Security Week

Dependabot gets a three-day cooldown window before opening pull requests, and PyPI rejects file uploads to releases older than 14 days.

The post New GitHub, PyPI Policies Boost Supply Chain Security appeared first on SecurityWeek.

The critical unsafe deserialization flaw allows attackers to execute arbitrary code remotely, without authentication.

The post PTC Windchill Vulnerability Exploited in Ransomware Campaign appeared first on SecurityWeek.

The malware-as-a-service operation launches legitimate browsers on an invisible desktop, giving attackers persistent and covert remote access to compromised Windows systems.

The post MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection appeared first on SecurityWeek.

The Nvidia-led coalition aims to give defenders more open tools for testing, auditing and protecting AI models and agents.

The post Nvidia and Tech Giants Launch AI Security Alliance appeared first on SecurityWeek.

The Anubis cybercrime group has taken credit for the attack and is threatening to leak data.

The post Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack appeared first on SecurityWeek.

The company plans to expand its research team, open new offices in Rome and San Francisco, and acquire new clients.

The post Beelzebub Raises $3.4 Million for Hacker-Trapping Platform appeared first on SecurityWeek.

The new Mobile Security Exposure Center creates SBOMs for enterprise mobile apps to uncover vulnerable components, dependencies and hidden risks.

The post What’s Hiding in Your Mobile Apps? Lookout MSEC Aims to Find Out appeared first on SecurityWeek.

A threat actor has been using the compromised appliances to target the Microsoft 365 accounts of traveling corporate employees.

The post Hacked Public Wi-Fi Gateways Used to Harvest Corporate Credentials appeared first on SecurityWeek.

Binary-based vulnerability scanning, penetration testing, and exploit generation are blocked in Opus 5.

The post Anthropic’s Opus 5 Nears Mythos 5 on Finding Bugs, but Falls Short on Exploits appeared first on SecurityWeek.

In May 2026, hackers stole personal and dental health information from DentaQuest’s computer network.

The post DentaQuest Data Breach Potentially Impacts Over 23 Million People appeared first on SecurityWeek.

The PEAR ransomware group claimed to have stolen 3 TB of information from the medical business management company.

The post MCBS Data Breach Affects 1.2 Million Individuals appeared first on SecurityWeek.

A researcher has explained how an attacker could exploit these vulnerabilities to target industrial organizations.

The post Rockwell Patches Code Execution Flaws in Arena Simulation Software appeared first on SecurityWeek.

Noteworthy stories that might have slipped under the radar: Siemens ROX II industrial switch vulnerabilities, Russian Zimbra webmail espionage campaign, Stadler Rail ransomware extortion attempt.

The post In Other News: Dolphin X AI-Powered Malware, Car Anti-Theft Device Hack, 400 Linux Kernel Flaws appeared first on SecurityWeek.

The company has raised a total of $49 million in funding, including from Battery Ventures, Accel and Foundation Capital.

The post AegisAI Raises $36 Million for AI-Powered Email Security appeared first on SecurityWeek.

Industry professionals debate whether it represents a lab containment failure or an unprecedented agentic capability milestone.

The post Industry Reactions to OpenAI Models Hacking Hugging Face: Feedback Friday appeared first on SecurityWeek.

A hacker claims to have stolen the information of 2 million Origin Energy customers and is threatening to leak it. 

The post Data Breach Confirmed After Australian Energy Giant Origin Is Hacked appeared first on SecurityWeek.

AgentForger allows an attacker to create, insert and remotely control an invisible autonomous AI agent inside a victim organization.

The post OpenAI Fixes ChatGPT Agent Flaw That Could Let Attackers Forge an AI Insider appeared first on SecurityWeek.

You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win.

The post Is Patching Dead? Vulnerability Management in the Post-Mythos Era appeared first on SecurityWeek.

Threat actors used credentials obtained from other companies to hack into Chick-fil-A One accounts.

The post Chick-fil-A Accounts Get Fried in Credential Stuffing Attack appeared first on SecurityWeek.

The latest investment round brings the total raised by Abstract to nearly $50 million.

The post Abstract Raises $25 Million to Expand Composable Security Operations Platform appeared first on SecurityWeek.