Model Security Is the Wrong Frame – The Real Risk Is Workflow Security
Jan 15, 2026The Hacker NewsData Security / Artificial Intelligence As AI copilots and assistants become embedded in daily work, security teams are still focused on…
Category: TheHackerNews
Palo Alto Fixes GlobalProtect DoS Flaw That Can Crash Firewalls Without Login
Jan 15, 2026Ravie LakshmananNetwork Security / Vulnerability Palo Alto Networks has released security updates for a high-severity security flaw impacting GlobalProtect Gateway and Portal, for…
Microsoft Legal Action Disrupts RedVDS Cybercrime Infrastructure Used for Online Fraud
Microsoft on Wednesday announced that it has taken a “coordinated legal action” in the U.S. and the U.K. to disrupt a cybercrime subscription service called…
Researchers Null-Route Over 550 Kimwolf and Aisuru Botnet Command Servers
The Black Lotus Labs team at Lumen Technologies said it null-routed traffic to more than 550 command-and-control (C2) nodes associated with the AISURU/Kimwolf botnet since…
AI Agents Are Becoming Privilege Escalation Paths
AI agents have quickly moved from experimental tools to core components of daily workflows across security, engineering, IT, and operations. What began as individual productivity…
Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware
Security experts have disclosed details of an active malware campaign that’s exploiting a DLL side-loading vulnerability in a legitimate binary associated with the open-source c-ares…
Microsoft Fixes 114 Windows Flaws in January 2026 Patch, One Actively Exploited
Microsoft on Tuesday rolled out its first security update for 2026, addressing 114 security flaws, including one vulnerability that it said has been actively exploited…
Fortinet Fixes Critical FortiSIEM Flaw Allowing Unauthenticated Remote Code Execution
Jan 14, 2026Ravie LakshmananVulnerability / Patch Management Fortinet has released updates to fix a critical security flaw impacting FortiSIEM that could allow an unauthenticated attacker…
64% of 3rd-Party Applications Access Sensitive Data Without Justification
Research analyzing 4,700 leading websites reveals that 64% of third-party applications now access sensitive data without business justification, up from 51% in 2024. Government sector…
Critical Node.js Vulnerability Can Cause Server Crashes via async_hooks Stack Overflow
Jan 14, 2026Ravie LakshmananApplication Security / Vulnerability Node.js has released updates to fix what it described as a critical security issue impacting “virtually every production…
PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces
Jan 14, 2026Ravie LakshmananCyber Espionage / Threat Intelligence The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of new cyber attacks targeting its…
Long-Running Web Skimming Campaign Steals Credit Cards From Online Checkout Pages
Jan 13, 2026Ravie Lakshmanan Web Security / Data Theft Cybersecurity researchers have discovered a major web skimming campaign that has been active since January 2022,…