Cybersecurity News and Updates

“Workflow identity hijacking” can bypass standard security controls and hijack an organization’s data by sending a basic request through an unauthenticated entry point.

US agencies claim Chinese companies covertly extracted billions of tokens from OpenAI, Anthropic, Google Gemini, and SpaceX’s Grok to reduce development costs.

An analysis of Project Glasswing findings shows only a fraction have reached disclosure, and an even smaller number have been fixed.

Major chipmakers announced patches for vulnerabilities recently discovered in their products.

The post Chipmaker Patch Tuesday: Nvidia, AMD, Arm Issue Security Advisories appeared first on SecurityWeek.

The security updates resolve critical flaws across Android’s Framework, System, and Kernel components.

The post Android’s September 2026 Updates Patch 180 Vulnerabilities appeared first on SecurityWeek.

A major vulnerability is disclosed. The alert lands immediately. Then comes the harder question: Are we actually exposed?

For many security teams, answering that means jumping between vulnerability scanners, endpoint tools, cloud inventories, SBOMs, repositories, and application data to build enough context to act.

As AI accelerates vulnerability discovery and research, that delay matters more

Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create “stolen keys” that grant illicit access to tools from model providers like Google, Anthropic, and others. 

Information stealers like Lumma Stealer or Vidar are equipped to harvest a wide range of data from compromised systems. This can include credential, session tokens, and API

Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome.

The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31 (aka Bronze Vinewood, Judgement Panda, JungleBamboo,

The U.S. Department of Justice (DoJ) on Wednesday announced coordinated actions aimed at an illicit online marketplace called Xinbi Guarantee that offered scam services, including seizing Telegram channels used to run the service, confiscating two cryptocurrency wallets, and deploying the Scam Center Strike Force to Madagascar to help disrupt 13 scam compounds run by Chinese organized crime

Veradigm said access was limited to a specific interface, and did not impact the company’s broader environment such as its networks, servers or databases. The incident did not result in operational disruptions, the company added.