Hugging Face Transformers RCE flaw enables stealthy compromise via AI model configs
“The malicious field uses an underscore-prefixed name that looks like an internal implementation detail — the kind of field that config files are full of,”…
Category: CISOOnline
Beware the ‘son of Mythos,’ security experts warn
“When we’re doing threat modeling, we have some sense that these are the known vulnerabilities that we are modeling against and here’s where we think…
Hole in GitHub’s browser-based VSCode editor could lead to stolen token
First, the bug: Users of github.com may not realize it, but when they are on any repository, they can shift to github.dev and its browser-based…
Enterprise Spotlight: Rethinking cloud strategy in the age of AI
Cloud computing has reached a crossroads. The high cost and data sensitivity of AI workloads are raising the appeal of private clouds, even as neoclouds…
Lessons from the Canvas cyberattack
Who? The ShinyHunters criminal hacker group’s name is believed to be derived from the rare Shiny Pokémon video game character. The character is an aspect…
Microsoft builds a security perimeter for AI agents
“AI is accelerating development and introducing new issues around insecure code, opaque models, data exposure, and compliance,” Aleš Holeček, chief architect at Microsoft Security, said…
AI may finally unlock the cyber budgets CISOs have wanted for years
“Ask for more money, but have a plan,” he says. “Especially a plan that incorporates the fact that you’re not going to get everything you…
Two-year old Oracle WebLogic Server vulnerability is being exploited
“To make the CISA KEV means that we’re seeing active exploitations,” agreed Tyler Reguly, Fortra’s associate director of security R&D. “Given that this CVE was…
Anthropic grants Project Glasswing access to 150 more companies, with a focus on critical infrastructure
If Project Glasswing, and similar projects from other major AI vendors, increase the stream of vulnerability identifications by 10 or more times, will vendors be…
Trump revives parts of canceled AI order with cybersecurity-focused directive
Establishing oversight of frontier model cyber capabilities One of the most consequential sections of the order concerns advanced AI systems, often referred to as frontier…
Infected Red Hat npm packages expose developer credentials
The campaign, which Wiz researchers are tracking as Miasma, is thought to be the latest evolution of Shai-Hulud, a self-propagating malware family that has repeatedly…
Attackers exploit Palo Alto GlobalProtect flaw days after disclosure
“Rapid7 MDR identified successful exploitation across numerous customers, however we did not observe any indication of successful lateral movement from the devices,” the firm said…