AI reads 36 sources every 2 hours and ranks each story by importance from 1 to 5 - so you see what actually matters.
A threat actor called Red Heron exploited a remote code execution flaw in Gitea to compromise 13 organizations across six countries. The campaign shows how vulnerable self-hosted Git services can expose source code and credentials. Organizations using Gitea should patch promptly and review for signs of compromise.
Schneier on Security examines how artificial intelligence is being used in weapons development and what it means for military power, arms control, and global security. The piece highlights risks that AI could accelerate weapons design, autonomous systems, and proliferation, making the issue increasingly urgent.
WordPress has introduced automated plugin reviews that screen updates before they reach the official repository, aiming to stop malicious or compromised code from being distributed to users. The change matters because WordPress powers over 40% of the web, making the plugin supply chain a high-value target for attackers.
The Hacker News published its weekly cybersecurity roundup covering rogue AI agents, a self-spreading worm on WeChat, ongoing attacks exploiting PaperCut print management software, AI-driven espionage, and new rootkit threats. The digest highlights how both AI tools and long-standing enterprise software are being turned into attack vectors. It matters as a consolidated view of the week's most active threats for security teams to prioritise patching and detection efforts.
A Hacker News analysis argues that AI has fundamentally changed how organizations experience security exposure, altering both the scale of the attack surface and how threats are discovered and exploited. It contends that traditional validation methods, such as periodic testing, can no longer keep pace and must evolve to continuously reflect AI-driven risks. The piece is an argument for rethinking security validation rather than a report of a specific incident.
Bruce Schneier examines Microsoft's software patching practices in a new blog post. The analysis matters because Microsoft's updates protect a vast share of global computers, so weaknesses in its patching process can affect millions of users and organizations.
A malicious browser extension for Twitch was found harvesting OAuth tokens from close to 31,000 users, according to a report by The Hacker News. The stolen tokens could let attackers hijack accounts and act on behalf of victims without needing their passwords. It highlights the ongoing risk posed by third-party extensions that request broad access to popular platforms.
David Sacks, the White House's AI and crypto czar, argued that frontier labs such as OpenAI and Anthropic do not need regulation to pace the development of frontier models. The remarks signal the administration's preference for industry-led pacing over new government rules, a stance that matters as policymakers debate AI safety oversight.
Attackers are using phishing tactics that abuse passkeys to break into Microsoft cloud accounts and steal data, undercutting the assumption that passkeys are inherently phishing-proof. The technique matters because passkeys are widely promoted as the strongest defense against credential theft, so a working bypass could expose many organizations relying on them.