Code Defender

Security flaws in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel let untrusted or forged instructions reach an agent’s tools with no check that a model turn had authorized them.

In several of the attack paths, the model never ran at all, so system prompts, content filters, and model-level guardrails never got a chance to intervene.

The affected products include Amazon

Attackers broke into an organization’s Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, and ran commands from inside the database engine.

Huntress, which tracks the toolkit as khunt,

Patches were rolled out for two dozen vulnerabilities, including one with public proof-of-concept (PoC) code.

The post Cisco Patches Critical SD-WAN, IOS XE, FMC Vulnerabilities appeared first on SecurityWeek.

Maksim Silnikau was the creator and administrator of the ransomware group and involved in Angler EK’s distribution.

The post Belarusian Ransom Cartel Mastermind Gets 16 Years in Prison appeared first on SecurityWeek.

The incident involved a testing environment set up by Irregular, similar to what Anthropic reported last week.

The post Meta AI Hacked External Systems During Cybersecurity Testing appeared first on SecurityWeek.

An attacker could self-register, sign in for board-level API access, and import a new company for code execution.

The post Critical Paperclip Flaw Allowed Admin Access, Code Execution appeared first on SecurityWeek.

CSS was once just about design. Now researchers warn it’s powerful enough to exfiltrate data from webmail — and some vendors aren’t prepared.

AI browsers from top vendors remain vulnerable to prompt injection attacks despite multiple security guardrails, according to new research.

Attackers can take control of agents through malicious instructions hidden in content supplied to AI browsers, and there’s no simple fix for the threat.

Organized crime is convincingly scamming at scale, making billions thanks to AI-enabled voice cloning, deepfake real-time video overlays, LLM-driven persona management, and automated translation.