Code Defender

The browser refreshes fix multiple use-after-free, sandbox escape, and privilege escalation bugs.

The post Chrome and Firefox Updates Patch Dozens of Vulnerabilities appeared first on SecurityWeek.

In one attack, threat actors stole an API key that ultimately led to the consumption of $600,000 in public AI model credits for the security nonprofit.

The attacks targeting CVE-2026-0768 are the latest threat against the low-code AI development platform, which is receiving more attention from adversaries this year.

Some security researchers have observed an uptick in insider-assisted ransomware attacks, but malicious insiders pose other threats that cost companies millions.

CVE-2026-82329 is an authentication bypass flaw in JFrog’s repository manager that enables bad actors to gain admin-level access on affected systems.

Cybersecurity researchers have identified a set of 13 malicious Composer theme packages on Packagist that are designed to inject JavaScript into Vietnamese movie and comic streaming sites that install those libraries and initiate the deployment of spyware aimed at unpatched iOS devices.

“The injected code runs two operations against a site’s visitors: a mobile ad-fraud and gambling-redirect

Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet (formerly UNC5669) since 2024.

Google Threat Intelligence Group (GTIG) and Mandiant teams described the threat actor as “specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers.” The adversary

Andrew Bailey, chair of the Financial Stability Board, called on financial institutions and technology providers to “prepare for more severe scenarios involving simultaneous disruption across multiple firms or shared technology dependencies.”

Forescout researchers used Claude AI to port a remote code execution exploit between WAGO PLC models.

The post Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars appeared first on SecurityWeek.

The new office will serve as the central authority for cybersecurity policy covering US ports, vessels, and maritime facilities.

The post Coast Guard Establishes Office of Maritime Cybersecurity Policy appeared first on SecurityWeek.