Search: “intel”

42 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 14 Research 13 Exploit / PoC 11 Policy & legal 7 AI safety & security 6 AI industry 6 Tools 6 Threat actor 5 Advisory 4 Phishing & fraud 4 Vulnerability 3 Malware 2 Ransomware 1 Data breach 1

SeverityAll critical 8 high 14 medium 15 low 4 info 44

SK Hynix reportedly in talks with Intel to build memory chips in US

SK Hynix is reportedly negotiating with Intel to manufacture memory chips in the US, possibly leasing space at Intel's Ohio fab.

Reuters reports SK Hynix and Intel have discussed SK Hynix producing RAM in the US for the first time, including leasing space at Intel's planned Ohio factory or forming a joint venture that could include cloud-service providers; SK Hynix says nothing is finalized. The company is already building a $3.8 billion AI chip packaging and research facility in West Lafayette, Indiana, with mass production expected to begin in 2029, amid surging HBM demand from AI data centers. The potential deal could face a South Korean government review over transfers of strategically important chip technology, and follows Intel's 2020 sale of its NAND flash business to SK Hynix for $9 billion.

TechCrunch · AISep 16, 13:23 UTC · 17h agoAI industry

macOS 27 Golden Gate – Review

Ars Technica reviews macOS 27 Golden Gate, highlighting an unavoidable Apple Intelligence upgrade, new AFM 3 Core models, and dropped Intel Mac support.

macOS 27 Golden Gate delivers the first significant Apple Intelligence upgrade two years after launch, and the toggle to disable the AI features or delete downloaded models is gone. Apple Intelligence runs on a new AFM 3 Core model built in collaboration with Google, while the more capable AFM 3 Core Advanced requires an M3 chip and at least 12GB of RAM. The release drops all Intel Mac support, requiring Apple Silicon, with Sequoia security updates expected to end in fall 2027 and Tahoe's in 2028.

Hacker News · AISep 16, 19:53 UTC · 11h agoAI industry 2 sources HN 45↑ · 28 comments

Mars Security Launches Real-Time Intel-to-Detection Engine That Turns Live Threat Intelligence Into Backtested Detections in Minutes

Mars Security launched Real-Time Intel-Based Detection, converting advisories into MITRE ATT&CK-mapped, backtested detection rules for CrowdStrike, Wiz, and Splunk within minutes.

The capability turns newly published threat intelligence from CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence into validated detection rules within minutes, each backtested against 30 days of the customer's own telemetry before deployment. Rules are written in native query languages across CrowdStrike Falcon, Wiz, Splunk, firewalls, Linux Sysmon, identity providers, AWS telemetry, and data lakes such as Snowflake and Databricks, with no data ingestion or stack changes. The feature is available at no additional cost to existing customers and on AWS Marketplace. Mars also flags detection coverage gaps and extends monitoring to credentials leaked by AI coding agents.

Cyber Security NewsSep 8, 13:20 UTC · 8d agoTools1

ASML locks in TSMC, Samsung, and Intel while Huawei races to break its grip

ASML secures TSMC, Samsung, and Intel commitments for twelve-inch photomasks while Huawei funds China's DUV lithography push to bypass export controls.

ASML, the world's only EUV lithography maker, has locked in commitments from TSMC, Samsung, and Intel to move photomasks from six-inch to twelve inches, which ASML CTO Marco Pieters says could raise High-NA throughput by 40 percent; TSMC and ASML plan a test line by 2031 with production on High-NA tools by 2033. Meanwhile Huawei is orchestrating China's push to build DUV lithography equipment and reduce dependence on ASML, centered on Shanghai equipment maker Yuliangsheng, with SMIC testing the machines and Huawei's Habo fund backing Zeiss rivals and light-source developers. Bernstein analysts note the main bottlenecks remain projection lenses and light sources.

The DecoderSep 8, 15:11 UTC · 8d agoAI industry

Mars Security Debuts Automated Threat Engine Processing Live Cyber Intelligence Into Validated Rules Within Minutes

Mars Security launches Real-Time Intel-Based Detection, converting threat intelligence advisories into validated, ATT&CK-mapped detection rules within minutes for SOCs.

