Search: “environment”

4 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 32 Industry 28 AI safety & security 24 Tools 20 Vulnerability 18 Advisory 18 AI industry 16 Research 15 AI research 14 Threat actor 14 Malware 11 AI tools & infra 6 Data breach 5 Phishing & fraud 4

SeverityAll critical 14 high 56 medium 30 low 4 info 128

Webinar: How malicious OAuth apps can lead to Google Workspace breaches

BleepingComputer webinar will dissect two Google Workspace breaches caused by malicious OAuth apps and social engineering, hosted September 23 with Material Security.

On September 23, 2026, BleepingComputer will host a webinar with Material Security examining two real attacks that used malicious OAuth applications and social engineering to breach Google Workspace environments. Rather than stealing credentials, attackers persuaded users to authorize malicious apps, gaining access to data through the granted permissions. The session covers first-hour response decisions and which security controls provide the greatest value for fast-growing organizations.

BleepingComputerSep 14, 12:15 UTC · 2d agoPhishing & fraud

Microsoft Releases Emergency Patch to Fix RDS Snafu

Microsoft's out-of-band KB5129195 fixes September Patch Tuesday regressions breaking RDS connections, Hyper-V shared folders, and USB audio.

Microsoft released cumulative out-of-band update KB5129195 on September 14, 2026, fixing RDS instability causing failing RDP connections, sign-in issues, and hanging servers. The patch also resolves Hyper-V Plan9 shared-folder failures affecting WSL and Claude Cowork, plus USB Audio Class 1.0 device failures. This is Microsoft's sixth emergency patch after a September Patch Tuesday that fixed a record 974 CVEs.

Infosecurity MagazineSep 15, 08:40 UTC · 1d agoAdvisory 3 sources

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · securitySep 16, 13:24 UTC · 18h agoResearch

New hardware device can RAM into encrypted memory, expose your data

Researchers built a $200 DDR5 interposer that silently drops memory writes to break TDX, SGX, and SEV-SNP confidential VM integrity, requiring physical access.

Researchers from KU Leuven, ETH Zurich, Durham University, and Google demonstrated DDRop, a hardware interposer costing under $200 that corrupts DDR5 bus commands to silently drop writes to encrypted memory, enabling replay attacks on confidential VMs. Because scalable memory encryption lacks freshness checks, protected VMs keep computing on stale attacker-selected data; on an Intel TDX server the attack forces debug mode for plaintext memory reads or forges attestation reports, succeeding in under two minutes without crashing. Intel and AMD both called the attack out of scope for their cloud threat models, with no mitigation planned, and proposed cache line versioning appears still vulnerable. The full interposer design is being released as open-source hardware.

The Register · SecuritySep 14, 18:31 UTC · 2d agoResearch