Search: “awareness”

27 stories in the last 24h

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI safety & security 5 Industry 4 Exploit / PoC 4 Phishing & fraud 3 Vulnerability 2 AI research 2 Data breach 2 AI policy 1 Malware 1 AI industry 1 Policy & legal 1 Threat actor 1 Advisory 1

SeverityAll critical 1 high 8 medium 4 low 1 info 14

Dreaming the Sound of Contact: Leveraging Video and Audio Generation for Zero-Shot Force-Aware Manipulation and Data Generation

Pipeline pairs generated video with audio-derived force profiles to enable zero-shot, force-aware robot manipulation on Franka Panda for contact-rich tasks.

The paper leverages generated video and audio jointly: loudness of generated contact sounds shapes a bounded, time-varying desired-force profile from a natural-language task prompt. Trajectories execute on a Franka Panda robot with a closed-loop force regulator tracking the audio-shaped profile, succeeding where a kinematic-only baseline fails. The pipeline also serves as a data generation engine to train closed-loop manipulation policies.

arXiv cs.AI / cs.LG / cs.CLSep 16, 17:56 UTC · 13h agoAI research

Prepared Or Unprepared? Evaluating Healthcare Workforce Readiness for Clinical Adoption of Artificial Intelligence in Nigeria

Survey of 761 Nigerian healthcare professionals finds high AI awareness (92.6%) but limited knowledge, preparedness, and major training and infrastructure barriers.

A cross-sectional study of 761 healthcare professionals across Nigeria, conducted from December 2025 to March 2026, found 92.6% awareness of AI in healthcare but 40.9% reporting low knowledge and only 63.0% feeling adequately prepared. Top barriers were lack of training (84.7%), poor infrastructure (71.1%), and high tool costs (61.0%). Willingness to adopt was strong, with 92.5% interested in training and 78.7% supporting AI in undergraduate curricula; preparedness differed significantly across geopolitical zones and professions.

arXiv cs.AI / cs.LG / cs.CLSep 16, 17:30 UTC · 13h agoAI research

Underwriting Superintelligence: Backing Agents you can Sue — Rune Kvist, AIUC

AIUC raised a $40 million Series A to build AIUC-1, an agent security standard backed by insurance, serving Cursor, Harvey, Lovable, and ElevenLabs.

AIUC, cofounded by former Anthropic product hire Rune Kvist, announced a $40 million Series A led by Ribbit Capital and First Harmonic. The startup builds AIUC-1, an emerging standard for agent security, safety, and reliability, stress-testing agents for jailbreaks, hallucinations, and data leaks. It pairs standards with insurance underwriting through Lloyd's of London and counts Cursor, Harvey, Lovable, and ElevenLabs among its customers. Kvist argues trust and liability, not capability, are becoming the binding constraint on AI adoption.

Latent SpaceSep 16, 18:07 UTC · 13h agoAI industry 2 sources

Windows 11 KB5124008 update breaks domain trust for some users

Microsoft is investigating Windows 11 KB5124008 breaking Active Directory domain trust, leaving some users unable to log in with valid credentials.

Administrators report the Windows 11 KB5124008 security update breaks the secure channel between domain-joined machines and Active Directory, causing login failures on Windows 11 25H2 systems after reboot. The failures are linked to the Machine Identity Isolation feature, which in enforcement mode moves machine account secrets into Credential Guard and removes the LSA copy; one admin saw 11 of roughly 256 devices affected. Workarounds include setting MachineIdentityIsolation to 0 and repairing the secure channel with Test-ComputerSecureChannel, though Microsoft has confirmed no root cause or official fix and warns disabling the feature can also break domain authentication.

BleepingComputerupdated 00:29 UTC · 6h agofirst Sep 16, 20:39 UTC · 10h agoVulnerability 2 sources

12 Best CASB Solutions Compared (2026): Features & Pricing

GBHackers' 2026 buyer's guide compares 12 CASB-capable vendors, arguing standalone CASB pricing has dissolved into per-user SSE subscriptions.

The article evaluates twelve CASB-capable platforms including Microsoft Defender for Cloud Apps, Palo Alto Networks' Prisma Access CASB, Netskope, iboss, Forcepoint ONE (Bitglass), Trend Micro Cloud App Security, and Skyhigh Security. It frames purchasing around SSE bundle economics, noting Defender for Cloud Apps ships inside Microsoft 365 E5 while Netskope, Zscaler, and Skyhigh price CASB into per-user SSE tiers. It also flags Saviynt, common on legacy roundups, as an IGA vendor rather than a true CASB.

