Antivirus and Security news

Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it

Almost eight months after confirming a critical security vulnerability within the personal version of its AI assistant, Copilot, Microsoft on Tuesday issued a patch to close the hole, which relies on an LLM’s inability to distinguish the data in a query from an instruction. The CoSnitch hole was discovered by Varonis, and marked the third […] more…

AI’s attribution problem gets worse as models scale

Diffusion models are becoming sophisticated enough that they can reproduce an image even when they don’t have access to the original. In a series of ‘what if’ scenarios, researchers associated with MIT’s Computer Science & Artificial Intelligence Laboratory (CSAIL) swapped out different training datasets to test the impact on image outputs when original image data […] more…

Google buys data from bankrupt Spirit Airlines for AI training

Google has paid $10 million in a bankruptcy auction for a large amount of data from the defunct Spirit Airlines, Bloomberg Law reports. The purchase includes 100 million emails, 500 million messages, data from Microsoft Teams, as well as information on revenue, flight operations, marketing, personnel, and project management. The material also includes 30 million […] more…

Webinar Today: Rethinking Cyber Defense for AI-Speed Attacks

Join the live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. The post Webinar Today: Rethinking Cyber Defense for AI-Speed Attacks appeared first on SecurityWeek. more…

CISO Conversations: Nico Waisman – From Self-Taught Hacker to AI-Driven Offensive Security at XBOW

With no formal training and no career plan, Waisman built a path from Argentina’s early hacking scene to leading security at an AI-powered offensive security firm. The post CISO Conversations: Nico Waisman – From Self-Taught Hacker to AI-Driven Offensive Security at XBOW appeared first on SecurityWeek. more…

AI-Driven Vulnerability Surge Breaks the Traditional Patching Model

Rapid7 warns that traditional patch cycles cannot keep pace with soaring vulnerability disclosures and faster exploitation, forcing defenders to prioritize exposure over severity scores. The post AI-Driven Vulnerability Surge Breaks the Traditional Patching Model appeared first on SecurityWeek. more…

Xpander Raises $7.5 Million for AI Management and Governance

Xpander’s platform uses a universal agent harness that executes AI agents as portable workloads and securely renders interfaces on demand. The post Xpander Raises $7.5 Million for AI Management and Governance appeared first on SecurityWeek. more…

Fortinet Acquires AI Security Company Virtue AI

Fortinet will use Virtue AI technology to enhance its AI security portfolio, including for AI models, applications, and agentic systems. The post Fortinet Acquires AI Security Company Virtue AI appeared first on SecurityWeek. more…

Is Apple beginning a privacy reset?

In recent months, hints emerged concerning Apple’s plans to introduce camera-equipped AirPods Pro; the cameras would be designed to pick up details of your ambient surroundings and feed information to Siri to help you with your life. At one point, we heard the product had been pulled citing privacy concerns. But that doesn’t seem to be the case, […] more…

New malware turns Microsoft 365 and Azure into its control center

Security researchers are warning of a newly uncovered Python malware framework that routes much of its command-and-control (C2) activity through Microsoft services that defenders already expect to see. The Ontinue Cyber Defense Center discovered the implant while investigating an active campaign in July and has since tracked it as TWINLOOT. It was seen using SharePoint […] more…

Warning to enterprises: Vibe coding can be a threat

Vibe coding is a top security threat to enterprises and could leak data into the public sphere, analysts and executives are saying. “The number one risk at the minute is hard-coded secrets being uploaded through vibe-coded applications to GitHub, and then providing a route in,” said Pete Shoard, chief of research for cybersecurity at Gartner. […] more…

300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw

Tracked as CVE-2026-15748, the arbitrary file upload bug allows unauthenticated attackers to upload executable files. The post 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw appeared first on SecurityWeek. more…

Heights Finance Data Breach Impacts at Least 1.2 Million Individuals

Hackers stole names, addresses, phone numbers, Social Security numbers, and financial information from a third-party platform. The post Heights Finance Data Breach Impacts at Least 1.2 Million Individuals appeared first on SecurityWeek. more…

GitLab Patches Critical Code Injection Vulnerability

The security defect allows unauthenticated attackers to modify or delete user data and public projects. The post GitLab Patches Critical Code Injection Vulnerability appeared first on SecurityWeek. more…

GitHub restores services after nearly 8-hour outage disrupts Actions, APIs, PRs and Copilot

GitHub has restored services after a nearly eight-hour outage disrupted several of its core developer tools, including Actions, pull requests, APIs, Git operations, Webhooks, and Copilot, impacting software development workflows across its platform. “This incident has been resolved. Thank you for your patience and understanding as we addressed this issue,” the company wrote on its status […] more…

Dozens of WebKit Vulnerabilities Patched With Fresh macOS, iOS Security Updates

The bugs could be exploited to crash Safari, corrupt memory, leak sensitive data, escape the sandbox, and exfiltrate data. The post Dozens of WebKit Vulnerabilities Patched With Fresh macOS, iOS Security Updates appeared first on SecurityWeek. more…

« Older posts