI testing exploited weaknesses across a customer workload, a third-party cloud platform, and Hugging Face’s production environment before…
Anthropic finds weakness in Hawk post-quantum digital signature algorithm
“The attack operates under a chosen plaintext threat model, which is the most common assumption used for studying ciphers like AES,” it explained in the…
It’s easier to steal cargo than toothpaste
How did we get here? Freight logistics is quite a fragmented industry. From the production line all the way to consumers or customers, there are…