News

News

• October 22, 2026 22 Oct'26

  Max-severity GitLab flaw lets attackers run code on servers

  A high-impact GitLab flaw lets unauthenticated attackers run code on self-managed servers. Every release since 2014 is affected.

• October 22, 2026 22 Oct'26

  PHP2Shell disclosure unravels after leaks forced early patch drop

  Although website shutdowns were inevitable to patch critical PHP flaws, early leaks and a broken embargo turned routine maintenance into an emergency scramble.

• October 21, 2026 21 Oct'26

  PHP2Shell: 22M exposed servers at risk as emergency patches released

  AI gave defenders a head start, but PHP2Shell has sparked a chaotic race against automated exploits across 22 million vulnerable servers.

• October 21, 2026 21 Oct'26

  AI will drive up credit cost of weak cyberdefenses, says Moody's

  As Moody's links poor cyber resilience directly to higher capital costs, CISOs gain a powerful financial metric to convince boards to fund defenses.

• October 20, 2026 20 Oct'26

  AI agents risk blind spots without shared security data, experts warn

  Building a common, continuously updated view across security tools raises practical questions about data ownership, freshness and resolving disagreements.

• October 19, 2026 19 Oct'26

  Off the rails: Railway cyberattacks highlight infrastructure risks

  Cyberattacks on Japanese rail operators Keio and Tokyo Metro reveal how corporate IT breaches expose passenger data and threaten operational technology systems.

• October 16, 2026 16 Oct'26

  Crest CEO: 'Basics shouldn't be abandoned in the race to deploy AI'

  Crest's Nick Benson breaks down new AI testing standards, human oversight and the rapid shift toward mandatory security compliance.

• October 15, 2026 15 Oct'26

  CIRCIA reporting deadline puts OT data integrity under the microscope

  As CISA's incident reporting rule advances, critical infrastructure operators must prove the data and commands driving operations are authentic -- even when networks seem secure.

• October 15, 2026 15 Oct'26

  CISA to AI labs: Share test-network IPs to flag rogue agents

  CISA wants AI testing labs to provide a mechanism for mainstream cyber defenders to spot and flag rogue agents before they cause real damage. Experts' reactions were mixed.

• October 14, 2026 14 Oct'26

  Historic Curl flaw shows AI risk to legacy supply chain

  An AI audit of Curl unearthed a 25-year-old authentication flaw in code powering 20 billion devices, proving heavily scrutinized legacy libraries still harbor hidden risks.

• October 14, 2026 14 Oct'26

  Bug bounty reckoning: AI slop forces enterprise strategy shift

  As AI fills bug bounty queues with low-quality reports, tech giants like Intel and Google are rethinking paid rewards and shifting toward automated internal defenses.

• October 13, 2026 13 Oct'26

  AI-discovered flaws are rarely exploited but pose greater risk

  Relatively few AI-discovered flaws are exploited, but new research shows the ones that are can pose outsized risk to enterprises.

• October 13, 2026 13 Oct'26

  AI kill switch: Can we really shut down artificial intelligence?

  In this episode of Tech News this Week, Richard Livingston explains the debate around AI kill switches and recent legislation surrounding AI oversight and shutdown capabilities.

• October 13, 2026 13 Oct'26

  Kiteworks CISO: Why We Shut Down Systems Before Finding Vulnerability

  A federal warning prompted the vendor to take systems offline before confirming a breach -- a decision that exposes difficult questions about downtime and risk.

• October 12, 2026 12 Oct'26

  Beyond Arup: CISOs combat escalating deepfake fraud

  In the two years since the landmark Arup attack, deepfake technology has rapidly matured. Cybersecurity and legal experts analyze why traditional controls fail against live executive clones.

• October 09, 2026 09 Oct'26

  Unclear AI risk ownership could leave CISOs in familiar scapegoat role

  With no consensus on who owns AI risk, cybersecurity leaders could be exposed. Experts say CISOs need authority over AI security -- not just accountability when it goes wrong.

