SecurityWeek

A code reuse issue enabled comma characters in certificate principals to be interpreted as list separators.

The tech giant found that many indirect prompt injection attempts are harmless, but some malicious exploits have also been identified.

Itron, which serves utilities and cities around the world, discovered unauthorized access to its systems on April 13.

The threat actor infected victims with the Snow malware family – Snowbelt, Snowglaze, and Snowbasin – for persistent access.

A race condition in PackageKit allows unprivileged users to escalate privileges when installing packages.

US conducts sweeping crackdown on Southeast Asian cyberscam operations as part of what officials say is a “new theater of war”.

The vulnerability is tracked as CVE-2026-6770 and it has been patched with the release of Firefox 150 and Tor 15.0.10.

Dubbed GopherWhisper, the group relies on multiple Go-based backdoors alongside custom loaders and injectors.

It targeted high-precision calculation software to tamper with results and packed a self-propagation mechanism.

Other noteworthy stories that might have slipped under the radar: Supreme Court hacker sentenced, Lovable exposed user data, Google expands enterprise security. 

From autonomous code generation to decision-making systems that initiate actions without human intervention, the industry is entering a new phase.

Locked Shields has grown significantly over the past 16 years, with only four nations participating in the first edition.

The malware provides remote access and control of infected devices and maintains post-patching persistence.

The Trump administration is vowing to crack down on foreign tech companies’ exploitation of U.S. artificial intelligence models.

CrowdStrike has fixed a critical LogScale vulnerability, while Tenable addressed a high-severity Nessus flaw.