Mars Security, an autonomous threat hunting and detection engineering platform founded by former offensive security operators, announced Real-Time Intel-Based Detection. The capability ingests advisories from sources like CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence, maps indicators to MITRE ATT&CK, and authors native query logic across connected infrastructure including CrowdStrike Falcon, Wiz, Splunk, Sysmon, identity providers, Snowflake, and Databricks. Every rule is backtested against 30 days of historical telemetry to quantify false positives before analyst approval and one-click deployment. The feature is free for existing customers and available via AWS Marketplace.

CSO OnlineSep 8, 15:05 UTC · 8d agoTools2

Risky Bulletin: Dutch intel services to get extensive new powers

Netherlands proposed a bill granting AIVD and MIVD expanded warrantless tapping, faster hacking powers, and forced data disclosure, citing Russia, China, and Iran threats.

The Dutch government introduced a bill greatly expanding surveillance powers of intelligence agencies AIVD and MIVD, allowing up to one year of tapping without pre-approval and simplified hacking operations against 'foreign adversaries'. Agencies could compel Dutch companies or citizens to provide data under threat of charges, share data with the private sector, and oversight bodies would merge into a new CTT board. The bill follows similar overhauls in Ireland, Germany, and France after Russia's invasion of Ukraine. The newsletter also reports Moonwell hacked for $8.7M, a Cosmos EVM bug exploited for ~$3M, ShinyHunters listing McKesson with claimed hundreds of millions of records, and a pro-Kremlin DDoS claim against Norway's government network.

Risky Business NewsAug 31, 03:25 UTC · 17d agoPolicy & legal

Mars Security brings threat intelligence to detection in real time

Mars Security launched Real-Time Intel-Based Detection, converting advisories from CISA and Mandiant into backtested MITRE ATT&CK-mapped detection rules for CrowdStrike, Wiz, and Splunk.

Mars Security announced a capability that automatically turns newly published threat intelligence from sources like CISA, Mandiant, Unit 42, and Microsoft into MITRE ATT&CK-mapped detection rules. Each rule is written in the native query language of the customer's telemetry (CrowdStrike Falcon, Wiz, Splunk, firewalls, identity providers, AWS, Snowflake, Databricks) and backtested against 30 days of the customer's data before deployment, with indicator scoring to drop noisy or stale indicators. The platform also maps existing detection coverage, flags gaps such as AWS CloudTrail tampering and pass-the-hash movement, and delivers some recommendations as open pull requests for detection-as-code workflows.

Help Net SecuritySep 8, 13:43 UTC · 8d agoTools

Your threat feed is someone else's database: What ingesting malware intel at scale takes

GitHub's Dependabot lead shares five production lessons for ingesting community malware intelligence feeds across eight package ecosystems at scale.

GitHub's Dependabot team monitors over 30 million repositories and extended malicious-package advisories from npm to eight package ecosystems by ingesting OpenSSF's malicious-packages intelligence. The team catalogued roughly 18 new malicious npm packages per day in the year ending May 2026. The write-up argues that provenance with batch reverts, fingerprinting to catch echo-chamber duplicates, and heavyweight normalization are the make-or-break engineering for feed ingestion. It also recommends automated publishing with import caps and anomaly flagging, and quarantining malformed records rather than silently repairing them.

Help Net SecuritySep 3, 00:00 UTC · 14d agoResearch1

"They don't care about this": A Systematic Study of TEE Build Reproducibility in the Wild

91% of 115 surveyed TEE deployments across Intel SGX, TDX, and AMD SEV fail to provide reproducible builds needed for verifiable remote attestation.