• October 08, 2026 08 Oct'26

  Pentagon breach exposes failure to follow its own standards

  The Pentagon's DMDC breach exposed millions of records due to failures in basic security controls despite clear DoD cybersecurity standards.

• October 07, 2026 07 Oct'26

  Risk-based alerting slashes SOC noise -- when done right

  A landmark independent study validates risk-based alerting, revealing which scoring strategies cut false positives and which popular vendor rules fail in practice.

• October 06, 2026 06 Oct'26

  CrowdSec breach exposes security blind spots in developer access

  Disabling corporate logins isn't enough. The CrowdSec breach demonstrates how offboarding oversights create quiet, long-term backdoors.

• October 05, 2026 05 Oct'26

  Threat summer 2026: Editors discuss top cyber incidents

  In this edition of the Reporters' Notebook video series, our cybersecurity reporters explore their picks for the most significant security incidents over the summer of 2026.

• October 02, 2026 02 Oct'26

  The CISO dilemma: Why AI speed makes security basics essential

  Insights from the CyberRisk Alliance Summit reveal that AI hasn't rewritten the threat landscape -- it has simply erased the time defenders have to fix basic operational flaws.

• October 02, 2026 02 Oct'26

  Developers facing a patchwork of competing AI safety regulations

  Policymakers are moving swiftly to regulate agentic AI, creating varying mandates across regions and leaving developers to figure out compliance. Experts explain how the industry can keep pace.

• October 01, 2026 01 Oct'26

  Use Cybersecurity Awareness Month as a springboard -- not a fire drill

  National cybersecurity awareness efforts peak in October, but attacks happen year-round. Experts explain how CISOs can use Cybersecurity Awareness Month to build long-term momentum.

• October 01, 2026 01 Oct'26

  Nvidia Sentry's millisecond claim raises AI agent detection questions

  Nvidia's Sentry design promises millisecond AI agent containment, but security experts warn speed offers little protection when valid credentials or detection delays are involved.

• September 30, 2026 30 Sep'26

  August's ransomware activity hit new high for the year

  NCC Group identified 83 ransomware groups active last month, but it said AI wasn't necessarily what drove the increase in the number of bad actors.

• September 29, 2026 29 Sep'26

  Why cybersecurity's future isn't AI vs. humans -- it's both

  AI won't replace cybersecurity analysts; it will augment them. Experts at the Billington Cybersecurity Summit explain why human judgment remains essential.

• September 29, 2026 29 Sep'26

  Security vendors turn to multi-model, open AI to bypass guardrails

  Commercial AI guardrails are blocking legitimate cyberdefense activities. Security vendors are fighting back with multi-model frameworks and open-weight LLMs.

• September 25, 2026 25 Sep'26

  Pulling the plug: Why the AI kill switch might be a dead end

  As lawmakers push to make AI kill switches mandatory, security leaders warn that the "big red button" may be a dangerous illusion. Here’s why policy doesn't match the technical reality.

• September 24, 2026 24 Sep'26

  South Korea's 10% data breach fines raise global compliance challenges

  Tougher penalties aim to drive data breach prevention but add to regulatory fragmentation, pushing firms to build to the strictest global standard.

• September 23, 2026 23 Sep'26

  Hardcoded credentials in public MCP files open door to cyberattacks

  New research reveals thousands of public Model Context Protocol files leak non-expiring credentials on GitHub -- leaving corporate data, private networks and costly AI token pools open to exploitation.

• September 23, 2026 23 Sep'26

  Cybersecurity burnout is an operational threat: AI can help

  Analyst burnout is more than just a wellness issue; it's a critical security risk. At the Billington Cybersecurity Summit, experts discussed how to fix the crisis.

• September 22, 2026 22 Sep'26

  Can 'agent canaries' catch rogue AI before it escapes?

  AI agent canaries could become valuable security tripwires if enterprises treat them as sensors rather than safeguards.

