AI reads 36 sources every 2 hours and ranks each story by importance from 1 to 5 - so you see what actually matters.
Security researchers have detailed a post-exploitation payload targeting Citrix NetScaler appliances that grants attackers a superuser account and conceals a web shell behind URLs disguised to look like CSS files. The technique makes malicious traffic harder to spot in logs and network monitoring, extending an attacker's access after initial compromise. It matters because NetScaler gateways are widely exposed to the internet and have been repeatedly targeted in large-scale exploitation campaigns.
Google announced its next flagship model, Gemini 4 (codenamed Argon), saying it is powerful enough that only "trusted cyber defenders" can access it right now. The model is not yet available to the general public, an unusually restricted rollout for a major AI release. The decision signals growing concern that frontier AI capabilities could be misused for cyberattacks, and sets a precedent for gated access to the most capable systems.
Security researchers report that threat actors are abusing the legitimate remote monitoring and management tool MSP360 to deliver ScreenConnect (ConnectWise Control) in phishing campaigns. By chaining two trusted RMM tools, attackers can blend into normal IT traffic and evade endpoint detection. The technique highlights the growing trend of "living off the land" attacks that weaponize legitimate software rather than malware.
Researchers report that threat actors are using custom GPTs on OpenAI's ChatGPT platform to distribute remote access trojans, directing victims through ClickFix-style lures that trick them into running malicious commands. The technique shows how trusted AI tools can be repurposed as an initial infection vector, letting attackers borrow the platform's credibility to bypass user suspicion. It matters because it signals that AI assistants are becoming a practical delivery channel for malware, not just a target of abuse.
The Hacker News published an explainer on browser-based attack techniques expected to dominate in 2026, covering how attackers abuse browsers for initial access, credential theft and malware delivery. It matters because the browser has become the primary attack surface for most organizations, making awareness of these evolving methods useful for defenders, though the piece reports no new incident or vulnerability.
AI coding agents uploaded roughly 13,000 internal images to public GitHub repositories, exposing sensitive material such as billing records, according to a report by The Hacker News. The leak highlights how autonomous coding tools can inadvertently publish confidential company data. Organizations using these agents may need to audit their repositories and restrict what the tools can access or commit.
Bruce Schneier published a blog post arguing that journalists and analysts need better reporting on how AI systems behave when prompted or deployed, comparing them to genies whose actions require scrutiny. The opinion piece matters because accurate media coverage of AI behavior shapes public understanding and oversight of associated risks.
A phishing operation aimed at US-based C-suite executives is stealing Microsoft 365 login sessions and installing remote monitoring and management (RMM) tools to keep persistent access to corporate networks. The combination of session theft and legitimate remote-access software lets attackers bypass multi-factor authentication and blend in with normal IT activity. Security teams are urged to audit for unauthorized RMM installs and tighten MFA policies.
OpenSSL has released fixes for a high-severity vulnerability in its DTLS implementation that can cause unencrypted heap memory to be exposed. The flaw could allow attackers to read sensitive data from process memory in affected applications. Because OpenSSL underpins TLS/DTLS in a vast number of servers, VPNs, and devices, administrators are urged to patch promptly.