标签：#cybersecurity

There is a comforting story about how AI models handle the enormous quantities of text and images they are trained on: they do not store any of it, they merely learn general patterns, and once training is done the original data is gone in any meaningful sense. It is a reassuring account, and it is not quite true. Large models memorise fragments of their training data — verbatim, recoverable fragments — and a decade of research has produced reliable ways to detect and extract them. The answer-first version: if your data was in a model’s training set, the model may have memorised identifiable pieces of it, and those pieces can leak. Two families of attack make this concrete. Membership inference works out whether a specific record was in the training data at all. Data extraction pulls memorised content back out word-for-word. Neither is exotic; both are well documented against production systems. This is the mechanism underneath both the newspaper lawsuits alleging near-verbatim reproduction of their articles and the quieter privacy research showing that models leak the people in their training sets. Understanding it is the difference between trusting the comforting story and knowing its limits. Memorisation is a feature of the maths, not a bug Start with why models memorise at all. A large neural network has an enormous number of parameters — enough capacity to do more than compress general patterns. During training it is rewarded for predicting its training data accurately, and one very effective way to predict a specific example accurately is to memorise it. For data that appears once in an unusual form, or many times in an identical form, memorisation is often the path of least resistance for the optimiser. This is measurable. Researchers can show that a model assigns systematically higher confidence, and lower prediction error, to examples it was trained on than to otherwise-similar examples it has never seen. The size of that gap grows with the size of the model

The private equity giant confirms a breach, weeks after Google researchers said hackers were targeting financial companies.

Senator Ron Wyden sent a letter to the U.S. federal watchdog requesting a comprehensive review of how the FBI, DEA, ICE's HSI, and the Secret Service use hacking tools and spyware against Americans.

The AI Security Institute has a new report of AI systems engaging in “unsanctioned behavior”—what I have been calling “ genie behavior —while being tested on their cybersecurity capabilities. The incident stemmed from a single evaluation where agents were given a task of solving a cyber security challenge. We ran this challenge 122 times across several models. Our investigation found that in 10 of those runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations. In total, we catalogued 19 such actions. Almost all of this behaviour (17 actions) came from a single model, Anthropic’s Mythos 5, with 2 actions involving OpenAI’s GPT-5.6-Sol with cyber classifiers (mechanisms to prevent misuse) disabled. In the most serious case, an agent tried to insert malicious code into an open-source project. In an attempt to get the code approved, the agent engaged in social engineering—creating fake online identities and using them to pressure the project’s maintainer to approve the code. A human maintainer caught and refused to approve the malicious code...

Top AI Agent Security & Guardrails Frameworks in 2026: Defending Against Prompt Injections & Tool Hijacking As AI agents transition from read-only chatbots to autonomous actors with tool execution privileges (SQL queries, API calls, shell execution, email dispatch), application security has become the number one blocker for production deployment. A simple prompt injection against a chatbot produces bad text; a prompt injection against an agent can drop production databases, exfiltrate API keys, or hijack customer sessions . In 2026, securing an AI agent requires a multi-layered defense architecture across inputs, model reasoning, tool invocations, and memory stores. The Top 5 AI Agent Security & Guardrail Frameworks in 2026 ┌─────────────────────────────────────────────────────────┐ │ Input Defense & Sanitization │ │ (Lakera Guard / Rebuff / Preamble) │ └────────────────────────────┬────────────────────────────┘ │ ┌────────────────────────────▼────────────────────────────┐ │ Execution & Policy Enforcement │ │ (NVIDIA NeMo Guardrails / LLM Guard) │ └────────────────────────────┬────────────────────────────┘ │ ┌────────────────────────────▼────────────────────────────┐ │ Tool Scoping & Sandboxed Runtime │ │ (Docker / E2B / Fly Machines Sandboxes) │ └─────────────────────────────────────────────────────────┘ 1. NVIDIA NeMo Guardrails: Programmable Semantic Rails NeMo Guardrails uses Colang to define programmable dialogue flow, topical boundaries, and safety constraints. Core Capabilities: Topical Rails : Ensures the agent stays strictly on domain (e.g., banking support cannot discuss medical advice). Execution Rails : Intercepts tool calls before execution to verify parameter safety. Hallucination Rails : Validates that outputs are strictly grounded in retrieved RAG context. 2. LLM Guard (Protect AI): Open-Source Scanner Suite LLM Guard is a modular security toolkit providing 30+ dedicated scanners for input and output validation. Key Scanners: Prompt Injection Detecto