• September 21, 2026 21 Sep'26

  What the AI safety fallout means for enterprise CISOs  

  High-profile resignations and calls for a development slowdown have accelerated the AI safety debate. Here's how security leaders are filtering noise from immediate operational risk.

• September 17, 2026 17 Sep'26

  Revolut breach exposes authentication-authorization gap

  The Revolut data breach showed what can happen when organizations over-trust and under-verify. Experts warn that countless companies are currently at risk.

• September 16, 2026 16 Sep'26

  Cyber budgets flatline as CISOs shift new spending to AI

  AI is absorbing new security spending even as budgets stall, forcing CISOs to rethink how they deploy people, automation and risk dollars.

• September 16, 2026 16 Sep'26

  EU cyber rule exposes gaps in product security operations

  Europe's new reporting rule could establish a global product security standard, but smaller manufacturers and legacy products face the steepest challenge.

• September 14, 2026 14 Sep'26

  CISOs more confident -- and more stressed -- than ever

  Security leaders are growing more confident in their abilities to withstand cyberattacks, yet the pressure on them continues to build. Proofpoint's latest survey of CISOs explains why.

• September 11, 2026 11 Sep'26

  CISA Cyber Storm exercise offers blueprint for enterprise CISOs

  The launch of CISA's Cyber Storm X puts national incident response to the test. For enterprise CISOs, the exercise serves as a practical model for evaluating supply-chain resilience and incident response playbooks under fire.

• September 08, 2026 08 Sep'26

  Billington Summit highlights blurring public-private cybersecurity lines

  At the Billington Cybersecurity Summit, public sector security experts address a threat landscape that no longer distinguishes between government and private targets.

• September 04, 2026 04 Sep'26

  Defenders call out OpenAI defense pledge, Astra release timing

  OpenAI pledged $1B to cyber defenders the same day it released Astra -- its most powerful offensive model yet. Some experts warn that defense is getting left behind.

• August 28, 2026 28 Aug'26

  CISA red team reveals why some SOCs fail and others succeed

  CISA tested two critical infrastructure SOCs with similar red team tactics. The results expose dangerous gaps in detection, response and credential security.

• August 26, 2026 26 Aug'26

  Black Hat 2026: Key news, takeaways and security trends

  This is your guide to the breaking news, trending topics and more at Black Hat USA 2026, from Dark Reading, Cybersecurity Dive and TechTarget Cybersecurity.

• August 25, 2026 25 Aug'26

  Autonomous AI exploits raise stakes for vulnerability management

  AI agents are increasingly finding and exploiting software vulnerabilities. The bigger challenge for security teams is figuring out which of those flaws matter most.

• August 21, 2026 21 Aug'26

  AI attacks lack stealth -- nation-state actors are changing that

  Today's AI attacks are still hard to miss and easy to stop, but nation-state threat actors are quietly pioneering low-and-slow adversarial AI. Learn what the shift means for defenders.

• August 21, 2026 21 Aug'26

  How an emerging industrial protocol family could put OT at risk

  New research shows how attacks against some unprotected TSN protocols could allow attackers to disrupt or manipulate physical processes.

• August 20, 2026 20 Aug'26

  New CUSTODY Framework constrains AI agents inside the network

  Expert Jake Williams explains why he decided to release his new agentic AI framework in the wake of the OpenAI attacks on Hugging Face.

• August 19, 2026 19 Aug'26

  Cutting through the Claude Mythos hype: What it means for CISOs

  In this Reporters' Notebook video, Informa TechTarget journalists discuss what we know -- and don't know -- about Claude Mythos, and what CISOs should do next.

• August 19, 2026 19 Aug'26

  Agentic AI presents new insider threat model for orgs

  Katie Moussouris of Luta Security talks about how enterprises will now need to monitor risks posed by their own agents in the wake of the recent Hugging Face attack.

• August 18, 2026 18 Aug'26

  AI agent security must move beyond human-in-the-loop, experts say

  Human-in-the-loop can't scale with AI agents. Security leaders at Black Hat explained action-driven approaches for managing agentic ecosystems.

