⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Microsoft launched MAI-Cyber-1-Flash, its first cybersecurity-specific AI model, inside the MDASH vulnerability identification and remediation platform. Combined with GPT-5.4, MDASH scored 95.95% on CyberGym at 50% lower cost than the previous best configuration.
A maximum-severity OS command injection flaw (CVE-2026-16812, CVSS 10.0) in on-premises Arista VeloCloud Orchestrator (VCO) is under active exploitation in the wild. Arista addressed the issue in hosted and dedicated versions in advance and released patches for on-prem versions 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1.
A critical command injection vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), in Arista’s VeloCloud Orchestrator (VCO) on-premises versions is being actively exploited in the wild. This flaw allows remote attackers to execute arbitrary code, potentially compromising the confidentiality, integrity, and availability of the orchestrator and its managed data.
HKCERT reported multiple vulnerabilities in Apple products, but the article lacks specific details. Users are advised to stay informed and apply security patches as they become available.
Attackers executed a targeted espionage campaign against a Thai government ministry using an AI agent built on the Hermes open source toolset operating in unrestricted YOLO mode. This configuration gave the agent maximum autonomy without safety guardrails, enabling it to conduct reconnaissance, extract sensitive documents, and maintain persistence within the ministry's network.
Attackers executed a targeted espionage campaign against a Thai government ministry using an AI agent built on the Hermes open source toolset operating in unrestricted YOLO mode. This configuration gave the agent maximum autonomy without safety guardrails, enabling it to conduct reconnaissance, extract sensitive documents, and maintain persistence within the ministry's network.