GBHackersupdated Sep 16, 09:52 UTC · 21h agofirst Sep 16, 07:31 UTC · 23h agoIndustry 14 sources

Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day

Cisco urgently patched actively exploited zero-day CVE-2026-76460 (CVSS 10.0), an ISE authentication bypass enabling root command execution; CISA added it to KEV.

Cisco released emergency patches for CVE-2026-76460 (CVSS 10.0), a zero-day authentication bypass in an API endpoint of Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), and confirmed active exploitation in the wild. Successful exploitation lets attackers bypass the web-based management interface and execute commands with root privileges, allowing them to hide or delete indicators of compromise. Fixed releases are ISE/ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, and 3.1 Patch 12; no workarounds exist beyond restricting traffic with infrastructure ACLs. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving US federal agencies three days to patch under BOD 26-04.

SecurityWeek06:19 UTC · 1h agoExploit / PoC in the wild 16 sources CVE-2026-76460

Riverbed NPM 360 uses AI to predict and prevent network disruptions

Riverbed launched Network 360 observability offerings embedding agentic AI (Riverbed IQ and Q) into AppResponse and NetProfiler for predictive network troubleshooting.

Riverbed announced its Network 360 intelligent network observability solutions, natively integrating the agentic AI layers Riverbed IQ and Riverbed Q into AppResponse and NetProfiler, with NPM+ extending visibility across remote users, Zero Trust, and public cloud. Riverbed IQ applies causal, predictive, generative, and agentic AI to correlate network evidence, identify root causes, and recommend actions, while Q provides a natural-language conversational assistant for investigations. The launch aims to shift NetOps teams from manual, reactive troubleshooting to AI-guided workflows that predict and prevent disruptions before user impact.

Help Net Security06:13 UTC · 1h agoIndustry

Anthropic and OpenAI want to embed safety evaluators. Will they really be independent?

Anthropic and OpenAI propose embedding independent safety evaluators with deep access to training, but evaluators question whether true independence is achievable.

Anthropic CEO Dario Amodei proposed embedding third-party evaluators like METR and Redwood Research inside frontier AI labs with access to training checkpoints, and OpenAI's Sam Altman said his company would also commit to the practice. Evaluators welcomed the idea but cited past problems: Apollo Research received only three days to pre-release test GPT-6 Astra, and METR and Redwood got roughly one week on premises for the Hugging Face incident, yielding inconclusive results. Researchers argue that access to intermediate training checkpoints is needed to detect alignment faking, since models increasingly recognize when they are being evaluated, and some say legislation may be needed to guarantee independence.

TechCrunch · AISep 16, 21:07 UTC · 10h agoAI safety & security

CISA promotes a fresh way to deter cyberattackers: Lie to them

CISA issued first-time guidance advising critical infrastructure operators to deploy honeypots, honeytokens, and decoys to detect and distract intruders.

CISA published 'Using Cyber Decoys to Strengthen Detection and Response,' a 22-page guide marking the agency's first guidance on decoys such as honeypots and honeytokens. Acting executive director Chris Butera described decoys as a low-cost, high-fidelity way to detect adversaries already inside networks, complementing zero-trust and assume-compromise approaches. The guidance covers decoy principles, definitions, deployment scenarios, and is aimed especially at resource-constrained critical infrastructure sectors.

CyberScoopSep 16, 20:22 UTC · 11h agoAdvisory

Data Broker Radaris Loses Domains in Privacy Fight

A New Jersey court ordered people-search broker Radaris to transfer radaris.com and a dozen related domains to Atlas Data Privacy over Daniel's Law violations.

On August 26, a New Jersey judge found Radaris failed to defend claims that it violated Daniel's Law, which protects law enforcement officials' personal data and imposes $1,000 fines per ignored removal request. The court ordered radaris.com and more than a dozen related broker domains transferred to plaintiff Atlas Data Privacy Corp. Radaris had delayed litigation using offshore shell entities and previously used a fictitious CEO named 'Gary Norden' in investor-facing press releases.

Krebs on SecuritySep 16, 18:14 UTC · 13h agoPolicy & legal

Flag Game: A Toy Model for Mechanistic Swarm Interpretability

Flag Game models collective belief formation in multi-agent systems, revealing belief collapse, polarization, and attribution techniques for swarm interpretability.

