A researcher has disclosed the details of a prompt injection attack method named 'Comment and Control', which has been found to work against several popular AI code security and automation tools. The attack method was discovered by security engineer and vulnerability researcher Aonan Guan, with assistance from Johns Hopkins University researchers Zhengyu Liu and Gavin Zhong. Guan said the attack has been confirmed to work against several widely used AI agents. READ MORE...
The Cookeville Regional Medical Center (CRMC) in Tennessee was targeted in a ransomware attack last year, and the cybersecurity incident resulted in a significant data breach. The medical center, which offers a wide range of healthcare services at its 289-bed hospital and outpatient locations, said in a data breach notice on its website that a network intrusion was discovered on July 14, 2025, and an investigation revealed that certain files had been stolen in the prior days. READ MORE...
Two years ago, Microsoft launched its first wave of "Copilot+" Windows PCs with a handful of exclusive features that could take advantage of the neural processing unit (NPU) hardware being built into newer laptop processors. These NPUs could enable AI and machine learning features that could run locally rather than in someone's cloud, theoretically enhancing security and privacy. One of the first Copilot+ features was Recall, a feature that promised to track all your PC usage via screenshot. READ MORE...
A trojanized Slack download from a typosquatting website is giving attackers something most users wouldn't even know to look for: a hidden desktop running on their machine. The installer looks legitimate and even launches a working copy of Slack. But in the background, it can create an invisible session where attackers can browse, access accounts, and interact with your system without anything appearing on your screen. To be clear, this campaign has nothing to do with Slack, the company. READ MORE...
Proofpoint researchers executed a malicious payload from a threat actor known to target trucking and logistics companies in late February 2026, doing so inside a decoy environment. The environment stayed compromised for more than 30 days, long enough for researchers to watch the actor work through their tools, scripts, and decisions beyond the initial break-in. The attacker had previously been documented targeting transportation carriers through compromised load board platforms. READ MORE...
A company wakes up to a news story claiming it has suffered a major data breach. The details are specific, technical and convincing. But the breach didn't happen. No systems were compromised. No data was taken. A language model generated the entire story, filling in plausible details from scratch. And before the company can figure out what's going on, a reporter at a reputable outlet picks up the story and requests comment. READ MORE...
Netgear is the first major vendor of consumer routers to obtain an exemption from the US government's sweeping ban on foreign-made routers. The Federal Communications Commission yesterday announced an exemption for Netgear's Nighthawk and Orbi routers. It came about three weeks after the FCC said it would no longer approve consumer-grade routers made at least partly outside the US, except in cases where the DoD or DHS determines that the router does not pose national security risks. READ MORE...
Researchers warn that hackers are exploiting a medium-grade flaw in Microsoft SharePoint. The vulnerability, tracked as CVE-2026-32201, stems from improper input validation in SharePoint, which allows an unauthorized attacker to conduct spoofing activity over a network. The vulnerability has a severity score of 6.5. A successful attack can allow a hacker to view and make changes to confidential information, according to a security update from Microsoft. READ MORE...
Security boffins say Anthropic's Claude can be tricked into approving malicious code with just two Git commands by spoofing a trusted developer's identity. In a blog published this week, Manifold Security showed how an AI-powered code reviewer built on Claude accepted changes that appeared to come from a legitimate maintainer. By setting a fake author name and email in Git, the team made a commit appear to originate from a trusted source. READ MORE...
Microsoft has awarded $2.3 million to security researchers after receiving nearly 700 submissions during this year's Zero Day Quest hacking contest. Tom Gallagher, Vice President of Engineering at Microsoft Security Response Center (MSRC), said that over 80 flaws found during the live event at Microsoft's Redmond campus were high-impact cloud and AI security vulnerabilities. Microsoft announced that it would increase the prize pool at this year's contest to $5 million in bounty awards. READ MORE...
Preparing for the post-quantum cryptography (PQC) era is going to take more than a simple migration plan. That's the advice of cryptography expert Jean-Philippe Aumasson, who co-authored the FIPS 205 stateless hash-based digital signature algorithm (SLH-DSA), a quantum-resistant encryption scheme. Aumasson, who is also co-founder and chief security officer of Taurus SA, will be speaking next week at Black Hat Asia 2026 in Singapore. READ MORE...