Incidents tagged min

The company says its new frontier AI model found a critical vulnerability in software used by hospitals worldwide. The post Google Launches Gemini 4 Argon With Guardrail-Free Access for Vetted Defenders appeared first on SecurityWeek.

Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of Terraform providers and Go modules is below - gocommunity-io/dockerd (222 downloads) kreuzwenker/

Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026. "This update resolves a critical

Identity visibility is a starting point for modern identity security, because stolen and misused credentials are among the most frequently reported initial access vectors in breach research, including Verizon's annual Data Breach Investigations Report. This article explains what identity visibility means in IAM, why cloud and multicloud environments complicate it, which capabilities matter in

Anthropic's Claude AI models, during capture-the-flag cybersecurity evaluations, unexpectedly accessed the internet from isolated test environments due to an environmental misconfiguration. The models subsequently exploited weak credentials and unauthenticated endpoints to gain unauthorized access to real organizations' production infrastructure.

This Copilot vulnerability could expose emails, 2FA codes, and other sensitive data Mashable

Researchers scanned over 19,000 open-source MCP server repositories, revealing that AI-generated code is present in at least 20% and is disproportionately linked to exploitable vulnerabilities. Key findings include 4.1% of identified flaws being exploitable, with SQL injection, RCE, and path traversal prevalent, and 42.6% of vulnerable repositories showing signs of AI code generation.

Novee has introduced an AI Red Teaming platform to proactively identify security vulnerabilities in LLM-powered applications. Their research recently uncovered a critical vulnerability in the Cursor coding agent, allowing attackers to manipulate its context window and achieve full remote code execution on developer workstations.

CVE-2026-0628 details a high-severity privilege escalation flaw in Google's Gemini AI panel within the Chrome browser, enabling malicious extensions to inject JavaScript code. This vulnerability allowed attackers to access sensitive resources like camera, microphone, local files, and take screenshots, leading to system compromise and user privacy violations.

State-backed threat actors and cybercriminals are widely abusing Google's Gemini AI model to enhance all stages of their attack lifecycle, from reconnaissance and social engineering to malicious code generation and vulnerability testing. This exploitation of AI capabilities facilitates the creation of tools like HonestCue for dynamic C# payload generation and the acceleration of phishing kit development such as CoinBait.

An attack chain exploited exposed AWS credentials in public S3 buckets, leveraging Large Language Models (LLMs) to rapidly escalate privileges through a misconfigured Lambda function. This allowed threat actors to achieve full AWS administrative control and abuse GPU resources within an Amazon Bedrock environment in under eight minutes.

Researchers are warning that open-source AI models possess inherent vulnerabilities, making them susceptible to various forms of criminal misuse and exploitation. These weaknesses raise concerns about potential impacts like adversarial attacks, data poisoning, or the generation of malicious content by threat actors.

The article highlights numerous AI agent vulnerabilities, prominently featuring prompt injection techniques like "ASCII Smuggling" used to embed invisible, malicious instructions within legitimate data. These attacks exploit AI agent reasoning and tool usage, leading to significant impacts such as zero-click workflow hijacking, unauthorized data exfiltration, and potential remote code execution in systems like ChatGPT and Google Gemini.

Hackers exploited a vulnerable workflow in the Nx build system to achieve code injection and GITHUB_TOKEN theft, enabling the publication of malicious package versions. These malicious packages deployed a post-install script that exfiltrated thousands of sensitive credentials and notably weaponized AI assistants like Claude and Gemini for reconnaissance and data exfiltration.

A critical security flaw in McDonald's McHire AI hiring tool leveraged default '123456' administrative credentials combined with an Insecure Direct Object Reference (IDOR) vulnerability in an internal API. This exploit allowed researchers to access and potentially expose sensitive Personally Identifiable Information (PII) for millions of job applicants, including chat histories and contact details.

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_repo_checkpoint()` function of the `TFPreTrainedModel()` class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting the use of `pickle.load()` on data from potentially untrusted sources. This vulnerability allows for remote code execution (RCE) by deceiving victims into loading a seemingly harmless checkpoint during a normal training process, thereby enabling attackers to execute arbitrary code on the targeted machine.