A Risk Manager for Intrusion Tolerant Systems: Enhancing HAL 9000 with New Scoring and Data Sources

Intrusion Tolerant Systems ITSs have become increasingly critical due to the rise of multi-domain adversaries exploiting diverse attack surfaces. ITS architectures aim to tolerate intrusions, ensuring system compromise is prevented or mitigated even with adversary presence. Existing ITS solutions...

IBM Concert Software 安全漏洞

IBM Concert Software is IBM's generative AI-driven automated application management and monitoring tool based on the WatsonX platform, focused on optimizing the operational efficiency and reliability of applications. IBM Concert Software suffers from an excessive data exposure vulnerability that...

Beneath the Mask: Can Contribution Data Unveil Malicious Personas in Open-Source Projects?

In February 2024, after building trust over two years with project maintainers by making a significant volume of legitimate contributions, GitHub user "JiaT75" self-merged a version of the XZ Utils project containing a highly sophisticated, well-disguised backdoor targeting sshd processes running...

Exploit for CVE-2025-32778

CVE-2025-32778 - Web-Check Command Injection Exploit !Criti...

CVE-2025-8675

Server-Side Request Forgery SSRF vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.This issue affects AI SEO Link Advisor: from 0.0.0 before 1.0.6...

Zero Trust + AI: Privacy in the Age of Agentic AI

We used to think of privacy as a perimeter problem: about walls and locks, permissions, and policies. But in a world where artificial agents are becoming autonomous actors — interacting with data, systems, and humans without constant oversight — privacy is no longer about control. It's about trus...

New NIST Concept Paper Outlines AI-Specific Cybersecurity Framework

NIST has released a concept paper for new control overlays to secure AI systems, built on the SP…...

The Edge of Agency: Defending Against the Risks of Agentic AI

...

Malicious code in device-intelligence (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-6922 Malicious code in device-intelligence (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in intel-ai-assistant-ui (npm)

The package intel-ai-assistant-ui was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

Malicious code in @zalastax/nolb-ai_ (npm)

The package @zalastax/nolb-ai was found to contain malicious code...

Malicious code in generator-watson-news-intelligence (npm)

The package generator-watson-news-intelligence was found to contain malicious code...

MAL-2025-23268 Malicious code in intel-ai-assistant-ui (npm)

The package intel-ai-assistant-ui was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

CVE-2025-24923

Uncontrolled search path in some IntelR AI for Enterprise Retrieval-augmented Generation software may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2025-27559

Incorrect default permissions for some AI Playground software before version v2.3.0 alpha may allow an authenticated user to potentially enable escalation of privilege via local access...

What happened in Vegas (that you actually want to know about)

Welcome to this week's edition of the Threat Source newsletter. Last week I flew 5,000 miles to Las Vegas for Black Hat USA. After navigating the casino carpet labyrinth and finding the only venue in Nevada that serves a proper English breakfast tea with milk lifesaver, I've decided Black Hat fee...

Moderate: Red Hat Security Advisory: RHOAI 2.23.0 - Red Hat OpenShift AI

Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 2.23.0 provides these changes:...

Inside Grammarly’s AI-driven automation with the MCP Server for Wiz

Meet the system that cut manual triage times by 90% and enables engineers to focus on strategic thinking...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 4, 2025 to August 10, 2025)

Calling all Vulnerability Researchers and Bug Bounty Hunters! Spring into Summer with Wordfence! Now through September 4, 2025, earn 2X bounty rewards forall in-scope submissions from our 'High Threat' list in software with fewer than 5 million active installs. Bounties up to $31,200 per...