WordPress Auto Alt Text plugin cross-site request forgery vulnerability

WordPress Auto Alt Text plugin is a tool that uses artificial intelligence technology to automatically generate alternative text AltText for website images. The WordPress Auto Alt Text plugin suffers from a cross-site request forgery vulnerability, which arises from a web application that does no...

Warnings Mount in Congress Over Expanded US Wiretap Powers

Experts tell US lawmakers that a crucial spy program’s safeguards are failing, allowing intel agencies deeper, unconstrained access to Americans’ data...

CVE-2025-66446

MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow attackers to overwrite the built-in dynamic linker and other critical files, potentially resulting in privilege escalation. This issue is fixed in version 2.4.0...

How Akamai Is Powering Trust in Tomorrow’s AI-Driven Ecosystem

Discover how Akamai powers secure, trusted AI interactions by verifying bots and agents, enabling adaptive trust, and supporting new monetization opportunities...

Imposter for hire: How fake people can gain very real access

In the latest edition of our Cyberattack Series, we dive into a real-world case of fake employees. Cybercriminals are no longer just breaking into networks—they’re gaining access by posing as legitimate employees. This form of cyberattack involves operatives posing as legitimate remote hires,...

Scale AI Securely with Qualys TotalAI’s Streamlined Onboarding, Deeper Risk Detection, and Compliance-Ready Reporting

Executive Summary Enterprises are entering a phase where AI systems function as decision engines that shape customer interactions, operational workflows, and business outcomes. This creates a new class of risk that is behavioral, contextual, and dynamic, driven by how models interpret instruction...

The Year in Review 2025: AI, APIs, and a Whole Lot of Audacity

...

From awareness to action: Building a security-first culture for the agentic AI era

The insights gained from Cybersecurity Awareness Month, right through to Microsoft Ignite 2025, demonstrate that security remains a top priority for business leaders. It serves as a strategic lever for organizational growth, fosters trust, and facilitates the advancement of AI innovation. The Wor...

FBI Warns of Fake Video Scams

The FBI is warning of AI-assisted fake kidnapping scams: Criminal actors typically will contact their victims through text message claiming they have kidnapped their loved one and demand a ransom be paid for their release. Oftentimes, the criminal actor will express significant claims of violence...

Webinar: How Attackers Exploit Cloud Misconfigurations Across AWS, AI Models, and Kubernetes

Cloud security is changing. Attackers are no longer just breaking down the door; they are finding unlocked windows in your configurations, your identities, and your code. Standard security tools often miss these threats because they look like normal activity. To stop them, you need to see exactly...

Malicious GenAI Chrome Extensions: Unpacking Data Exfiltration and Malicious Behaviours

The rapid proliferation of AI and GenAI tools has extended to the Chrome Web Store. Cybercriminals are exploiting this trend, deploying malicious Chrome extensions posing as AI tools or impersonating popular GenAI models to target users. These extensions often appear legitimate while secretly...

Changing the physics of cyber defense

The Deputy CISO blog series is whereMicrosoft Deputy Chief Information Security Officers CISOs share their thoughts on what is most important in their respective domains. In this series, you will get practical advice, tactics to start and stop deploying, forward-looking commentary on where the...

Changing the physics of cyber defense

The Deputy CISO blog series is whereMicrosoft Deputy Chief Information Security Officers CISOs share their thoughts on what is most important in their respective domains. In this series, you will get practical advice, tactics to start and stop deploying, forward-looking commentary on where the...

Build a Proactive Vulnerability Management Program

You wouldn't build a fortress without a blueprint. Yet, many organizations approach cybersecurity by simply buying tools—the digital bricks and mortar—without a clear plan for how they all fit together. This leaves gaps in your defenses that attackers are quick to find. A vulnerability management...

Stripo Inc: [Critical] Unauthorized Cross-Tenant Data Access in Stripo AI Hub Campaign via Deleted Project.

An unauthorized cross-tenant data access vulnerability was discovered in the Stripo AI Hub Campaign. The vulnerability allowed access to data from a deleted project. The issue was resolved...

CVE-2025-62994

CVE-2025-62994 relates to the WordPress plugin WP AI CoPilot (ai-co-pilot-for-wp) with versions up to and including 1.2.7. The issue is described as an insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data (information disclosure). The CVSS 3.1 vector in...

CVE-2025-42896 Server-Side Request Forgery (SSRF) in SAP BusinessObjects Business Intelligence Platform

SAP BusinessObjects Business Intelligence Platform lets an unauthenticated remote attacker send crafted requests through the URL parameter that controls the login page error message. This can cause the server to fetch attacker-supplied URLs, resulting in low impact to confidentiality and integrit...

PT-2025-51478

Уязвимость платформы бизнес-аналитики SAP BusinessObjects Business Intelligence связана с неправильным кодированием или экранированием выходных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, осуществить SSRF-атаку...

CVE-2025-42896: Improper Encoding or Escaping of Output

SAP BusinessObjects Business Intelligence Platform lets an unauthenticated remote attacker send crafted requests through the URL parameter that controls the login page error message. This can cause the server to fetch attacker-supplied URLs, resulting in low impact to confidentiality and integrit...

Chrome Zero-Day Vulnerability: Risks & Protection

Your team knows the drill: a security alert goes out, and everyone scrambles to patch. But what happens in the critical window before a fix is available for a new Chrome zero-day vulnerability? Relying on a reactive cycle of patching leaves your organization dangerously exposed. Attackers thrive ...