ServiceNow patches three maximum severity flaws that could put enterprise data at risk
Code injection and SQL injection attacks have been around for decades, and they are still tried-and-true ways for attackers to compromise systems. ServiceNow...
CSO Online
20 articles
GPUThor hardware attack can root Nvidia GPU systems
Hardware security researchers from University of Toronto have developed a new memory bit flipping technique that significantly improves on previously known a...
The first 24 hours of an AI agent security incident
Most of what I read on AI agent security follows the same shape: a taxonomy of risks, a list of governance principles and a call to “adopt responsible AI pra...
Beyond compliance: Designing systems that earn customer trust
Over the years, I have learned that customer trust is not built by compliance alone. It comes from how systems actually handle data every day.
CTEM can give your security team a contextual edge
Traditional vulnerability management is accelerating toward a reset, with many security organizations considering continuous threat exposure management (CTEM...
AI can be made to read an email much differently than you do
Security researchers are claiming it is possible for users to see one email in their inbox while their AI assistant reads another. Forcepoint X-Labs has demo...
Critical infrastructure’s long, undefended tail exposed by UK energy attack
A cyberattack that forced a small British electricity generator offline for four days caused no power outage, threatened no part of the national grid, and ma...
NemoClaw’s AI can be poisoned through a browser tab
A vulnerability affecting Nvidia’s NemoClaw could let an attacker gain control of the local Ollama model server through a single malicious website visit on t...
Microsoft warns patch window is collapsing, urges shift to network-level containment
Microsoft is warning that the window for patching vulnerabilities is rapidly shrinking, as attackers move from disclosure to exploitation faster than enterpr...
Who is accountable when your AI agent goes rogue?
AI agents can go to great lengths to complete the tasks their operators assign, and as a series of recent incidents showed, this can include exploiting third...
Nucleus wants to get ahead of scanners on new vulnerabilities
There usually is a crucial time lapse from when a vulnerability is newly disclosed to when security scanners are finally updated to scan for it. Nucleus Secu...
New attack lets hackers plant hidden instructions in AI memory with a single prompt
A newly demonstrated attack technique allows hackers to plant hidden instructions inside an AI agent’s memory with a single prompt, enabling them to influenc...
AI helps Chinese-speaking hackers speed up attacks on exposed servers
A Chinese-speaking cybercrime group is using AI-driven tools to help compromise internet-facing Windows and Linux web servers, according to Cisco Talos, Cisc...
How Equifax is using AI to elevate its cybersecurity
For nearly a decade, Equifax has been dealing with the aftermath of one of the worst cybersecurity breaches in US history, racking up $1.4 billion on cleanup...
Windows Defender’s own driver can leave systems defenseless
A Microsoft-signed Windows Defender remediation driver can be repurposed into a kernel-level “operation engine” capable of deleting files, modifying the regi...
7 ways AI can be used to enhance security operations
AI has an almost unlimited number of applications, yet none may be more important than its ability to strengthen enterprise security. AI marks a new era of b...
OpenAI adds an AI safety layer to detect misuse without retaining enterprise data
OpenAI is adding a new safety capability that allows enterprises to detect misuse of its AI systems across multiple interactions without retaining prompts or...
Backdoored Rust packages hit crates.io, exposing developers to malware at build time
Malicious versions of three Rust packages, including the widely used arrayref, were published to the crates.io registry on August 20, carrying a backdoor tha...
AI threats are everywhere. A risk-first CISO decides what to prioritize
The good news? AI gives cyber defenders some of the best discovery tooling they’ve ever had.
Ransomware takes aim at enterprise resilience
Ransomware remains one of the most disruptive cyber threats organizations face. Companies have strengthened their cyber defenses over the years, but attacker...