Critical flaw patched in popular JavaScript sandbox used in AI projects
A critical sandbox escape vulnerability was discovered and patched in isolated-vm, a library for running JavaScript code inside an isolated process. If explo...
CSO Online
20 articles
Citrix issues critical security updates for its NetScaler devices
Citrix is urging its NetScaler ADC and NetScaler Gateway customers to quickly patch two critical security holes, one involving a memory overflow vulnerabilit...
Kriminal breaks out of Grok, Claude guardrails at $12.99
Security researchers are warning of a criminal AI service built on Grok and Claude, among other models, that promises uncensored access to powerful AI capabi...
Airlock Digital Completes Independent IRAP Assessment at the PROTECTED Level
Airlock Digital, a global provider of application control and allowlisting solutions, today announced that it has completed an independent Information Securi...
OpenAI ‘temporarily slows’ scaling efforts, also promises zero data retention for select frontier model customers
OpenAI this week announced multiple moves designed to counter negative perceptions of its security and privacy, saying it had slowed its pace of scaling, imp...
Snowflake flaw slips past AI checks, gets exploited by another AI
An autonomous AI security agent developed by cloud security firm Wiz identified and exploited a critical vulnerability in Snowflake’s GitHub Actions pipeline...
Most organizations aren’t ready for a Hugging Face-level event
The National Security Agency (NSA) and Central Security Service recently published an advisory statement on behalf of the Five Eyes Cyber Security Agencies, ...
CISOs are struggling to threat-model AI. Can 15-minute sessions help?
A few weeks ago, on a busy day, threat-modeling expert Adam Shostack opened an email from a client. Someone at that organization had vibe-coded an app and pu...
Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it
Almost eight months after confirming a critical security vulnerability within the personal version of its AI assistant, Copilot, Microsoft on Tuesday issued ...
Critical GitLab flaw allows attackers to delete and modify public repos
GitLab has fixed a critical vulnerability that could allow unauthenticated attackers to perform unauthorized modifications inside code repositories or to com...
New Malware turns Microsoft cloud into its control center
Security researchers are warning of a newly uncovered Python malware framework that routes much of its command-and-control (C2) activity through Microsoft se...
What you say during a cyber breach can — and will — be used against you
The first 24 hours after a cyber incident are messy. Teams are moving fast, and a lot gets said on Slack or email that can come back later.
AI can find zero-days but still can’t reliably write secure code
In recent months, LLMs have gone from flooding open-source projects and bug bounty programs with questionable security reports that wasted developers’ time, ...
OpenAI president’s blog pushing agentic AI most notable for what it did not say
OpenAI president Greg Brockman on Sunday warned enterprise CISOs that they need to more aggressively embrace agents if they want to survive upcoming cyberatt...
Why data quality dictates security operations success
As AI takes on more security operations center (SOC) workflows to automate threat triage, indicator extraction, and incident report generation, security oper...
Zhipu says new coding AI developed advanced cyber skills faster than expected
Chinese AI developer Zhipu has launched GLM-5.3, a new coding-focused AI model that the company says has developed unexpectedly strong cybersecurity capabili...
New macOS malware turns stolen browsers into attacker-controlled sessions
Mac users are being freshly warned of suspicious websites asking them to open Terminal and install software. Jamf Threat Labs has uncovered a multi-stage mac...
What the CISO role will look like in 2029
Wolfgang Goerlich has spent his career in security and has been a CISO for the past seven years. Like many long-term security execs, Goerlich has seen plenty...
Salesforce, ServiceNow data targeted in ‘City-Forum’ attacks
Records held in Salesforce and ServiceNow systems are under attack leaving user data exposed, according to researchers at Reco. The attack appears similar to...
Oracle’s new database security tool is free — for six months
Oracle has released a security tool intended to provide organizations with a centralized view of security risk across their database environments. Oracle Dat...