Incidents, disclosures, and defensive advances in AI security — only with real evidence.
The revamped Cyber Verification Program merges Project Glasswing and the original CVP. Every tier includes Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1.
The phishing campaign uses browser-in-the-browser pop-ups and takes advantage of interest in Meta's Muse agent to target agency staff and media buyers.
The nonprofit's investigative report describes unauthorized edits, failed attempts to compromise its Etherpad service, and millions of automated API requests.
CVE-2026-61500 lets attackers forge admin sessions on file servers running versions 3.0.0 through 3.2.0. A fix has been available since July.
The Open Source Software Vulnerability Rewards Program stopped taking product vulnerability reports on October 1, and Google says it will give an update in the first quarter of 2027.
CVE-2026-88779 caused denial-of-service conditions on appliances that had already been patched against two other exploited flaws. Researchers are checking whether it can also be used for code execution.
Reuters sources say the suspect is walking investigators through his devices and communications to help find alleged co-conspirators.
Mac apps will soon need 'very explicit user action' to get the setting. The announcement follows a disputed report that Meta's Muse read a columnist's private messages.
CVE-2026-90970 affects self-hosted AI Gateway instances. Customers on GitLab's hosted gateway are already protected.
An authentication bypass and an OAuth2 token leak in Loom, plus a SageMaker command injection bug, are covered in advisories published October 2.
Transluce traces SQL injection probes at US and Canadian government sites, and Asymmetric Security says agents scraped data from 55 websites.
Proofpoint says TA419 used fake advisory committees and Senate report invitations to steal cloud credentials.