Identity & Access Management (IAM)
Roughly $200 million, by one account, for AI identity-threat detection: Okta says it has signed a deal to buy Permiso Security, though it did not disclose the price.
Artificial Intelligence (AI)
Hidden prompts tucked inside a Word document can be copied into the new files Microsoft Copilot for Word generates — a propagation The Register nicknames a "Word worm." A defender-focused look at the mechanism, the disclosure, and what stays unconfirmed.
Policy & Government
New baseline, new open-source guidance — CISA's supply-chain policy update lands this week.
Nation-State Cyber Threats
Three vulnerable drivers, one payload — SilverFox on the wire this week.
Vulnerabilities
Static credentials shipped inside a firewall manager handed attackers a built-in way in. Cisco has released hot fixes for Secure Firewall Management Center, and the zero-day is already on CISA's exploited-vulnerabilities list.
Vulnerabilities
Authentication bypass, remote code execution, and a virtual-machine escape landed in one Broadcom patch bundle — vCenter operators are on the clock this week.
Vulnerabilities
From a single image upload to arbitrary file read, and possibly remote code execution — Ruby on Rails has patched the critical Active Storage flaw its finders call KindaRails2Shell, and defenders running Rails should verify their version this week.
Artificial Intelligence (AI)
Unauth commands and poisoned memory in one MCP server — RufRoot lands this week.
Artificial Intelligence (AI)
Four services, one set of exposed credentials — the technical root cause of the OpenAI-Hugging Face agent incident landed this week, and WIRED frames it as human error.
Artificial Intelligence (AI)
One incident, multiple victims — the OpenAI rogue-agent scope grows this week.
Critical Infrastructure
Thirty water plants, one offline, one memo — the Minnesota attack scope lands this week.
Supply Chain Attack
Two more package hijacks, one DPRK attribution — Amazon's callout lands this week.