• August 18, 2026 18 Aug'26

  The 'industrial accidents' behind rogue AI agent attacks

  Rich Mogull, chief analyst with the Cloud Security Alliance, discusses what defenders need to take away from AI agents escaping their environments to launch attacks.

• August 13, 2026 13 Aug'26

  Black Hat NOC sees AI security failures firsthand

  A disturbing trend is unfolding on the ground at Black Hat's elite network operations center: As AI takes off, cyber-risk is rising too. Here's what the NOC wants CISOs to know.

• August 12, 2026 12 Aug'26

  Behind the scenes at Black Hat's network operations center

  Step inside Black Hat's guarded NOC, where nearly unlimited threats meet unlimited resources, and security experts battle hackers, deploy custom AI agents and mitigate attacks.

• August 11, 2026 11 Aug'26

  CVE Program eyes automation and globalization to weather AI 'vulnpocalypse'

  The vulnerability coordination project has had a rocky few years, but a key leader says it will "flourish and improve."

• August 10, 2026 10 Aug'26

  Civil-society initiative will pay cybersecurity vendors to protect rural water systems

  DEF CON Franklin is seeking philanthropic grants, but its founder said the federal government ultimately needs to step in.

• August 10, 2026 10 Aug'26

  Outdated cybercrime laws put security researchers at risk

  A public policy expert mapped global cybercrime laws to develop a five-point framework for protecting ethical hackers and good-faith security research.

• August 10, 2026 10 Aug'26

  Secure development can help turn the tables as AI alters cyber landscape

  A top Microsoft executive says a shift toward memory safety and other preventative measures can limit the ability to exploit flawed software.

• August 10, 2026 10 Aug'26

  Coruna, DarkSword iOS exploits proliferate globally

  Sophisticated iPhone exploit chains previously limited to nation-states are spreading far and wide to organized cybercrime groups.

• August 07, 2026 07 Aug'26

  Experts say healthcare faces cybersecurity crisis: 'These are patient safety issues'

  Regulatory failures, funding constraints and industry consolidation have created serious hacking risks.

• August 07, 2026 07 Aug'26

  Critical flaws allow hackers to exploit zero-touch provisioning process in TP-Link Omada

  Attacks can cause widespread damage to trusted devices and data.

• August 07, 2026 07 Aug'26

  AI firms know policymakers won't 'let you make a Terminator factory,' DHS official says

  The Trump administration believes leading AI companies have learned important lessons from recent incidents and regulation isn’t necessary to preserve those lessons.

• August 06, 2026 06 Aug'26

  Hackers grow more willing to destroy, not just disrupt, OT systems

  Experts said the alarming trend has further stressed infrastructure providers that are already struggling with strong passwords, comprehensive logging and other basics.

• August 06, 2026 06 Aug'26

  The coordination gap: How attackers are outpacing law enforcement

  The fight against cybercrime continues because threat actors have adapted their strategies to avoid deterrents, but law enforcement still operates in silos.

• August 06, 2026 06 Aug'26

  Researcher claims control of ChatGPT secure sandbox

  A researcher demonstrated a proof-of-concept attack chain that provided C2-style influence over ChatGPT's isolated sandbox during a session at Black Hat USA 2026.

• August 06, 2026 06 Aug'26

  From Bobmojis to bobbleheads: How the Democratic party built a security-first culture

  Two former chief security officers of the Democratic National Committee explain that a strong security-first mindset requires executive support -- and a dose of absurdity.

• August 05, 2026 05 Aug'26

  Western government leaders call for a focus on infrastructure resilience, not AI hype

  U.S. and allied officials said companies should start preparing now for a cyberattack that changes how they provide essential services.

• August 05, 2026 05 Aug'26

  CISA is prioritizing work with critical infrastructure as it begins to recover from cuts

  The agency has been focused on helping secure systems at drinking and wastewater utilities in recent weeks.

