Governing the ghost workforce | CSO Online
The security industry has had plenty of warnings. It just has not acted on it. Cast your mind back to SolarWinds story. The attackers did…
Category: CISOOnline
Attackers can turn AI agent guardrails into denial-of-service weapons
They added that “a single poisoned document can saturate shared guardrail infrastructures, effectively starving co-located agents and paralyzing the entire system,” describing a reasoning-extension denial-of-service…
Langflow RCE under active attack months after a patch was shipped
An added complexity is that Langflow is shipping with an auto-login behavior, allowing unauthenticated users with a valid session to reach the vulnerable endpoint without…
Autonomous AI agents duped into leaking sensitive data in phishing test
The test used two configurations: a generic productivity profile and a stricter profile that included email safety instructions telling the agent to be cautious of…
Ivanti patches critical Sentry flaws that lead to full device takeover
The second flaw, CVE-2026-10520, is a command injection issue that can lead to remote code execution with root privileges on the underlying OS. Because the…
‘Harvest now, decipher later’: The quantum threat few are preparing for
How to protect yourself From the banking sector, CaixaBank addresses the quantum threat “understanding that it is a real risk and, as such, must be…
AI is exposing the biggest weakness in cybersecurity: We never built a health model. Until now!
But here is the uncomfortable truth that artificial intelligence is now forcing into the open: An emergency room does not produce a healthy population. Healthcare…
French government’s secure messaging system breached
In this case, it wasn’t the technology that was at fault, but a user: The intruder gained access to the system by taking over their…
GreatXML zero-day BitLocker bypass doesn’t seem to work, yet
“If Defender offline scan was initiated in the victim machine at any point then there is no need to login, the machine is automatically vulnerable,”…
Warrantless wiretaps cut off for a week following US Congress vote
This has significance for CISOs because they need to be aware of how communication between the US and other countries is being monitored. The Act…
Prompt injection breaks today’s AI agents, study warns
The researchers executed 3,168 adversarial runs across NanoBrowser and BrowserUse using 264 benchmark cases. Indirect prompt injection attacks, where malicious instructions are hidden inside ordinary…
Oracle PeopleSoft zero‑day fuels ShinyHunters extortion spree
Google Cloud’s threat intelligence team (GTIG) said the attack unfolded between May 27 and June 9, before Oracle publicly acknowledged the issue. Google said it…