A systematic study of 115 TEE deployments found 91% were not reproducible and 80% lacked both source code and a reference build, undermining remote attestation guarantees. Interviews with 12 developers of 50 Intel SGX projects confirmed that only one participant treats reproducibility as a development priority. The authors identify technical barriers such as embedded timestamps plus ecosystem-level issues like lack of build-environment control in multi-stakeholder projects, and call for holistic, committed reproducibility practices.

arXiv cs.CRSep 10, 11:43 UTC · 6d agoResearch

Homebrew 7.0.0 Adds Built-In Vulnerability Scanner and Stronger Package Sandboxing

Homebrew 7.0.0 ships a native brew vulns scanner, OSV-backed advisory database, stronger sandboxing, and fixes a sandbox-escape issue.

Homebrew 7.0.0 introduces a built-in 'brew vulns' command that scans installed formulae, dependencies, and Brewfiles against a new Homebrew-specific advisory database and OSV.dev data, distinguishing backported fixes from outdated versions. The release hardens sandboxing by blocking home-directory reads during builds, disabling network access at install time, and replacing Bubblewrap with Landlock on Linux. It also fixes moderate-severity GHSA-5263-whxq-77hp, where a malicious cask could execute code outside the macOS sandbox via LaunchServices, and drops macOS Catalina while moving Intel Macs to Tier 3.

Cyber Security NewsSep 15, 13:55 UTC · 1d agoTools1

SpliTEE: Improving LLM Inference on Trusted Hardware with Differentially Private GPU Outsourcing

SpliTEE splits LLM inference between Intel TDX trusted execution and untrusted GPUs, using differential privacy instead of encryption to protect intermediate representations.

SpliTEE extends split inference to LLMs, running inference partly inside an Intel TDX TEE while masking intermediate inputs sent to untrusted GPUs with differential privacy rather than encryption. The authors show a prompt-reconstruction attack recovers nearly 80% of prompts from unmasked intermediate representations, motivating the masking. A global sensitivity analysis bounds the required DP noise scale, avoiding quantization and keeping models in floating point. The implementation is nearly twice as fast as full CPU-based TDX inference and 5-15 seconds faster than encryption-based Slalom with higher accuracy, evaluated on Llama-3.2-3B and Qwen3-4B.

arXiv cs.CRSep 14, 04:55 UTC · 3d agoResearch

Ransomware negotiation tactics have turned into a business process

Intel 471's Dave Ross details ransomware negotiation tactics, with demands typically set at 1-5% of annual revenue and specialized criminal service roles.

In a Help Net Security video, Intel 471 Senior Director Dave Ross explains how ransomware groups research a victim's revenue and insurance coverage, run test decryptions to prove they hold a working key, and set demands at roughly 1% to 5% of annual revenue. He describes negotiation dynamics with shifting deadlines and a criminal service economy supplying language skills, data review, and legal analysis. Multi-extortion methods include data theft, DDoS attacks, and direct contact with customers and journalists.

Help Net SecuritySep 8, 05:40 UTC · 9d agoRansomware

Linux Foundation takes on TRACE, a hardware-backed runtime evidence specification for AI agents

The Linux Foundation adopts TRACE, an OPAQUE-contributed spec giving AI agents hardware-attested, cryptographically verifiable runtime and compliance evidence.

The Linux Foundation accepted the TRACE (Trust, Runtime Attestation and Compliance Evidence) specification contributed by OPAQUE, developed with AMD, Intel, Microsoft, and the Technology Innovation Institute. TRACE binds runtime environment, software, policies, data classifications, and tool usage into a portable, cryptographically verifiable artifact, composing existing standards such as RATS, EAT, SLSA, SCITT, SPIFFE, and EAR. It recorded nearly 135,000 PyPI downloads within 10 weeks of its June 2026 introduction, and its technical workstream will be hosted by the Coalition for Secure AI.

Help Net SecurityAug 26, 00:00 UTC · 22d agoAI tools & infra

MacOS 27 - First Boot, (Tue, Sep 15th)

SANS ISC documents the expected network traffic macOS 27 'Golden Gate' generates on first boot to help defenders baseline their networks.

Johannes Ullrich of SANS Internet Storm Center captured roughly 300 packets from a macOS 27 'Golden Gate' system before user login, covering DHCP, IPv6 duplicate address discovery, DNS, and TCP behavior. macOS 27 resolves hostnames like albert.apple.com (device activation, certificate-pinned), push messaging hosts, and ipv4only.arpa for NAT64 networks. The OS still uses a TCP window scale of 6, ECN, and random timestamps, with only four TCP connections observed during boot. The analysis provides a reference baseline for security teams monitoring Apple endpoints.

