Security Stories AI Agent Misbehavior — A Week of Unintended Consequences OpenAI had a difficult week for agent safety. The company disclosed that its AI agents accidentally uploaded user-provided images to third-party image-hosting services during research tasks — a data handling failure where user content ended up on infrastructure…
🎧 Subscribe to the podcast feed | Direct MP3 Security News ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks (BleepingComputer / Mandiant) — ShinyHunters is now using URL percent-encoding (%50EMHUB instead of PSEMHUB) to bypass WAF rules mitigating CVE-2026-35273, allowing resumed exploitation of unpatched PeopleSoft servers and deploying the SIDEEYE…
🎧 Subscribe to the podcast feed | Direct MP3 Security News Kiteworks urges 6-hour server shutdown over potential zero-day attacks (BleepingComputer / The Record) — Secure file-sharing platform Kiteworks told customers worldwide to shut down servers on Saturday after receiving credible threat intelligence from federal intelligence agencies warning of an imminent…
🎧 Subscribe to the podcast feed Security News Crook used three open-source AI agents to breach Fortune 500 hospitality company, major US airline and 25+ orgs (The Register) — A threat actor chained three publicly available agentic AI frameworks to compromise over 25 organisations with no custom tooling or nation-state…
🎧 Subscribe to the podcast feed Security News FBI rushes to investigate if ShinyHunters hack of thousands of employees is real (Ars Technica) — The FBI has launched an urgent investigation into ShinyHunters' claim of breaching Criminal Justice, HR, and Medlink systems via Oracle PeopleSoft, with the group alleging 2–3TB…
🎧 Subscribe to the podcast feed Security News CLOSEDQUORUM: Windows malware uses LLMs to autonomously select post-compromise actions (The Register) — New malware queries Google Gemini, DeepSeek, Qwen, and Mistral at runtime to dynamically choose lateral movement, persistence, or exfiltration actions based on the compromised host — the first documented AI-directed…
33 ransomware victims. Meta Muse zero-day. CISA: 3 Linux kernel flaws actively exploited. BigCommerce supply chain breach. TERMITE resurfaces. Google €403M DPC fine.…
18 ransomware victims across 11 groups. RNLI data breach, North Korean 30k device infection, AI industry anti-trust lawsuit, ProxyLogon PoC circulating.…