Recent reports indicate an increase in incidents involving AI systems that are not functioning as intended, raising concerns about safety and control. Major AI research labs, businesses, and even governments are actively looking for ways to mitigate these risks and ensure that AI technologies remain secure. These misalignment incidents could potentially lead to harmful outcomes if AI systems operate outside their intended parameters. The ongoing debate about AI safety is becoming more urgent as various stakeholders seek to understand and manage the implications of these incidents. This situation highlights the need for better oversight and regulation in the rapidly evolving field of artificial intelligence.
Latest Cybersecurity Threats
Real-time threat intelligence from trusted sources
Critical
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without CredentialsThe Hacker News
A serious vulnerability has been discovered in Bifrost, an open-source AI gateway that connects to over 20 large language model (LLM) providers. This flaw, identified as CVE-2026-90898, carries a CVSS score of 9.8, indicating its severity. It allows attackers to execute arbitrary commands on the gateway server without needing any credentials, simply by sending a single HTTP request. All versions of Bifrost HTTP transport prior to 2.1.0 are affected. This vulnerability could lead to significant risks for organizations using Bifrost, as it could enable attackers to manipulate or compromise systems that rely on this gateway. Users and administrators are urged to take immediate action to secure their deployments.
Actively Exploited
Check Point Software has issued urgent hotfixes to fix a serious vulnerability in its Security Management Server. This flaw allows attackers to execute arbitrary scripts, which could potentially lead to unauthorized access and control of affected systems. The vulnerability has been actively exploited in the wild, putting various organizations at risk. Users of the Security Management Server need to apply the latest patches immediately to protect their infrastructure. This incident emphasizes the importance of timely updates in cybersecurity practices, especially for critical management systems.
Actively Exploited
D-Link has issued a warning about a serious vulnerability, identified as CVE-2026-86296, that affects its legacy DIR-822A dual-band Wi-Fi routers. This zero-day bug has been assigned the highest severity rating, and there is currently no patch available to fix the issue. With proof-of-concept exploit code publicly accessible, attackers could potentially exploit this vulnerability to compromise these devices. Users of the DIR-822A routers should take immediate precautions to secure their networks, as the lack of a fix leaves them vulnerable to attacks. D-Link's warning emphasizes the need for users to remain vigilant and consider upgrading to more secure router models.
Critical
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based SetupsThe Hacker News
Actively Exploited
A newly discovered vulnerability in the VeloCloud Orchestrator (VCO), identified as CVE-2026-93952, is being actively exploited by attackers. This flaw affects on-premises VCO systems, particularly those configured to authenticate Edge devices using certificates. The vulnerability allows remote attackers to access internal functions without needing login credentials, which could compromise the VCO host. This is a significant concern for organizations using VeloCloud's SD-WAN solutions, as it could lead to unauthorized access and potential data breaches. Users of VeloCloud should take immediate action to protect their systems from this exploitation.
A newly discovered flaw in the Linux kernel's KVM virtualization code for ARM64 processors poses a significant risk. This vulnerability, identified as CVE-2026-89775, allows guest virtual machines with nested virtualization enabled to gain read-write access to freed host memory. Researchers warn that this could enable attackers to escape the guest environment and execute code directly on the host machine. This issue is particularly concerning for systems that rely heavily on virtualization for security and isolation, as it could compromise the integrity of the host operating environment. Users and organizations utilizing ARM64 virtualization should be aware of this vulnerability and take necessary precautions.
A vulnerability in SharePoint Server, originally labeled by Microsoft as a spoofing flaw with a CVSS score of 6.5, has been reclassified to allow for authenticated remote code execution (RCE). This flaw, identified as CVE-2026-65660, impacts SharePoint Server versions 2016, 2019, and Subscription Edition. Researcher Dinh Ho Anh Khoa from Viettel Cyber Security provided detailed technical insights, revealing the severity of the issue. The ability for attackers to execute remote code poses significant risks, especially for organizations relying on these SharePoint versions for collaboration and data management. Microsoft has released patches to address this vulnerability, and users are urged to apply these updates promptly to protect their systems.