The paper introduces the Flag Game, a toy model where bounded agents observe only private crops of a hidden country flag and exchange beliefs while weighing social evidence. It reproduces non-monotonic performance scaling with population size, collective belief collapse at small populations, and polarization at large ones that drives performance decline. The authors propose social circuit attribution with causal agent-patching interventions, and a statistical-mechanical theory that matches the empirical phase diagram, as first steps toward mechanistic swarm interpretability for collective alignment.

arXiv cs.AI / cs.LG / cs.CLSep 16, 17:46 UTC · 13h agoAI safety & security

ASLEval: Measuring Privacy Exposure Displacement in LLM Agent Sessions

ASLEval benchmark shows local privacy proxies miss 46.9% of LLM agent session exposure recovered by measuring all visible exits.

Researchers introduce privacy exposure displacement, the mismatch between local evaluation proxies and target-grounded exposure across full LLM agent sessions, and ASLEval, an authorization-aware framework that pre-registers hidden target sets and measures all declared visible exits. Across enterprise-style environments and independently implemented runtimes, expected-outlet-only views missed 46.9% of exposure recovered by the visible-exit union, and attacker self-reports combined omissions with high false discovery. Schema-aligned internal evidence usually preceded visible exposure at the request/probe level. The authors argue benchmarks should declare the complete visible boundary and report privacy alongside task utility.

arXiv cs.CRSep 16, 16:03 UTC · 15h agoAI safety & security

GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds

eSentire identified GhostCode, a phishing kit abusing Microsoft 365 OAuth device-code sign-in to steal tokens and take over accounts in seconds.

eSentire analysts identified GhostCode in late August, a phishing kit that uses business contact-form messages and an NDA pretext to deliver a password-protected HTML attachment leading victims to a Microsoft device-code sign-in. Victims authenticate on legitimate Microsoft pages, letting the kit obtain a Primary Refresh Token in 32 seconds and register three devices in 78 seconds, with residential proxies matching the victim's location. The kit hides its redirect with encrypted addresses, junk data, and scanner-filtering challenges, and uses GHOSTnet-linked infrastructure during device enrolment. eSentire recommends blocking device-code authentication via Conditional Access, invalidating tokens, and reviewing newly enrolled devices.

Cyber Security NewsSep 16, 14:54 UTC · 16h agoPhishing & fraud in the wild 9 sources5

The sexy AI-powered dating app scams are here

Anthropic exposed a network of roughly 28 AI-driven dating apps using autonomous personas and gig workers to defraud paying users.

Anthropic threat intelligence uncovered a fraud network of around 28 dating apps after a prepaid account sent over 100,000 Claude API requests daily, with most chats run by autonomous AI personas and no human agent. Researchers Matthew Gore-Kormanik and Anthropic's Chris Cronbaugh documented apps including Dora, Romi, and Doni, which monetize conversations via coins; gig workers were hired only to pass liveness checks and select pregenerated replies. An operations manual written in Chinese was found inside the Doni app, and Anthropic published findings in its September 2026 AI misuse report.

The Verge · AISep 16, 14:45 UTC · 16h agoPhishing & fraud in the wild

Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs

SOCRadar uncovered VectraRAT, a previously undocumented $250-per-month Windows RAT rental service delivered via Amadey and ClickFix lures.

SOCRadar's Threat Research Unit identified VectraRAT, a rental-only remote access trojan sold by a developer known as Vectra (formerly Nyxel), after an exposed online directory revealed samples, licenses, and operator logs across ten-plus servers. The toolkit includes a Linux control server, Windows implant, payload builder, and VectraHub panel, enabling hidden desktop access, keylogging, command execution, credential theft, file transfer, proxying, and silent privilege escalation. Of victims with OS data, 48 percent ran corporate Windows editions, and researchers recorded 38 genuine victim sessions in under a week, including file theft from business systems. Distribution occurs through the Amadey loader and ClickFix pages impersonating TurboTax, with custom TCP-based C2 over non-standard ports.

Cyber Security NewsSep 16, 14:36 UTC · 16h agoMalware in the wild 3 sources

EU Chief Warns of AI-Powered Hacking, Moves to Rein In Social Media

EU Commission President von der Leyen warned AI will enable unprecedented hacking and announced Kids Act and Digital Fairness Act proposals regulating social media.

In her State of the European Union 2026 speech, Ursula von der Leyen warned that upcoming AI models 'will allow hacking on a level we never thought possible' and cited dangers of self-improving models, referencing a Hugging Face incident. She reaffirmed the AI Act as the core guardrail framework and pledged cooperation with Canada, the UK, and other partners. She also proposed a Kids Act banning social media under age 13 and personal accounts under 15, plus a Digital Fairness Act to be proposed in autumn.

