Dark Reading Newsletter
- Get link
- X
- Other Apps
"Can Shadow AI risks be stopped?"
Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents. Accessed on 30 September 2025, 1509 UTC.
Content and Source provided by email subscription from https://feedly.com.
https://feedly.com/i/subscription/feed%2Fhttp%3A%2F%2Fwww.darkreading.com%2Frss%2Fall.xml
URL--https://www.darkreading.com
Please check subscription link, URL, or scroll down to read your selections. Thanks for joining us today.
Russ Roberts (https://www.hawaiicybersecurityjournal.net).
61
Today
by Arielle Waldman / 1h
Agentic AI has introduced abundant shadow artificial intelligence (AI) risks. Cybersecurity startup Entro Security extends its platform to help enterprises combat the growing issue.
by Elizabeth Montalbano, Contributing Writer / 1h
Flaws in individual models of Google's AI suite created significant security and privacy risks for users, demonstrating the need for heightened defenses.
Yesterday
by Kristina Beek / 8h
A researcher-developed framework could enable attackers to conduct real-time conversations using simulated audio to compromise organizations and extract sensitive information.
by Arielle Waldman / 17h
The Internet of Things (IoT) has made everything more interconnected than ever, but an important US government security initiative is stuck in limbo even as threat actors step up attacks on everything from medical gear to printers.
The first known malicious MCP server is an AI integration tool that automatically sends email such as those related to password resets, account confirmations, security alerts, invoices, and receipts to threat actors.
Akira ransomware actors are currently targeting SonicWall firewall customers vulnerable to a bug discovered last year.
2 TTPs
by Elizabeth Montalbano, Contributing Writer / 23h
Attackers impersonate the National Police of Ukraine to deploy Amatera Stealer and PureMiner, using malicious Scalable Vector Graphics to trick victims.
Sep 26, 2025
Three international vehicle manufacturers have fallen to supply chain cyberattacks in the past month alone.
by Rob Wright / 3d
Security researchers say multiple threat groups, including Iran's Charming Kitten APT offshoot Subtle Snail, are deploying malware with code-signing certificates from the Houston-based company.
by Robert Lemos, Contributing Writer / 3d
The world's most-popular sports contest starts in June 2026 across 16 venues in three countries: Securing the event infrastructure from cyber threats will require massive collaboration.
Sep 25, 2025
Patch now: Cisco recently disclosed four actively exploited zero-days affecting millions of devices, including three targeted by a nation-state actor previously discovered to be behind the "ArcaneDoor" campaign.
Yet again researchers have uncovered an opportunity (dubbed "ForcedLeak" for indirect prompt injection against autonomous agents lacking sufficient security controls — but this time the risk involves PII, corporate secrets, physical location data, and so much more.
The China-linked cyber-espionage group UNC5221 is compromising network appliances that cannot run traditional EDR agents to deploy new versions of the "Brickstorm" backdoor.
by Robert Lemos, Contributing Writer / 5d
Outages affecting DevOps tools threaten to leave developers coding like it's 1999. How serious is the threat and what can companies do?
Sep 24, 2025
by Nate Nelson, Contributing Writer / 5d
"RedNovember" is both lazy and punctual: always quick to do its homework on new vulnerabilities, but always getting the answers from cyber defenders.
by Rob Wright / 5d
Threat actors exploited CVE-2024-36401 less than two weeks after it was initially disclosed and used it to gain access to a large federal civilian executive branch (FCEB) agency that uses the geospatial mapping data.
by Kristina Beek / 5d
The cybercrime group continues to gain attention despite its apparent shutdown last week.
Researchers have tracked a Russian disinformation campaign against upcoming Moldovan elections, linking it to a previous campaign that began in 2022.
The poisoned package, purporting to be a JavaScript utility, threatens the software supply chain with a highly obsfuscated credential stealer.
Hackers tracked as UNC6148 are attacking SonicWall security devices by installing hidden software, allowing them to control systems, steal passwords, and hide their activities.
