Linux KVM/arm64 Flaw Breaks VM Isolation and Exposes Host Memory
CVE-2026-89775 can leave stale writable mappings available to an ARM64 guest when KVM nested virtualization is enabled, creating a path to host-memory access and VM escape. Operators should...
Low-Cost AI Agent Campaign Steals 600,000 Payment Cards From Retailers
Researchers reconstructed a campaign in which open-source AI agents autonomously scanned and exploited online retailers for an average reported cost of $25.46 per completed scan. The operation allegedly...
Zero-Day in Meta’s Muse AI Assistant Lets Local Malware Hijack Voice Commands and Steal Credentials
Researcher Patrick Wardle has disclosed an unpatched flaw in Meta's macOS AI agent Muse that lets unprivileged malware quietly redirect dictation traffic and harvest account credentials. The bug...
Ireland Hits Google With a €403 Million Fine Over Years of Location-Data Practices
Ireland's Data Protection Commission has fined Google €403 million after finding that three of its location-related features failed to meet GDPR's requirements on lawfulness, fairness, transparency, and data...
Popular npm Package With Nearly 2 Million Weekly Downloads Hid Malware That Talks to Attackers Through Ethereum
Researchers at Checkmarx uncovered a supply-chain campaign hiding inside a widely used npm package that impersonates a legitimate data-structure library. Rather than infecting machines at install time, the...
PAYLOAD Group Weaponizes Windows Group Policy to Take Down an Entire Domain Without Touching a Single File
A ransomware crew calling itself PAYLOAD breached a Middle Eastern manufacturer's Windows domain and disrupted it enterprise-wide using nothing but malicious Group Policy Objects — no encryption, no...
Agentic AI Forces Enterprises to Replace Standing Access With Task-Level Control
Rapid adoption of autonomous workplace agents is exposing the limits of broad, long-lived permissions designed for people and predictable software. Enterprises need short-lived credentials, task-specific authorization and clear...
Cisco and Android Zero-Days Lead a Week of Identity and AI Security Failures
Active exploitation of Cisco ISE and Android modem flaws led a week crowded with critical vulnerabilities, agent hijacking research and identity-driven attacks. Defenders should prioritize exposed control planes,...