30
30
55
30
30
30
42
30
30
30
Security through obscurity is dead, and AI delivered the fatal blow
AI agents are killing security through obscurity, accelerating vulnerability discovery and patch-gap exploitation, experts warn, with OT/ICS systems most at risk.
An opinion/analysis piece arguing AI has made security through obscurity obsolete, citing record vulnerability disclosure volumes after Microsoft's Patch Tuesday addressed 974 CVEs. FBI Cyber Division assistant director Brett Leatherman said latest AI models found significant vulnerabilities in open source libraries running on most web servers. The article cites at least four espionage crews (most suspected China-linked) exploiting Chromium's patch-gap window with a rapid exploit kit, and a five-agency advisory on AI-generated exploitation scripts breaching internet-exposed Siemens S7 Series PLCs at water, manufacturing, and energy facilities. Experts including John Hultquist, Chris Inglis, and Katie Moussouris warn AI erodes the expertise barrier protecting obscure OT/ICS systems while defensive AI patching lags, with studies showing AI-generated patches fail more than half the time.
52
30
30
30
The Vulnpocalypse Is Repricing the Bug Bounty Economy
Surging AI-generated vulnerability reports are driving down bug bounty payouts, threatening the economics of independent security researchers.
Dark Reading argues that a surge of AI-powered vulnerability reports is repricing the bug bounty economy. As programs absorb escalating report volume, payouts for many classes of findings are falling. The trend could undermine the livelihoods of independent full-time bug bounty researchers.
30
30
30
30
30
Just a rumour of a bug is enough to find a security exploit these days
Commentary argues that an unverified rumor of a software bug is now enough for researchers or attackers to develop a working exploit.
A short blog note reflects on how modern exploit development has accelerated to the point that even a mere rumor of a vulnerability can be enough to locate and weaponize a bug. The piece is commentary on the current state of security research and attacker trends rather than a disclosure of a specific flaw.
15
Playstation Announces Bug Bounty
Sony's PlayStation announced a bug bounty program; the article text was unavailable so program details are unconfirmed.
Infosecurity Magazine's headline reports that PlayStation announced a bug bounty program. The full article text was unavailable, so details such as reward tiers, scope, and platform could not be verified. A vendor bug bounty launch is industry news relevant to researchers seeking disclosure channels.
20
30
30
30
30
Mythos has made 2026 patching hell. It might make 2027 a breeze
Gartner analyst Craig Lawson argues AI bug-hunters like Anthropic's Mythos have audited major codebases so thoroughly that 2027 could see fewer severe vulnerabilities.
Speaking at Gartner's IT Symposium in Australia, research VP Craig Lawson said AI-driven bug hunting, exemplified by Anthropic's Mythos, is uncovering flaws at unprecedented scale, citing Microsoft shipping over 970 patches in one week and a recent series of CVEs in historically secure OpenBSD. He argued vendors are also using AI to find bugs before release, retiring technical debt and shrinking future zero-day avenues. Lawson predicts 2027 may be the first year with a net drop in vulnerability severity, if not aggregate counts. He also expects AI to enable near-continuous red-teaming and faster fixes, such as generating F5 iRule syntax for virtual patches via Gemini.
28
Microsoft Offers Up to $30,000 for Critical AI Flaws in Dynamics 365 and Power Platform
Microsoft expands AI bug bounty to Dynamics 365 and Power Platform, paying up to $30,000 for critical inference manipulation flaws.
Microsoft's bug bounty program offers up to $30,000 for critical 'Inference Manipulation' or 'Inferential Information Disclosure' bugs in Dynamics 365 and Power Platform, including Copilot Studio, AI Builder, Power Apps, Power Automate, and Dataverse. Payouts scale by report quality ($30,000/$20,000/$12,000 for critical) with important-severity AI flaws earning $6,000-$20,000, plus 20% multipliers for Dataverse privilege escalation and Plugin Sandbox escapes. Prompt injection affecting only the attacker, hallucinated execution, and system-prompt disclosure are excluded from scope.
25
ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories
Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.
Socket found four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) stealing session tokens and wallet data from Axiom Trade and Padre users via attacker-controlled Vercel deployments. Hunt.io reported a Chinese-speaking operator using Claude Code, Alibaba Qwen, and DeepSeek with the SecFlow orchestration framework to automate intrusions against government and financial targets in Afghanistan, Thailand, Taiwan, and the US. The UK NCSC warned shadow AI use risks breaches and regulatory failure, Microsoft announced privacy-preserving Windows Age APIs, and Gen Digital described fake M&A wire-fraud scams. A 119,000-domain fake-shop operation called DoppelCart was also highlighted.
25
30
30
30
30
30
30
30
30
55
42
30
30