Windows starts asking for admin rights where it shouldn’t after security fix Summary Microsoft’s August 2025 Windows Security Update fixed CVE-2025-50173 — an authentication issue in Windows Installer that could…
Microsoft inches toward Rusty Windows drivers, production use still a no-no Summary Microsoft is steadily improving tooling and examples for writing Windows drivers in Rust, but the effort remains immature…
Boffins build automated Android bug hunting system Summary Researchers from Nanjing University and The University of Sydney have built A2, an agentic AI system that automates discovery and validation of…
Summary Unknown actors have been exploiting a configuration weakness in multiple Sitecore products (XM, XP, XC and Managed Cloud) to achieve remote code execution by using publicly documented ASP.NET machine…
AI code assistants make developers more efficient at creating security problems Summary Application security firm Apiiro analysed tens of thousands of repositories and several thousand developers at Fortune 50 companies…
Knock-on effects of software dev break-in hit schools trust Summary A cyberattack on Hull-based developer Intradev, detected on 4 August 2025, has had knock-on effects for UK schools after sensitive…
Proof-of-Concept in 15 Minutes? AI Turbocharges Exploitation Summary An AI-driven offensive research system developed by two independent Israeli researchers — dubbed Auto Exploit — combines CVE advisories, open-source patches and…
Proof-of-Concept in 15 Minutes? AI Turbocharges Exploitation Summary An AI-driven offensive research pipeline developed by two Israeli researchers—dubbed Auto Exploit—uses LLM prompts, CVE advisories and open-source patches to generate proof-of-concept…
ISC2 Aims to Bridge DFIR Skill Gap with New Certificate Summary ISC2 has launched the Threat Handling Foundations Certificate — a four-course programme designed to strengthen Digital Forensics and Incident…
Phishing Empire Runs Undetected on Google, Cloudflare Summary Researchers at Deep Specter uncovered a multi-year, industrial-scale phishing-as-a-service (PhaaS) operation that ran undetected on public cloud infrastructure for more than three…