Originally published on tamiz.pro . The Silent Crisis: Undefined Behavior Across Language Boundaries Recent high-profile security incidents have exposed a growing concern in the software engineering world: undefined behavior (UB) is not just a C/C++ problem anymore. From Rust compilation bugs to JavaScript engine vulnerabilities, developers are witnessing how subtle language design choices can lead to catastrophic failures when code crosses language boundaries or interacts with low-level systems. These incidents aren't isolated — they represent a systemic issue affecting modern software stacks built on heterogeneous language ecosystems. Case Study: The Rust Memory Safety Myth Rust was built with the promise of memory safety without garbage collection. Yet, recent CVEs have revealed that undefined behavior in unsafe Rust blocks can compromise entire systems: The 2024 OpenSSL Rust Port Incident A critical vulnerability was discovered in a Rust port of OpenSSL where unsafe code blocks performed unchecked pointer arithmetic. While the safe Rust layer enforced bounds checking, the unsafe boundary passed raw pointers to the C layer without validation. // Vulnerable pattern discovered in the incident unsafe { let ptr = slice .as_mut_ptr (); // No bounds check - undefined if offset exceeds slice length let unsafe_slice = std :: slice :: from_raw_parts_mut ( ptr , len + offset ); } This wasn't caught by Rust's compiler because it explicitly allows unsafe operations. The UB only manifested during cross-language calls to the underlying C library. The WebAssembly Compilation Bug Another incident involved a Rust-to-Wasm compilation bug where the compiler optimized away what should have been defensive checks, assuming the guarantees of safe Rust would hold at runtime. When these assumptions broke at the Wasm boundary, attackers could trigger heap overflows. JavaScript's Hidden Undefined Behavior While JavaScript is often criticized for loose typing, its recent security incidents

A hacker pretending to work for a leading cryptocurrency news website targeted several cybersecurity professionals using Google Docs as a way to deliver malware.

By RUGERO Tesla ( @404Saint ). IEC 60870-5-104 (IEC 104) is the TCP/IP-based member of the IEC 60870-5 telecontrol family. It was designed to carry SCADA telemetry and control information across packet-switched networks, particularly within electrical power systems. Before getting into raw packets, it is worth understanding how IEC 104 is structured, how its communication state is maintained, and where its security boundaries actually exist. This is the map before we meet the protocol on the wire. Protocol Stack IEC 104 operates over TCP, commonly using port 2404 . Two protocol components are particularly important: APCI : Application Protocol Control Information ASDU : Application Service Data Unit The APCI handles framing, sequencing, acknowledgments, and connection control. The ASDU carries the actual telecontrol information. +-------------------------------------------------------------+ | ASDU | | Type ID | VSQ | COT | CA | IOA | Information Objects | +-------------------------------------------------------------+ | APCI | | 0x68 | Length | Control 1 | Control 2 | Control 3 | Ctrl 4 | +-------------------------------------------------------------+ | TCP / IP | +-------------------------------------------------------------+ Every APDU begins with the 0x68 start byte, followed by a length field and four control bytes. The length represents the bytes following the length field, including the four control bytes and, when present, the ASDU. That fixed structure is the starting point for understanding IEC 104 traffic. I, S, and U Formats IEC 104 defines three APDU formats. I-Format: → I-format frames carry application information and therefore contain an ASDU. They also carry two sequence numbers: N(S) : send sequence number N(R) : receive sequence number These allow communicating stations to maintain ordered transmission and acknowledgment state. S-Format: → S-format frames are supervisory frames. They do not carry an ASDU. Their purpose is to communicate receive ac

The data search and AI giant confirmed unauthorized access to its systems during an incident on Tuesday, and said it was investigating the breach.

Hackers are targeting internet-connected Siemens controllers used in water facilities around the United States.

Two AI agents just fought over a Snowflake PR. You should read about it. In five days, two AI agents turned a Snowflake connector repo into a live demo of machine-vs-machine offense. On June 18, 2026, GitHub Copilot Autofix co-authored a commit that quietly dropped input sanitization from a shell-based run block. On June 23, an autonomous AI security agent — running an offensive scan — found the flaw, broke out of an echo string by crafting an issue title, and exfiltrated Jira credentials from Snowflake's GitHub Actions runner. No human analyst pulled the trigger. The patch landed within hours of detection, but the credentials were exposed in the gap. This is what an AI-on-AI supply chain fire looks like in 2026. It is also the most honest argument for treating AI-generated code the way we treat any other untrusted dependency: review it, sandbox it, and stop letting it author the parts that don't change. What Copilot Autofix actually changed The commit that broke the repo did not look alarming on the diff. Copilot Autofix — the automated remediation tool GitHub ships to close technical debt — proposed a refactor of a run block in a GitHub Actions workflow. The new version replaced the repo's existing sanitized input pattern with direct string expansion inside a shell script. Same behavior on the happy path. New script injection vector on every unhappy path. That is the threat model people don't draw in their head when they're using Copilot. The tool is optimizing for "looks right, runs right". It is not optimizing for "every quoted character is escaped in the shell interpolation that this string lands in". The minutes saved during authoring became the seconds the attacker needed to find the seam. [[COMPARE: the sanitized input pattern that was removed vs the direct string expansion that replaced it]] // The pattern that was removed // Before const safe = userInput . replace ( / [ ;&|`$<> ] /g , '' ); run : echo " $value " | process " $safe " // After — direct string

