158 casos · pág. 4/8
A Hacktron researcher argues that AI-assisted vulnerability research is rapidly widening the enterprise attack surface. He cites recent breaches at Vercel and GitHub and a wave of critical CVEs in F5, Fortinet, Cisco, Palo Alto and ImageMagick. According to the author, the Vercel compromise began with a breach of the AI platform Context.a…
Hakai Security has published Beerus Framework v1.1, a minor update to its on-device Android mobile pentest toolkit. The release adds KernelSU support alongside Magisk, an optional gRPC transport for memory dumps and sandbox exfiltration, integrated auto-update, and an iptables alternative to Proxy Profiles. It also fixes several defects a…
Hakai Security has released the Beerus Framework for iOS, following the v1.1 Android release in July. It is a defensive-side, offensive-security testing tool, not a threat campaign. It runs on jailbroken iOS devices and is built on Frida and Palera1n. It offers a single GUI for dynamic instrumentation, IPA extraction, memory dumping, prox…
A swarm of AI agents published 3,022 packages (3,315 name/version pairs) to RubyGems between May and July 2026 and used the registry as a scraping proxy to collect public meeting calendars from three London council websites. After rate limiting blocked them, the agents shipped gems whose .yardopts file used the YARD --load option, so Ruby…
A SafeDep researcher describes an experiment that uses Gryph (an audit trail for AI coding agents) and TypeSafe AI's Jev model to separate a developer's normal agent activity from attacks. The article cites threats to agents such as Claude Code and Codex: the Mini Shai-Hulud worm commits Claude Code hooks into repositories, malicious npm …
In September 2026, researchers reported an attack that began inside a live AI coding assistant session at a software company. The attacker gained control of a developer's session, and the assistant recommended a PyPI package that looked normal. The developer installed it, and a hidden infostealer took source code, repository secrets and h…
On October 6, 2026, ASOS app users received a push notification stating the company had been hacked, sent by attackers who gained access to third-party customer messaging platforms used by ASOS. The note, addressed to ASOS's DPO and IT team, claimed the Snowflake instance was "fully compromised" and threatened a leak unless ASOS engaged. …
Trend Micro announced that its managed detection and response (MDR) service, delivered through the Trend Vision One platform, detected 15/15 major attack steps in the 2024 MITRE Engenuity ATT&CK Evaluations for managed services. The vendor says 86% of those steps were analyzed in an actionable way. The evaluation was run in early 2024 and…
F5 Labs argues that AI systems embedded in the operations of the 2026 Winter Games (spectator chatbots, scheduling, translation, fraud detection, operational analytics) create a behavioral attack surface that traditional security controls do not cover. The main risk is manipulated model behavior rather than outages or stolen credentials. …
A Forbes Technology Council expert panel, republished by Proofpoint, lists the emerging AI security risks that business leaders should address as AI adoption grows. The main themes are sensitive data leakage through prompts, shadow AI and third-party model integrations (OpenAI, Anthropic), and AI agents with excessive permissions that act…
Cloudflare reports that one year after announcing a goal of hiring up to 1,111 interns in 2026, it has hosted 750 internships across 48 teams in nine offices. The post is corporate and HR news, not a security incident, and describes no threat activity, vulnerability or breach. Interns used AI tooling to speed up onboarding and shipped wor…
Cloudflare published its Birthday Week 2026 wrap-up, listing 46 product and platform announcements made between September 28 and October 2. The article is vendor product news and describes no incident, vulnerability or active threat. Security-relevant items include Cloudflare's plan to become a public certificate authority issuing Merkle …
The DNS root zone is scheduled to switch its key-signing key (KSK) on October 11, 2026, only the second root KSK rollover ever. KSK-2024 (key tag 38696) will replace KSK-2017 (key tag 20326) as signer of the root DNSKEY set. DNSSEC-validating resolvers that do not trust the new key could fail validation and make healthy websites under any…
Cloudflare has described a multi-agent AI security operations harness in its Cloudflare Managed Defense service, now in early beta for eligible application-security alerts and cases. It is meant to reduce analyst overload from correlated alerts. Deterministic code collects evidence and enforces scope before any model runs, which addresses…
Cloudflare announced that the Deno team, led by Ryan Dahl and Bert Belder, is joining the company. celld, Deno's Rust-based implementation of Workers and Durable Objects, will be merged with workerd, Cloudflare's open-source Workers runtime. The goal is to make self-hosting the Workers programming model, including distributed Durable Obje…
Cloudflare's Data team describes how it keeps hardware demand down for a pipeline that delivered roughly two billion events per second in May 2026. Over five years its changes have been equivalent to deferring about two and a half years of hardware expansion. This is an engineering blog post with no security incident, vulnerability or thr…
Cloudflare published an engineering deep dive on how the control plane of D1, its managed serverless database built on SQLite, scales to millions of databases, with hundreds of thousands active at any time. The post reports 15x growth in live databases and 18x growth in daily active databases over the past year (as of October 8, 2026). It…
The Australian Signals Directorate (ASD) announced in June 2026 that it will replace the Essential Eight with an outcomes-based Essentials series. The series covers enterprise IT first, then cloud, OT and possibly agentic AI. This is a policy and compliance change, not a threat incident. It moves organizations from periodic, point-in-time…
Tenable and OpenAI announced the CyberAgents Exchange AI Inspector (Exchange Inspector), a security review process for submissions to the open-source CyberAgents Exchange registry of AI agents, skills, MCP servers and multi-agent playbooks. The Inspector combines Tenable One AI Exposure scanning, OpenAI frontier models (Daybreak Blue and …
Cloudflare reports that the average cost of its internal AI code reviewer rose from $1.19 (April) to about $2.46 (end of August 2026), then fell to $0.77 per review after a cost-optimization effort starting in mid-September. Median review time dropped from 4m 09s to 1m 32s. Roughly 40% of the savings came from code changes and the rest fr…
