The exploitation activity follows attacks earlier this summer on two other zero-day vulnerabilities in the vendor's edge devices.

In one attack, threat actors stole an API key that ultimately led to the consumption of $600,000 in public AI model credits for the security nonprofit.

The ClickFix-style campaign features a sophisticated, multistage attack chain that includes reverse tunnels into victim organizations' networks.

The surge in AI-powered vulnerability reports is driving down bug bounty prices, and that could spell trouble for independent researchers.

North Korean operatives posing as IT workers are improving their tactics, but researchers say there are still ways to spot them before they do damage.

The international law enforcement operation focused on disrupting crime-as-a-service networks and infrastructure behind groups like Black Axe.

ClickFix-style threat campaigns are using a new trick to evade detection and deliver Amatera, an increasingly prevalent infostealer.

The new AI security controls follow the Hugging Face incident last month, though experts say many of these additions should have been in place prior to the frontier models escaping.

In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, including some scary airplane security risks and the US government's newest "hack back" strategy.

The AI company officially forbids illicit use, while offering guardrail-free social engineering, offensive cybercrime, and OSINT scanning to anyone with a bit of cryptocurrency.

Researchers discovered a "meta-hacking" technique that can manipulate the AI service into revealing its own security weaknesses.

A ransomware affiliate appears to be sidling up to victims with offers of aid, masking its true intention of diverting ransom payments.

Attacks targeting water systems just keep flowing across a dozen states, against ill-secured, Internet-exposed PLCs.

Sophisticated iPhone exploit chains previously limited to nation-states are spreading far and wide to organized cybercrime groups.

A researcher demonstrated a proof-of-concept attack chain that provided C2-style influence over ChatGPT's isolated sandbox during a session at Black Hat USA 2026.

AI browsers from top vendors remain vulnerable to prompt injection attacks despite multiple security guardrails, according to new research.

Over the weekend, the vendor discovered another vector of authentication bypass CVE-2026-18577 that gives attackers administrator access.

The organization behind Team USA's Olympic/Paralympic fencing teams has automated identity verification to handle growing membership, cutting manual review time while ensuring athletes compete in the correct categories.

In this edition of Reporters' Notebook, our journalists discuss the ins and outs of Anthropic's Claude Mythos rollout. How seriously should we take its risks? How big of a deal is it?

OpenAI's goal-seeking agent compromised a Modal customer environment and others during its sandbox escape.

OpenAI's recent AI agent sandbox escape proves traditional security principles matter more than ever: limit access, isolate execution, log everything.