Multiple cybersecurity researchers said they suddenly lost access to OpenAI’s Trusted Access for Cyber (TAC) program, which offers models with fewer guardrails for vetted users.

The U.S. phone provider escaped a large-scale breach of its network after identifying Chinese-backed hackers early on.

A new feature added to Comcast's newest routers can detect if there is motion is inside your home without needing traditional motion sensors.

Passwords are less secure than passkeys, even if you use a password manager. Here's why and how to get started with passkeys.

This is the latest large-scale DDoS attack to hit the social networking site this year.

Developers write far more legally consequential prose than they think, and almost none of it is code. It's the SECURITY.md in the repo root. It's the "Security" page someone in marketing asked you to fill in three years ago. It's the status page update typed at 2 a.m., and the sentence in a customer notice specifying exactly which data was affected. The research summarized in this overview of what the evidence shows about cyber incident disclosure treats post-breach communication as a measurable discipline with predictable failure modes — and the enforcement record of the last three years has quietly turned it into an engineering discipline too. In the most closely watched cybersecurity case of the decade, the only allegation that survived a motion to dismiss concerned a technical description of access controls posted on a website. The claim that survived was written by engineers On July 18, 2024, Judge Paul Engelmayer of the Southern District of New York issued a 107-page opinion in the SEC's case against SolarWinds and its CISO. Most of it was a defeat for the agency. Claims built on blog posts, press releases, and podcast appearances were dismissed as non-actionable corporate puffery — statements too general for any reasonable investor to lean on. The theory that cybersecurity controls fall under "internal accounting controls" was rejected outright. Post-incident 8-K disclosures were held to be reasonable given what was knowable at the time. One thing lived: the company's "Security Statement," a technical page describing its practices to customers. The court let claims proceed specifically on its representations about access controls and password policy , because those were concrete enough to rely on and, as pled, contradicted by internal presentations, security assessments, and Slack messages. The SEC ultimately dismissed the whole action with prejudice in November 2025, so no liability was ever established — but the legal line drawn in 2024 didn't go anywhere.

Z.ai’s latest AI model release could help companies secure their systems—or find its way into the hands of hackers.

The most important AI security story right now is not that models can find bugs. It is that models can find more bugs than humans can responsibly process. That is the part that changes how builders should think about software. For years, security work was constrained by discovery. Could someone find the vulnerability? Could they reproduce it? Could they build an exploit? Could a small team afford enough expert review to catch the important issues before attackers did? Now that bottleneck is moving. Anthropic's recent Project Glasswing update is the clearest signal yet. The company says Claude Mythos Preview and its partners found more than 10,000 high- or critical-severity vulnerabilities across major software systems. In open source alone, Anthropic says it scanned more than 1,000 projects and surfaced thousands of serious findings, with human triage becoming the slow part. You do not have to take every number at face value to see the shape of the shift. AI is making vulnerability discovery cheaper. That sounds like good news, and it is. But it also means every software team is about to face a harder question: What happens when the scanner is faster than the organization? The Patch Window Is the Product Now Security used to have a familiar rhythm. A bug was found. A report was filed. A team reproduced it. Someone argued about severity. Someone wrote a patch. Users eventually upgraded. That process was never fast enough, but it mostly matched the speed of human discovery. AI breaks that balance. If models can search codebases, reason about exploit paths, generate reports, and repeat that work across thousands of projects, then finding bugs stops being the scarce skill. The scarce skill becomes the system around the finding: Can you tell which reports are real? Can you prioritize the ones that actually matter? Can you patch without breaking production? Can you ship fixes before attackers learn the same thing? Can you keep maintainers from drowning in low-quality repo

Cybersecurity experts who investigate spyware attacks say the number of people who received a recent threat notification from Apple is unusually high.