Code Defender

ABB previously published an advisory warning about possible probing of a dynovaPRO vulnerability. 

The post ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw appeared first on SecurityWeek.

In Booz Allen’s isolated OT lab, AI models met every objective across eight scenarios and reached an industrial control network from a perimeter compromise in just over 16 minutes.

The post AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds appeared first on SecurityWeek.

Organizations are reporting that employees face threats to their families, stalking, physical violence, and abduction. But these alarming claims are hard to verify.

The most important is CVE-2026-96951, a security feature bypass flaw in Windows that has been exploited in the wild.

The post Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day appeared first on SecurityWeek.

Critical-severity flaws could lead to authentication bypass, code execution, and sensitive authentication information leaks.

The post Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products appeared first on SecurityWeek.

Mozilla has introduced Firefox Enterprise for organizations with strict compliance, governance, and security requirements.

The post Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise appeared first on SecurityWeek.

Investigators stormed 40 locations in Texas and seized 187 laptops used by North Korean IT workers to hide their location.

The post US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms appeared first on SecurityWeek.

The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part.

TL;DR

During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer’s production website, on its own.
One login request let the user choose where the one-time passcode went.
The attack was the easy part. Proving it

Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. 

Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking

A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said.

Its researchers built the attack in six days by directing AI agents running OpenAI’s publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $