AI reads 36 sources every 2 hours and ranks each story by importance from 1 to 5 - so you see what actually matters.
A newly disclosed vulnerability in the Linux kernel allows malicious or compromised ARM64 KVM guests to gain read-write access to the host machine's memory, breaking the isolation between virtual machines and their hypervisor. Such a guest-to-host escape is especially dangerous for cloud and data-center operators running ARM64 hardware, where tenants share physical servers. Patches and mitigation guidance are being urged for affected systems.
A SharePoint vulnerability that Microsoft first classified as a spoofing issue actually permits authenticated remote code execution, letting attackers with valid credentials run arbitrary code on affected servers. The mislabeling matters because it may have caused defenders to underestimate the flaw and delay patching, underscoring the risks of relying solely on vendor severity ratings.
Security researcher Bruce Schneier reports that GPT-6 Astra, a new AI model, solved an Enigma-encrypted message that had resisted conventional cryptanalysis. Enigma's core cipher was broken at Bletchley Park decades ago, so the interest lies less in the wartime machine than in what an AI's success on a remaining unsolved ciphertext says about machine reasoning and codebreaking. The claim warrants scrutiny until details and independent verification are published.
A malicious package named indexed-btree was published to the npm registry and concealed its loader inside runtime code, making the payload harder to spot during static inspection. The package has since been removed, but the incident highlights the ongoing risk of supply-chain attacks targeting open-source software repositories. Developers are urged to audit dependencies and verify package integrity.
The Pakistan-linked hacking group SideCopy has widened its India-focused espionage campaign beyond government and military targets to include academic institutions, using spear-phishing emails to deliver the ReverseRAT remote-access trojan. The shift suggests attackers are seeking research data and credentials held by universities, which typically have weaker security defenses than government networks. It highlights the growing targeting of education sectors by state-sponsored threat actors.
Security researchers report that an undisclosed configuration setting in Meta's AI assistant can be abused to let attackers use the assistant as a backdoor into a victim's account or device. The finding matters because AI assistants often hold broad permissions and access to personal data, making misconfigured settings a high-value target. Meta has not yet publicly detailed mitigations, so users should watch for guidance.
A WordPress vulnerability dubbed Comment2Shell allows attackers to escalate a cross-site scripting flaw in the comment system into remote code execution by exploiting an administrator's active session. Because the entry point is an anonymous comment, an unauthenticated attacker may be able to compromise a vulnerable site once an admin views the malicious content. Site owners are advised to patch or apply mitigations promptly.
Attackers are actively exploiting newly disclosed vulnerabilities in Zyxel networking devices and Veeam backup software, gaining remote command execution and full Windows SYSTEM-level access. Successful SYSTEM access lets intruders disable defenses, move laterally, and deploy ransomware across enterprise networks. Administrators are urged to patch immediately, as public exploit activity is already underway.
Attackers are distributing a counterfeit LastPass Authenticator installer that drops a Microsoft-signed driver to disable antivirus and EDR tools on victim machines. Abusing a legitimately signed driver lets the malware bypass security protections that would normally block such tampering. It highlights the growing trend of "bring your own vulnerable driver" attacks that undermine endpoint defenses.