Browsing Tag
Cybersecurity
52 posts
Oracle E-Business Suite Exploit Puts Payments Systems on Patch Watch
Attackers are exploiting CVE-2026-46817, a critical Oracle E-Business Suite flaw affecting Oracle Payments, while Shadowserver is tracking roughly 950 internet-facing EBS instances associated with exposure. Teams should verify May 2026 patches, review iPayment endpoint access, and check logs for suspicious file-transmission activity.
Clean GitHub Repos Can Still Trap AI Coding Agents
Mozilla’s 0DIN showed how an AI coding agent can be led from a normal-looking GitHub setup flow into running a DNS-fetched reverse shell. The proof of concept is a warning for teams letting agents install, initialize, and debug unfamiliar projects on developer machines.
OpenAI Launches GPT-5.6 Sol Under Government-Restricted Preview
OpenAI has launched GPT-5.6 Sol, Terra, and Luna in a restricted preview after U.S. government review. The release brings new pricing, API and Codex access limits, stronger cyber safeguards, and a clearer look at how frontier model launches are becoming governed deployments.
Citizen Lab Says Russia Used Cellebrite on Activist’s iPhone After Cutoff
Citizen Lab says Russian authorities used Cellebrite forensic tools on activist Andrey Pivovarov’s iPhone months after Cellebrite said it had stopped selling to Russia and Belarus. The case turns phone forensics into a control problem: what happens when extraction tools keep working after a vendor cuts off a customer?
SearchLeak Shows How Microsoft 365 Copilot Search Can Become a Data Leak
Varonis disclosed SearchLeak, a patched Microsoft 365 Copilot Enterprise Search vulnerability chain that could turn one trusted-looking Microsoft link into a path for stealing emails, files, calendar data, and MFA codes.
Dream’s $260M Round Turns Sovereign AI Into Cyber Infrastructure
Dream raised $260 million at a $3 billion valuation for sovereign AI and cyber defense systems built for governments. The deal shows how national AI infrastructure and critical-infrastructure security are becoming the same market.
Microsoft AutoJack Research Shows How AI Browsing Agents Can Break Localhost Trust
Microsoft’s AutoJack research shows how an AI browsing agent could turn a malicious webpage into a local remote-code-execution path through AutoGen Studio’s MCP WebSocket surface. The specific issue was fixed before a PyPI release, but the localhost trust problem is bigger than one tool.
F5’s Emergency NGINX Patches Put Web Server Teams on a Fast Upgrade Clock
F5 issued out-of-band NGINX updates for flaws affecting HTTP/3, proxy protocol, gRPC, Gateway Fabric, and related products. Teams running internet-facing NGINX should check versions, exposed modules, Kubernetes ingress paths, and temporary mitigations before treating this as routine patching.
Accenture’s Dragos Deal Puts OT Security on an AI Threat Clock
Accenture agreed to take a majority stake in Dragos and buy runZero and NetRise, creating a $4.175 billion bet on operational technology security as AI and geopolitical risk push industrial systems onto the cybersecurity agenda.
Microsoft MDASH Moves AI Bug Hunting Into Real Security Workflows
Microsoft says its MDASH agentic security system is now being used across Windows, Azure, and identity workflows, with new findings in Hyper-V, HTTP.sys, the Windows kernel, and Active Directory. The update shows AI vulnerability discovery moving from benchmark claims toward real engineering pipelines, while proof generation remains the hard part.