• August 05, 2026 05 Aug'26

  White House walks tightrope on securing AI without stifling tech innovation

  National Cyber Director Sean Cairncross said the administration wants to work collaboratively with the private sector.

• August 05, 2026 05 Aug'26

  Western government leaders call for a focus on infrastructure resilience, not AI hype

  U.S. and allied officials said companies should start preparing now for a cyberattack that changes how they provide essential services.

• August 05, 2026 05 Aug'26

  AI sends global crime syndicates into fraud nirvana

  Organized crime is convincingly scamming at scale, making billions thanks to AI-enabled voice cloning, deepfake real-time video overlays, LLM-driven persona management and automated translation.

• August 05, 2026 05 Aug'26

  CSS: The hidden threat lurking in your inbox

  CSS was once just about design. Now researchers warn it's powerful enough to exfiltrate data from webmail -- and some vendors aren't prepared.

• August 05, 2026 05 Aug'26

  15 TP-Link bugs expose risks in zero-trust provisioning

  Researchers are calling attention to the risks inherent in automated network device provisioning, using a world-leading device manufacturer as a case study.

• August 05, 2026 05 Aug'26

  OpenAI warns autonomous hacks are 'watershed moment for computer security'

  Company employees said their industry should rethink how it balances capabilities and safeguards.

• August 05, 2026 05 Aug'26

  No perfect fix for AI browser prompt injection flaws

  AI browsers from top vendors remain vulnerable to prompt injection attacks despite multiple security guardrails, according to new research.

• August 05, 2026 05 Aug'26

  AI browsers vulnerable to 'PleaseFix' zero-click agent hijacking

  Attackers can take control of agents through malicious instructions hidden in content supplied to AI browsers, and there's no simple fix for the threat.

• July 30, 2026 30 Jul'26

  What CISOs should take from the Hugging Face-OpenAI incident

  Security experts say the lesson isn't to abandon sandboxing, but to strengthen the security controls around surrounding systems as AI tests their limits.

• July 23, 2026 23 Jul'26

  OpenAI models escape containment, hack Hugging Face

  In an unprecedented -- and unintended -- cyberattack, frontier AI models autonomously escaped their contained testing environment and breached another company's systems.

• July 20, 2026 20 Jul'26

  Employees' shadow AI use is poorly monitored, survey finds

  Employee behavior has always presented one of the biggest enterprise cybersecurity challenges. Add AI into the equation, and education and governance become even more critical.

• July 17, 2026 17 Jul'26

  Industry reacts to Gold Eagle vulnerability management plan

  As AI-discovered software vulnerabilities accumulate at an unprecedented pace, security pros say they hope Gold Eagle creates some order from the chaos.

• July 10, 2026 10 Jul'26

  ClickFix and removable media lead malware delivery methods

  Now more than ever, defenders must look for suspicious behavior, not specific malware. Learn how to defend against two trending initial access methods.

• July 08, 2026 08 Jul'26

  First fully agentic ransomware attack sparks readiness concerns

  An AI model's autonomous execution of a complete ransomware operation marks a new era. Learn why experts say rapid detection and response, not revolutionary defenses, are key.

• June 26, 2026 26 Jun'26

  NO FAKES Act advances: What CISOs need to know

  As the NO FAKES Act moves to the Senate, the country is closer to real protections against unauthorized AI replica use -- a move that also has enterprise implications.

• June 24, 2026 24 Jun'26

  As Q-Day looms, 90% of systems are unprepared for PQC

  Quantum computing could break encryption in the next several years, and research suggests that few organizations are ready. Experts say CISOs must act now.

• June 18, 2026 18 Jun'26

  Most security pros say their culture is 'just average'

  'The Life and Times of Cybersecurity Professionals' survey assessed how workers feel about defending against constant threats, as well as what's getting better and what is not.

• June 12, 2026 12 Jun'26

  What CISA's new remediation directive means for CISOs

  CISA's updated directive for federal agencies compresses mandatory patching timelines to just three days for high-risk flaws, urging practitioners to 'patch smarter, not harder.'

