RCE by design: MCP architectural choice haunts AI agent ecosystem
According to Anthropic and other MCP adapter developers, the STDIO command execution behavior is by design and the responsibility of sanitizing MCP configurations falls with…
Category: CISOOnline
Flawed Cisco update threatens to stop APs from getting further patches
Using WLANPoller will make the process faster, he added. Enderle said that if an admin finds an AP whose flash memory is already too full…
Critical sandbox bypass fixed in popular Thymeleaf Java template engine
Endor Labs notes in their report that Thymeleaf has defense-in-depth layers to block dangerous expressions and in this case two of them failed. For example,…
Another Microsoft Defender privilege escalation bug emerges days after patch
Second Defender-based LPE in days The Defender flaw addressed earlier this week as part of Patch Tuesday was one of the two zero-day bugs Microsoft…
White House moves to give federal agencies access to Anthropic’s Claude Mythos
Enterprise implications Those same assurance questions translate directly to enterprise procurement. The OMB move signals that federal cyber defense is pivoting toward frontier models that…
Palo Alto’s Helmut Reisinger sees a cyber sea change ahead as AI advances
In this regard, I want to bring up the issue of sovereignty again because what can a company do if its infrastructure is, for example,…
Positiv denken für Sicherheitsentscheider: 6 Mindsets, die Sie sofort ablegen sollten
Security wiederum ist wie Qualität kein fertiges Produkt, sondern (wie bereits angemerkt) eine fortlaufende Disziplin. Sicherheit als eine Praxis zu betrachten, die ständig verfeinert werden…
Cisco Systems issues three advisories for critical vulnerabilities in Webex, ISE
Gartner analyst Peter Firstbrook noted in an email that, since Cisco has applied the patch to the cloud service, this is more of a configuration…
Behind the Mythos hype, Glasswing has just one confirmed CVE
Why is Glasswing still a big deal VulnCheck’s findings reframe Glasswing’s capabilities. The limited number of directly attributable CVEs is just one way of measuring…
Microsoft’s Windows Recall still allows silent data extraction
“The short-term fix is fairly straightforward. Microsoft could add stronger code integrity and process protections to AIXHost.exe, the process that renders the Recall timeline. Right…
Insurance carriers quietly back away from covering AI outputs
“You’ve got this bifurcation of AI, the governed generative and the autonomous pieces,” he says. “It’s no longer, ‘Are you using AI?’ It’s asking, ‘Are…
Was bei der Cloud-Konfiguration schiefläuft – und wie es besser geht
Einen weiteren blinden Fleck in Sachen Cloud Security sieht Roy während Fusionen und Übernahmen. Er mahnt Unternehmen dazu, in solchen Fällen proaktiv vorzugehen: “Führen Sie…