🕵️ RESEARCH & DEEP DIVES
AI risks topped security leaders' concerns at CrowdStrike's Fal.Con 2026 conference
A Security Boulevard post recaps the AI risk questions security leaders raised at CrowdStrike's Fal.Con 2026.- Applies to security leaders evaluating AI adoption, based on conversations at CrowdStrike's Fal.Con 2026 user conference.
- AI risks were the top concern, framed as three key questions the author posed in a conference presentation.
- The author's company demonstrated its integration with the CrowdStrike Falcon platform at the event.
Surfshark VPN says hackers breached internal testing, proxy servers — BleepingComputer
Microsoft Excel KB5002914 update breaks copy and paste for some users — BleepingComputer
ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories — The Hacker News
VU#687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks — CERT/CC Vulnerability Notes
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected ... — CVE ThreatInt
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discr... — CVE ThreatInt
Server-side request forgery in the Session Manager port forwarding functional... — CVE ThreatInt
Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass thr... — CVE ThreatInt
GridFS data disclosure and deletion via query-operator injection in file IDs ... — CVE ThreatInt
Heap buffer overflow via wrapped size check during SASL username canonicaliza... — CVE ThreatInt
Application denial of service via cancellation race in reactive client-side e... — CVE ThreatInt
GridFS data deletion via query-operator injection in file IDs in the MongoDB ... — CVE ThreatInt
Unauthorized document disclosure via query-operator injection in polymorphic ... — CVE ThreatInt
AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in Me... — CVE ThreatInt
Mass deletion and overwrite of embedded documents via query-operator injectio... — CVE ThreatInt
Regular expression injection via unescaped characters in LINQ query translati... — CVE ThreatInt
Tesseract: Denial of service via empty-stack dereference in Plumbing/Series a... — CVE ThreatInt
Protecting organizations from AI-assisted executive impersonation and invoice fraud — Microsoft Security Blog
Detect and disrupt AI-themed attacks with Microsoft Defender — Microsoft Security Blog
Reddit is becoming post after post after post of people getting their computer infected via ClickFix. — @GossiTheDog@cyberplace.social
🕵️♂️ SonicWall SMA1000 (CVE-2026-15409): SSRF to Erlang RCE chained into automated DCSync from the appliance — r/netsec
Critical SAML Signature Bypass in passport-saml-encrypted — thehackerwire.com (discovered)
rclone AuthProxy Bypass in FTP/S3 Serve Interfaces (CVE-2026-88044) — thehackerwire.com (discovered)
Why Regulating AI in Elections Hasn’t Worked — securityboulevard.com (discovered)
Please, don't reply to express personal opinions about Apple or the quality of the Passwords app. — @dangoodin@infosec.exchange
Backing up your Mac keychain is a lot more restrictive under Tahoe and Golden Gate, according to a new blog. — @dangoodin@infosec.exchange
Microsoft said it disrupted a BEC campaign involving 1m+ emails "using AI to amplify long-standing fraud techniques... — @metacurity@infosec.exchange
Chinese AI Giants Accused of Sending Millions of User Queries to U.S. — @metacurity@infosec.exchange
"Anthropic said it disrupted several potential plots this year by scientists who used its leading AI models to conduct... — @metacurity@infosec.exchange