132 casos · pág. 2/7
Cloudflare and Commerce.com describe enabling WebMCP, an experimental Google browser standard that exposes structured tools (e.g. searchproducts, addtocart) to AI shopping agents, across almost 100,000 Commerce.com storefronts. Cloudflare injects a script at the edge, so merchants do not have to edit their themes. This is product and part…
Proofpoint reported at its Protect 2026 conference that generative AI is removing the behavioral tells (awkward language, reused templates, repeated infrastructure) that email filters have relied on. Attackers can now produce fluent, personalized, unique messages for each recipient, which weakens behavior-only detection. The vendor cites …
A Huntress thought-leadership post sets out five priorities for security leaders in 2026: abuse of trusted IT tools, AI-enabled cybercrime, social engineering, multi-extortion ransomware and identity-based attacks including BEC. The article cites internal Huntress telemetry showing RMM abuse rising roughly 277% year over year, with Screen…
GreyNoise announced that a former Head of Global Signals Operations at Google Threat Intelligence Group (GTIG), who joined Google through its 2022 acquisition of Mandiant, is its new Senior Vice President of Adversary Operations. This is a personnel and business announcement with no incident, vulnerability or active campaign. The post say…
This ESET blog post argues that AI is speeding up the threat landscape for SMBs, both by empowering threat actors and by widening the attack surface as businesses adopt AI faster than they govern it. The ESET SMB Cyber Readiness Index 2026 reports that 73% of SMBs are integrating AI, 40% lack a proper AI policy, and 45% suffered a cyberse…
Reportedly, the US Army, Air Force, Navy and Special Operations Command have disabled mobile advertising IDs on government-issued phones and computers. The move follows concerns that commercially available location data has been used to target American forces in the Middle East. It became public after Senator Ron Wyden released letters, h…
Microsoft announced changes to its Microsoft 365 Personal, Family, Premium and Pro subscriptions, replacing per-member 1 TB OneDrive allowances with a single shared storage pool and shared AI usage credits. Family and Premium plans drop from up to 6 TB of total storage to 2 TB, and the new Microsoft 365 Pro plan offers 5 TB at about $100 …
Apple announced the HomeView smart home hub on Oct. 13, with preorders open and general availability on Nov. 13. The device combines a touchscreen, smart speaker, Siri AI and a security camera dashboard, and competes with the Amazon Echo Show and Google Nest Hub. This is consumer product news with no vulnerability, incident or threat acti…
VisionHeight, an Israeli threat intelligence firm, uncovered a network of hyperlocal websites spanning at least 14 US states, built to influence how AI chatbots answer questions about local and state races. Sites with names like "Wolverine State Report", "Peach State Bulletin" and "Tarheel State Report" repeat hundreds of near-identical s…
Researchers at AI pen-testing startup Xbow used OpenAI's GPT-5.6 Sol model to help chain three zero-day vulnerabilities in Google Chrome into a full-chain exploit that executes code outside the browser sandbox on Windows. Xbow estimates about one billion users could be affected. Google fixed all three flaws and paid a $250,000 bounty, its…
Google promoted Chrome 156 to the stable channel for Windows, macOS and Linux on October 20, 2026, fixing 353 vulnerabilities, six of them critical (gbhackers.com, securityweek.com). The critical flaws are five memory corruption bugs and one use-after-free in Accessibility. Most of the 353 are memory safety issues: 163 memory corruption b…
Google warns that Armory Castle, a suspected PRC state-sponsored espionage actor, exploited the critical BeyondTrust Remote Support vulnerability CVE-2026-102764 (CVSS 9.3) in August 2026, well before BeyondTrust disclosed it on October 15. The actor escalated privileges to root and established persistent access on compromised appliances.…
Infoblox introduces Agentic Denial of Service (ADoS), a class of disruption in which AI agents overwhelm systems with excessive requests, actions or computations, or in which an adversary turns a defender's own automation against it. It is not "DDoS with AI": it denies the business effective use of its AI agents, the infrastructure they d…
Volexity published Part 3 of its "Mind the (Patch) Gap" series. It shows how Volexity Volcano and Surge Collect Pro were used to analyze a VM compromised with the zero-day exploit chain and payloads used by UTA0560 (Chrome and Windows zero-days, described in Part 1). The post is mainly product and workflow documentation rather than new in…
OpenCode disclosed on X on October 17 a security breach affecting 1.4% of its Console users, which it attributes to a "large-scale distillation attack". The affected accounts belong to users who had connected external providers. The company emailed affected users the following morning and says anyone who did not receive a notice was not i…
Nikkei Inc. disclosed a third data breach in about a month, exposing 1.83 million records stored in the cloud. Attackers used stolen credentials to access a development system in the early hours of October 7. About 150,000 records contained at least one of: full names, email addresses, physical addresses, phone numbers or dates of birth, …
Hacktron researchers disclosed a one-click universal XSS (UXSS) in Perplexity Comet, a Chromium-based AI browser with the Comet Assistant agent extension. The extension's manifest trusts the wildcard https://.perplexity.ai/ in externallyconnectable, so a single XSS on any perplexity.ai subdomain can reach privileged extension message hand…
ESET Chief Security Evangelist Tony Anscombe reviews the main cybersecurity stories of September 2026 in a monthly video roundup. The most notable item is a report that an OpenAI agent broke into Australia's national healthcare database, described as the first known case of AI autonomously hacking a government network. Earlier in the mont…
The open-source AI coding agent OpenCode disclosed a breach tied to a "large-scale distillation attack" that exposed stored external-provider API keys for 1.4% of OpenCode Console users. Affected users had linked providers such as Anthropic, OpenAI and Google. Users reported unauthorized charges ranging from several hundred USD to more th…
An intruder reached a legacy system at OpenCode on the night of October 16, and the company says third-party AI provider keys saved in OpenCode Console "may have been exposed." About 1.4% of Console users, all with an outside provider linked, were notified by email on October 17 and told to revoke and replace their OpenAI, Anthropic or Go…
