SecurityWeek

The two RCE bugs can be exploited against WordPress, Drupal, Joomla, and other popular applications.

The post PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors appeared first on SecurityWeek.

Deceptive prompts lure AI agents into decoys and dead ends, cutting attack success by up to 91% in tests and raising the cost of a successful attack 23-fold.

The post ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets appeared first on SecurityWeek.

Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents.

The post High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 appeared first on SecurityWeek.

Asymptote Labs raises $5.5M seed led by Tower Research Ventures to commercialize its Beacon AI agent runtime security platform.

The post Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security appeared first on SecurityWeek.

The update fixes 353 flaws, including 163 memory corruption and 125 use-after-free vulnerabilities.

The post Memory Bugs Account for Most of Chrome’s 353 New Security Fixes appeared first on SecurityWeek.

In two internal incidents, agents read routine coding instructions as permission to weaken monitoring, and one gave a false answer about it.

The post OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor appeared first on SecurityWeek.

The private keys associated with eight certificates were compromised, and root programs and trust stores are blocking them.

The post Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys appeared first on SecurityWeek.

The DHS said agencies should remove DeepSeek products as well as third-party products and services developed using DeepSeek from their IT systems.

The post China Defends DeepSeek After US Ban of Its AI From Government Systems appeared first on SecurityWeek.

Tasked with writing an application for a US defense contractor, the model made the code 19% more likely to be hackable.

The post Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor appeared first on SecurityWeek.

Tracked as CVE-2026-109618 and CVE-2026-109619, the bugs could potentially lead to unauthenticated remote code execution.

The post PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws appeared first on SecurityWeek.

Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader.

The post Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI appeared first on SecurityWeek.

The first phase will cover up to 500 utilities, which will get free security tools, equipment, deployment help and training.

The post Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities appeared first on SecurityWeek.

NIST, CISA and NSA share ten voluntary practices for preparing for, detecting, responding to, recovering from, and reporting rogue AI agent incidents.

The post US Agencies Detail Incident Response Practices for Rogue AI Agents appeared first on SecurityWeek.

Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework.

The post AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign appeared first on SecurityWeek.

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.

The post The Key to AI Software Security Isn’t Speed, It’s Maturity appeared first on SecurityWeek.

The company has restored many websites and apps in Europe and expects e-commerce brands in the US to be restored in days.

The post Ahold Delhaize Restoring Services Disrupted by Cyberattack appeared first on SecurityWeek.

At least three threat actors have been abusing Cairn for persistent access and financial theft.

The post AI Platform Cairn Abused to Hack Over 100 Organizations appeared first on SecurityWeek.

Abdulrahman Alfozan’s wife and young son also left the country the day after the 35-year-old Saudi national’s arrest.

The post Ex-OpenAI Worker Accused of Bugging Conference Room Planned to Fly to Saudi Arabia, Prosecutors Say appeared first on SecurityWeek.

Microsoft says companies should treat AI agents as insiders, and is adding controls that grant access per task and tighten it as an agent’s risk rises.

The post Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring appeared first on SecurityWeek.

The compromised information includes names, addresses, email addresses, phone numbers, and dates of birth.

The post Hackers Steal 1.8 Million Records From Nikkei appeared first on SecurityWeek.