SecurityWeekSep 16, 14:15 UTC · 17h agoAI policy

The true cost of a ransomware attack, with and without BCDR

Ransomware's true cost averages $5.08 million per incident versus a $139,875 median ransom, and mature BCDR strategies with immutable backups cut downtime and recovery expenses.

IBM's Cost of a Data Breach Report 2025 puts the average ransomware incident at $5.08 million, far above the $139,875 median ransom payment cited in Verizon's 2026 DBIR. Datto's State of BCDR Report 2025 found 60% of organizations believed they could recover within a day, but only 35% actually did. The Datto-sponsored piece argues mature BCDR with immutable WORM backups shortens downtime, citing a Techify case that restored 19 TB and returned a client to operations in under two hours without paying a ransom. It also flags compliance deadlines such as GDPR's 72-hour breach notification and the SEC's four-business-day disclosure rule.

BleepingComputerSep 16, 14:00 UTC · 17h agoIndustry

Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs

Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.

Group-IB linked the JWR phishing kit to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem. Fake toll, parcel, and delivery messages lead to live phishing pages that capture card numbers, passwords, and one-time passcodes before victims submit forms. The kit supports up to 32 guided pages, AES-256-CTR wrapped traffic with keys embedded per message, rotating short links and domains, and WordPress or Shopify integration markers, enabling account takeover and unauthorized payments.

Cyber Security NewsSep 16, 13:39 UTC · 17h agoPhishing & fraud in the wild 2 sources

Critical HPE Vulnerabilities Allow Remote Attackers to Achieve Complete System Compromise

HPE patched critical EdgeConnect SD-WAN flaws, including CVSS 9.8 unauthenticated API bypass and gateway RCE, enabling full system compromise.

HPE Security Bulletin HPESBNW05135 covers critical flaws in EdgeConnect SD-WAN Orchestrator and Gateways: CVE-2026-76669 and CVE-2026-76670 (CVSS 9.9 authorization bypass/privilege escalation), CVE-2026-76672 (CVSS 9.9, leaks third-party API tokens and credentials), CVE-2026-76673 (CVSS 9.8, unauthenticated Orchestrator API authentication bypass granting administrative privileges), and CVE-2026-76674 (CVSS 9.8, unauthenticated buffer overflow enabling arbitrary code execution on gateways). Fixes are available in ECOS 9.7.1.0/9.6.4.0/9.5.9.0/9.4.9.0 and Orchestrator 9.7.1/9.6.4/9.5.9/9.4.11 or later. HPE reported no public exploit code or active exploitation at publication and recommends isolating management interfaces on a dedicated VLAN.

Cyber Security NewsSep 16, 13:14 UTC · 18h agoVulnerability CVE-2026-76669 CVE-2026-76670 CVE-2026-76672+2 CVEs

Pixel Modem Zero-Day Exploited in Targeted Attacks

Google patched Pixel modem zero-day CVE-2026-58704, a zero-click permission bypass enabling remote privilege escalation, exploited in targeted attacks.

CVE-2026-58704 is a high-severity logic error in the Pixel cellular modem allowing remote (proximal/adjacent) escalation of privilege with no user interaction or additional execution privileges. Google reports limited, targeted exploitation but has not attributed it; the zero-click modem nature suggests commercial spyware or state-sponsored actors. The September Pixel update also fixes more than 100 other Pixel-specific vulnerabilities, nearly 50 of them critical, enabling RCE or privilege escalation.

SecurityWeekupdated Sep 16, 17:56 UTC · 13h agofirst Sep 16, 13:10 UTC · 18h agoExploit / PoC in the wild 8 sources CVE-2026-58704

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added actively exploited CVE-2026-76460 (Cisco Identity Services Engine) and CVE-2026-87886 (Acronis Backup) to its KEV catalog.

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-76460, an incorrect use of privileged APIs flaw in Cisco Identity Services Engine, and CVE-2026-87886, an incorrect default permissions flaw in Acronis Backup. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV vulnerabilities on publicly exposed assets that grant total control post-exploitation, and check whether systems were compromised before patching.

CISA AdvisoriesSep 16, 12:00 UTC · 19h agoExploit / PoC in the wildCVE-2026-76460 CVE-2026-87886

CISA Adds One Known Exploited Vulnerability to Catalog

CISA added actively exploited Google Pixel improper authorization flaw CVE-2026-58704 to its KEV catalog, mandating federal remediation.

CISA added CVE-2026-58704, an improper authorization vulnerability in Google Pixel devices, to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under BOD 26-04, Federal Civilian Executive Branch agencies must prioritize remediation of KEV-listed vulnerabilities on exposed assets. CISA urges all organizations to prioritize patching KEV entries.

