Cyber Attacks
OpenAI confirmed two employee devices were compromised in the Mini Shai-Hulud supply chain attack, exposing code-signing certificates for its apps. OpenAI is rotating every certificate, and macOS users must update before June 12, 2026.
Threat Intelligence
Kaspersky found something unusual in a North Korean backdoor: comments that look written by an LLM, not a human. Combined with Kimsuky's expansion into defense targets across three countries, it is documented evidence that state malware development is borrowing AI.
Application Security
An autonomous AI was pointed at the NGINX source code and found a critical RCE that survived 18 years of human review — plus three more CVEs in the same six-hour session. NGINX runs a third of the internet's top sites. The discovery method is the bigger story.
AI Security
Germany's top cybersecurity official told lawmakers that China is close to building an AI model with superhacking capabilities — developed in secret. The warning lands a month after Anthropic gated Mythos. AI cyber capability is now great-power competition.
Policy & Government
ICE Assistant Director Matthew Elliston disclosed at the Border Security Expo that agents now reach a 20-million-person list from their iPhones via Palantir's ELITE system. The Mobile Fortify accuracy claim is in tension with 404 Media's January reporting.
Artificial Intelligence (AI)
Google Threat Intelligence Group disclosed the first publicly confirmed AI-generated zero-day exploit caught in the wild on May 11. The Python script bypassed 2FA on a popular open-source admin tool and was destined for mass exploitation before Google disrupted it.
Vulnerabilities
A newly-disclosed Server-Side Request Forgery flaw in the LMDeploy LLM inference-serving toolkit is already under active exploitation, with attackers using a vision-language-module endpoint as an SSRF primitive to probe AWS IMDS, internal databases, and admin planes within minutes of patch availability. SHANGHAI, CHINA — The window
AI Security
Federal adoption hits 82% vs 41% private sector as FedRAMP 20x accelerates unvetted agents into classified networks. WASHINGTON, D.C. — While the commercial world cautiously debates the ROI of agentic AI, the federal government has quietly surged ahead, creating a massive, unmanaged attack surface. According to recent IDC and Salesforce
AI Security
White House OSTP accuses DeepSeek and Moonshot AI of industrial-scale extraction attacks; bipartisan sanctions bill advances to protect American frontier models. WASHINGTON, D.C. — The Trump administration has officially signaled a major escalation in the AI arms race, shifting focus from hardware export controls to the protection of the
Data Breaches
Vendors' pen-testing credentials and URL guessing gave Discord hackers weeks of access to a cybersecurity superweapon Anthropic warned was too risky for public release. SAN FRANCISCO, CA — On the same day Anthropic prepared to roll out its most powerful and restricted cybersecurity model to date, an unauthorized group
Venture Capital
Rilian has emerged from stealth with $17.5 million in seed funding to scale its "Caspian" platform, aiming to automate the complex lifecycle of security software procurement and deployment for defense and enterprise sectors. SAN FRANCISCO, CA — Rilian announced on April 23, 2026, that it has secured $17.