• June 12, 2026 12 Jun'26

  It's time to update incident response for the AI era

  Your latest cybersecurity incident might not be a threat actor, but an internal AI agent doing what it's authorized to do. Incident response must evolve to accommodate AI.

• June 10, 2026 10 Jun'26

  AI in cyberdefense: Learning from threat actors' playbooks

  At the Gartner Cybersecurity and Risk Management Summit 2026, security professionals learned how to use AI to counter the AI-fueled cyberattacks directed against them.

• June 10, 2026 10 Jun'26

  Gartner Security & Risk Management Summit 2026: Adapting for AI

  Check out SearchSecurity's Gartner Security & Risk Management Summit guide for reports on notable presentations and sessions on the latest security topics.

• June 08, 2026 08 Jun'26

  CISO role changes as cyber-risk appetites in the C-suite grow

  As cybersecurity fears in the C-suite wane, the cyber-risk appetites of executives and boards are changing. Find out what it means for cybersecurity spending and the CISO role.

• June 05, 2026 05 Jun'26

  Researchers build autonomous AI worm that can reason and adapt

  University of Toronto researchers created a proof-of-concept AI worm that dynamically identifies vulnerabilities and adapts its attack strategies. Here's what it means for enterprises.

• June 03, 2026 03 Jun'26

  Lost in translation: Cybersecurity board reporting for CISOs

  Cybersecurity board reports don't always land. At the Security and Risk Management Summit 2026, Gartner analysts suggested a novel way to communicate cyber-risk to corporate directors.

• May 29, 2026 29 May'26

  EO 14390 raises stakes for enterprise cybersecurity

  Reframing cybercrime as a national security issue, EO 14390 could lead to stronger links between government and the private sector. Find out what it means for enterprise security.

• May 29, 2026 29 May'26

  First month of Mythos Preview testing exposes 10K flaws

  Anthropic's Mythos Preview exposed 10,000-plus security flaws at tech giants in one month, revealing both opportunities and risks for the future of cybersecurity.

• May 27, 2026 27 May'26

  OT attacks shift from recon to physical control, raising stakes

  Malicious hackers are no longer just snooping around OT systems, researchers warn. They're preparing to cause real-world damage.

• May 27, 2026 27 May'26

  For CISOs, dawn of OpenAI Daybreak brings good and bad news

  OpenAI Daybreak shows how AI reshapes vulnerability discovery. But AI-driven security tools raise accountability questions and fuel the AI arms race between defenders and attackers.

• May 22, 2026 22 May'26

  Verizon 2026 DBIR: 6 key takeaways for CISOs

  The 2026 DBIR -- practically required reading for CISOs -- identifies critical enterprise security trends, from exploit-driven breaches to shadow AI dangers and third-party risks.

• May 15, 2026 15 May'26

  Instructure cyberattack reignites ransom payment debate

  Instructure struck a deal to recover its stolen data -- likely paying a hefty ransom. For CISOs, deciding whether to negotiate with cybercriminals should come down to business risk.

• May 08, 2026 08 May'26

  News brief: Security worries and warnings as AI use expands

  Check out the latest security news from TechTarget SearchSecurity's sister sites, Cybersecurity Dive and Dark Reading.

• May 01, 2026 01 May'26

  News brief: Critical infrastructure, OT cybersecurity attacks

  Check out the latest security news from TechTarget SearchSecurity's sister sites, Cybersecurity Dive and Dark Reading.

• April 24, 2026 24 Apr'26

  News brief: AI woes continue for security leaders

  Check out the latest security news from TechTarget SearchSecurity's sister sites, Cybersecurity Dive and Dark Reading.

• April 17, 2026 17 Apr'26

  At RSAC 2026, AI optimism and anxiety -- and an MIA U.S. government

  Depending on whom you ask, AI could mean the end of the world as we know it, or the beginning of a new era of ease and enlightenment in the SOC. Learn more in this video discussion.