Sep 23, 2025
by Robert Lemos, Contributing Writer / 6d
The Japanese government suffered the most cybersecurity incidents in 2024 — 447, nearly double the previous year — while failing to manage 16% of critical systems.
GitHub will address weak authentication and overly permissive tokens in the NPM ecosystem, following high-profile threat campaigns like those involving Shai-Hulud malware.
The for-hire platform leverages legitimate cloud-native tools to make detection and disruption harder for defenders and SOC analysts.
by Kristina Beek / 6d
Cybersecurity leader Jason Manar shares insights on diverse career paths, essential skills, and practical advice for entering and thriving in the high-stress yet rewarding field of cybersecurity.
by Dark Reading Staff / 6d
Dark Reading Confidential Episode 10: It’s past time for a comprehensive plan to protect vital US systems from nation-state cyberattacks, and increasingly, that responsibility is falling to asset owners across a vast swath of organizations, who likely never bargained for an international cyber conflict playing out in their environments. But here we are. And here's what comes next, according to Fra
In Operation Rewrite, an unspecified actor is using legitimate compromised Web servers to deliver malicious content to visitors for financial gain.
Sep 22, 2025
by Jai Vijayan, Contributing Writer / 7d
"Nimbus Manticore" is back at it, this time with improved variants of its flagship malware and targets that are outside its usual focus area.
by Arielle Waldman / 7d
Zero Trust could help organizations fight back against attackers who use artificial intelligence, but new threats will require the architecture to evolve.
Threat actors are using a large-scale SEO poisoning campaign and fake GitHub repositories to deliver Atomic infostealers to Mac users.
Major EU airports such as Heathrow were disrupted over the weekend after a cyberattack hit the provider of check-in kiosk software, which caused delays and flight cancellations.
by John Kindervag / 8d
With the emergence of AI-driven attacks and quantum computing, and the explosion of hyperconnected devices, zero trust remains a core strategy for security operations.
Sep 19, 2025
Exploitation of the flaw, tracked as CVE-2025-10035, is highly dependent on whether systems are exposed to the Internet, according to Fortra.
by Arielle Waldman / 10d
As Splunk celebrates the 10th anniversary of Boss of the SOC competition, it continues to be a valuable platform for security professionals to test their skills, learn new techniques, and potentially advance their careers.
by Nate Nelson, Contributing Writer / 10d
The loophole allows cyberattackers to exfiltrate company data via OpenAI's infrastructure, leaving no trace at all on enterprise systems.
by Rob Wright / 11d
While the cloud vulnerability was fixed prior to disclosure, the researcher who discovered it says it could have led to catastrophic attacks, alarming some in the security community.
by Robert Lemos, Contributing Writer / 11d
Following a pandemic-era respite, financial fraud linked to synthetic identities is rising again, with firms potentially facing $3.3 billion in damages from new accounts.
by Nate Nelson, Contributing Writer / 11d
A Charming Kitten subgroup is performing some of the most bespoke cyberattacks ever witnessed in the wild, to down select high-value targets.
by Mick Baccio / 11d
Frameworks may seem daunting to implement — especially for government IT teams that may not have an abundance of resources and expertise. But beginning implementation is better than never starting.
by Ericka Chickowski, Contributing Writer / 11d
The former CIA deputy director for digital innovation discusses resilience, cultural shifts, and cyber fundamentals in the AI era.
Sep 18, 2025
by Jai Vijayan, Contributing Writer / 11d
The proposed restructuring plan would address many concerns related to the social media platform, but risks remain for security teams.
Threat actors breached the MySonicWall service and accessed backup firewall configuration files belonging to "fewer than 5%" of its install base, according to the company.
by Richard Thurston / 12d
Digital forensics offers a challenging but rewarding career path for cybersecurity professionals willing to invest in specialized knowledge and continuous learning.
by Robert Lemos, Contributing Writer / 12d
The cloud now acts as the connecting infrastructure for many companies' assets — from IoT devices to workstations to applications and workloads — exposing the edge to threats.
- Get link
- X
- Other Apps
Comments
Post a Comment
Please leave a comment about our recent post.