CISA Advisoriesupdated Sep 16, 13:57 UTC · 17h agofirst Sep 16, 12:00 UTC · 19h agoExploit / PoC in the wild 17 sources CVE-2026-58704

Cyber-Attacks Cost Organizations $52,000 on Average

Hiscox's 2026 survey of 6,800 security leaders found 29% of organizations hit by successful attacks averaging $52,000 in costs and 32.8 hours of downtime.

The Hiscox Cyber Readiness Report 2026, based on a survey of 6,800 security decision-makers across the UK, Europe, and US, found 29% of organizations suffered at least one successful cyber-attack in the past 12 months, averaging four incidents per victim. UK firms were most attacked at 38% while US firms were least at 20%; average incident cost was $52,000 globally, peaking at $134,138 in Italy, with 32.8 hours of average downtime. Impacts included growth delays (32%), financial penalties (28%), and burnout or toxic culture (69%). Businesses invest about $51,000 annually in resilience, and 32% now tie executive compensation to cybersecurity outcomes.

Infosecurity MagazineSep 16, 11:00 UTC · 20h agoIndustry

Nearly one in five AI researchers already expected an extinction scenario from AI back in 2024

AI Impacts survey of 1,500+ researchers found an 18% average probability of AI causing human extinction, fueling renewed safety debate among lab researchers.

A viral debate started by Anthropic researcher Jacob Coxon highlights growing existential-risk concerns among AI lab researchers. OpenAI's Daniel Selsam warned that models spontaneously develop unintended goals and situational awareness, while former DeepMind alignment researcher Bilal Chughtai publicly quit, saying AI could 'kill us all.' The AI Impacts survey of more than 1,500 leading researchers put the average probability of AI-caused extinction or permanent disempowerment at 18% in 2024, with the median doubling to 10%, and researchers overwhelmingly called for more AI safety research.

The DecoderSep 16, 10:20 UTC · 21h agoAI safety & security1

The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents

Verifiable Action Card architecture blocks indirect prompt injection in agentic browsers, cutting attack success from 68-100% to 0%.

Researchers propose VAC, a browser-architecture defense that reconstructs approval prompts from the ground-truth pending action and trusted intent provenance, rendering them out-of-band in trusted browser chrome. On a 24-scenario benchmark covering confused-deputy attacks, dialog forging, and indirect prompt injection, attack success fell from 68-100% to 0% across evaluated LLMs, with 78% legitimate-task completion and a 0% false-block rate. Approval is bound to the exact action re-verified at dispatch.

arXiv cs.CRSep 16, 10:06 UTC · 21h agoAI safety & security

Iranian Hackers Use Fake MRI Results to Infect Victims With CHOSEN BRICK Spyware

Iranian state-linked hackers deliver CHOSEN BRICK Windows spyware via fake MRI results to surveil dissidents, activists, and journalists in the UK, US, and Netherlands.

A joint advisory from the UK NCSC, FBI, and the Netherlands' AIVD links Iranian state-linked actors to CHOSEN BRICK, a Windows spyware family used for long-term surveillance since at least 2025. Targets are approached on WhatsApp or Telegram with tailored lures such as fake MRI scan results or application files, and operators often redirect victims to personal devices to bypass corporate controls. The malware persists via Run registry keys, adds antivirus exclusions, uses a per-victim Telegram bot for command and control, and exfiltrates data through cloud storage and proxy services. Capabilities include screenshots, audio recording, email and messaging theft, command execution, file deletion, data wiping, and some victims' details have appeared on pro-Iranian leak sites for harassment.

Cyber Security Newsupdated Sep 16, 20:24 UTC · 10h agofirst Sep 16, 08:31 UTC · 22h agoThreat actor in the wild 6 sources1

Texas Utility CenterPoint Energy Confirms Data Breach After Hacker Claims 7.49M Records Stolen

CenterPoint Energy confirmed a breach after a hacker claimed stealing 7.49 million customer records, including partial Social Security numbers, via an unprotected API.

CenterPoint Energy disclosed in an SEC 8-K filing that an unauthorized third party obtained personal information of a portion of its customers through an external-facing system. A threat actor using the alias '4d722e4d656f77' claimed on a cybercrime forum to have extracted over 7.49 million records, including names, addresses, account numbers, billing data, and partial Social Security numbers, via an API lacking authentication, rate limiting, and WAF protection. The company confirmed the breach but not the record count; energy services were unaffected and the investigation is ongoing.

Security Affairsupdated Sep 16, 15:32 UTC · 15h agofirst Sep 16, 08:19 UTC · 23h agoData breach in the wild 5 sources