⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
This fact sheet from the FBI and CISA highlights considerations for critical infrastructure entities when working with third-party industrial control system integrators. It emphasizes applying the principle of least privilege to reduce vulnerabilities and recommends actions to prevent malicious exploitation of third-party accesses.
Autonomous security agents are getting good at finding bugs. Nobody has a good way to measure how good.
Anthropic and OpenAI on Tuesday announced new models, with both artificial intelligence (AI) companies noting that they are continuing to invest in improving alignment to combat risky behavior. Opus 5.5, per Anthropic , is a "major step up from Opus 5," and "achieves the best scores of any model to date on our automated behavioral audit, our alignment suite that tests Claude across thousands of simulated scenarios." The AI company said the model is less likely than its other recent models to carry out hard-to-reverse actions or act outside the boundaries it's been given, adding it's more resistant than Opus 5 to prompt injection.
Microsoft warned that the September 2026 security updates may also break Always On VPN connections on some Windows 11 systems.
A use-after-free in the Linux kernel's AF_UNIX socket subsystem can be used to escape a container and gain root on the host, security firm DepthFirst said in research published September 22. The flaw, tracked as CVE-2026-80521 (CVSS score: 7.8), was fixed upstream on August 6, but Ubuntu has not shipped the patch for its 26.04, 24.04, or 22.04 LTS releases.
Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127 , affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications.