Learn Ethical Hacking

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim’s Copilot session.

The flaws, which the researchers collectively named CoSnitch, turn in part on an undocumented URL parameter that the assistant itself surfaced

Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA / HMI software built for operational technology (OT) and industrial automation, are witnessing malicious scanning and exploitation efforts.

According to independent reports from watchTowr and VulnCheck, the vulnerabilities in question are as follows –

A ransomware affiliate calling itself Ransom Busters has been spotted proactively sending emails to victim organizations and claims to delete stolen data from ransomware groups’ servers in exchange for a fee ranging from $20,000 to $60,000.

“In these messages, the third-party offers to help the victim recover from ransomware attack. This immediately stands out as anomalous,” GuidePoint Research

Security researchers at Anthropic and Switzerland’s EPFL have demonstrated that self-propagating payloads can spread from one artificial intelligence (AI) agent to the next through the editable system prompt files that autonomous agent harnesses use to carry state between sessions.

The work, released as a preprint on August 10, 2026, tests the technique in a simulated six-agent coding

Xpander’s platform uses a universal agent harness that executes AI agents as portable workloads and securely renders interfaces on demand.

The post Xpander Raises $7.5 Million for AI Management and Governance appeared first on SecurityWeek.

Fortinet will use Virtue AI technology to enhance its AI security portfolio, including for AI models, applications, and agentic systems.

The post Fortinet Acquires AI Security Company Virtue AI appeared first on SecurityWeek.

Tracked as CVE-2026-15748, the arbitrary file upload bug allows unauthenticated attackers to upload executable files.

The post 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw appeared first on SecurityWeek.

Hackers stole names, addresses, phone numbers, Social Security numbers, and financial information from a third-party platform.

The post Heights Finance Data Breach Impacts at Least 1.2 Million Individuals appeared first on SecurityWeek.

The unnamed 52-year-old is accused of attacking Swiss train manufacturer Stadler Rail alongside other enterprises as part of an international ransomware operation.

Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer.

OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker. The complete list of packages published as part of the campaign is below –

ubnuler
ubnlder
ri18nr
reaker
rakier
orakw
joxn