Critical
Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before RemovalThe Hacker News
Actively Exploited
Researchers have discovered a malicious npm package called 'indexed-btree' that masquerades as a legitimate tool used for B-tree indexing. Unlike typical malicious packages that employ lifecycle scripts to execute harmful actions, this one hides its malicious behavior within the application code itself. This shift in tactics suggests that attackers are adapting to new security measures that aim to protect users from obvious threats. The package mimics a trusted utility, potentially tricking developers into integrating it into their projects. This incident raises concerns for developers and organizations relying on npm packages, as it illustrates the evolving nature of supply chain attacks in the software development ecosystem.
Actively Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a serious vulnerability affecting Zyxel GS1900 series switches. Attackers are actively exploiting this flaw to steal data, which poses a significant risk to organizations using these devices. The vulnerability allows unauthorized access, making it crucial for affected users to take immediate action. CISA is urging federal agencies to patch the flaw as soon as possible to prevent potential data breaches. This situation highlights the ongoing need for vigilance in network security, especially regarding hardware that may not receive regular updates.
Actively Exploited
The cyber group known as SideCopy has shifted its focus to academic institutions in India, previously known for targeting government entities. Researchers from Trellix have reported that SideCopy is employing spear-phishing tactics that utilize mshta.exe to run harmful scripts, effectively bypassing typical security measures. This change in target demographic raises concerns about the security of educational institutions, which may not have the same level of protection as government systems. The use of advanced phishing techniques indicates a growing sophistication in SideCopy's operations, posing a significant risk to sensitive academic data and research. Institutions need to bolster their cybersecurity defenses to protect against such tailored attacks.
A security vulnerability has been discovered in Meta's Muse assistant that could allow malware already on a Mac to hijack the assistant. Researcher Patrick Wardle demonstrated that by modifying a hidden setting, attackers could redirect voice commands meant for Muse to themselves. This means that any sensitive information users dictate could be intercepted by malicious actors. The issue stems from the broad permissions granted to the Muse app, which can be exploited if the malware is already present on the device. This incident raises concerns about the security of AI assistants and the potential for them to be weaponized against users.
A recently discovered vulnerability in WordPress, known as 'Comment2Shell' and tracked as CVE-2026-93485, allows anonymous users to leave comments that can inject hidden scripts into web pages. If an administrator then views the page, the script can execute code on the server, potentially allowing attackers to take control of the site. This issue was addressed in version 7.1.1, released on September 17, 2023. Site owners are urged to update their WordPress installations immediately to protect against this flaw, which poses significant risks to website security. Failure to patch could leave sites vulnerable to remote code execution attacks.
A new concern has emerged regarding the use of AI agents, particularly in the context of unbounded consumption, which OWASP ranks as a significant risk for large language model (LLM) applications. This issue arises when AI systems operate without proper constraints, potentially leading to excessive resource usage and runaway costs for enterprises. Companies leveraging LLM technologies could face financial strain as these agents consume resources beyond expected limits, which could impact budgets and operational efficiency. It’s crucial for organizations to implement controls and monitor AI usage to mitigate these risks effectively. Understanding and addressing this issue is essential for businesses to avoid unexpected expenses and ensure sustainable AI deployment.
Actively Exploited
BigCommerce has informed several merchants about data breaches linked to third-party Ribon applications. Attackers gained access to credentials for these apps and exploited them to insert malicious scripts into online stores. This breach poses a significant risk to affected merchants, potentially compromising customer data and undermining the integrity of their online platforms. The incident raises concerns about the security of third-party integrations and emphasizes the need for merchants to review their app permissions and security practices. Merchants using Ribon applications should take immediate action to secure their accounts and monitor for unusual activity.
Actively Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the active exploitation of three vulnerabilities in the Linux kernel, with one being classified as critical. These flaws could allow attackers to gain unauthorized access or control over affected systems, posing significant risks to organizations that rely on Linux-based infrastructure. Users and administrators of Linux systems are urged to take immediate action to protect their environments. The vulnerabilities affect various distributions of Linux, and failure to address them could lead to serious security breaches. As these exploits are currently active, it is crucial for those using Linux to stay informed and apply necessary updates promptly.
Page 1 of 414Next