SANS Internet Storm CenterSep 15, 15:23 UTC · 1d agoResearch

11 Best CSPM Tools Compared (2026): Features & Pricing

CSPM comparison ranks Wiz first for agentless attack-path analysis; notes Ermetic absorbed into Tenable and Lacework into Fortinet FortiCNAPP.

An editorial comparison of eleven CSPM tools ranks Wiz as the agentless attack-path momentum leader, Prisma Cloud as the breadth benchmark, and Orca as the agentless SideScanning pioneer. It highlights consolidation: Ermetic now powers Tenable Cloud Security and Lacework became Fortinet's FortiCNAPP. The guide recommends starting with free tiers from Defender for Cloud, Prowler, and native cloud tools before buying.

GBHackersSep 15, 06:37 UTC · 2d agoIndustry1

New CISO appointments 2026

Companies including Mistral AI, Trellix, Marriott, and ANZ appointed new CISOs in July-September 2026 amid high security-leadership turnover.

CSO Online's rolling column tracks senior security appointments, noting many companies are hiring a CSO/CISO for the first time. Notable moves include Thomas Coudray leaving Ledger to become Mistral AI's CISO, David Soto joining Trellix from Amazon, and Daniel Dubowski becoming Marriott International's SVP and CISO. Other appointments span ANZ, Gigamon, Axonius, Tricentis, Remitly, Allied Universal, and the State of California.

CSO OnlineSep 7, 10:09 UTC · 9d agoIndustry

Former Infosys chief’s AI startup nabs another $53M

Hang Ten Systems, founded by ex-Infosys CEO Vishal Sikka, added $53 million to its seed round, bringing total funding to $85 million.

The new round was led by Temasek's early-stage platform Xora with Mayfield participating, closing five weeks after the initial $32 million seed. Founded in May 2026, the Palo Alto startup advises enterprises with over $10 billion in annual revenue on AI strategy and builds production software using its in-house Hobie framework of reusable AI skills. It works with 21 major enterprises including Fresenius Kabi, Saudi Aramco, and Siemens Energy, and plans to expand engineering, consulting, and sales teams.

TechCrunch · AISep 16, 13:00 UTC · 18h agoAI industry

Threat Intelligence Alone Won't Close the Exploitation Gap

Pentera argues threat intelligence alone leaves a validation gap, promoting threat-led penetration testing that auto-tests leaked credentials against real attack surfaces.

A contributed Pentera piece argues that threat intelligence signals such as leaked credentials and vulnerability advisories often sit unactioned in queues because teams lack the offensive capacity to validate them against live environments. It promotes threat-led penetration testing (TLPT) and highlights Pentera's integration with Recorded Future, which triggers automated validation of leaked credentials against an organization's external attack surface. Wyndham Hotels & Resorts cybersecurity VP Joseph Gothelf is quoted supporting the convergence of threat intelligence and security validation.

The Hacker NewsSep 16, 11:15 UTC · 20h agoIndustry

Top 10 Best Cloud Detection & Response (CDR) Solutions in 2026

Editorial scorecard ranks ten 2026 cloud detection and response platforms; Sysdig, Wiz, and CrowdStrike lead, with Wiz's Gem Security acquisition highlighted.

The editorial scorecard rates ten CDR platforms on real-time detection (30%), cloud telemetry depth, response automation, correlation, and value. Sysdig earns the best real-time detection score for its Falco- and eBPF-powered runtime telemetry, Wiz (8.7) folds acquired Gem Security's real-time CDR into its security graph, and CrowdStrike (8.7) leads response automation. Specialists Stream.Security, Skyhawk Security, Sweet Security, and the open-source Falco project are also assessed.

Cyber Security NewsSep 16, 07:41 UTC · 23h agoIndustry

Who's governing your AI? A trust framework for enterprise agents and models

DigiCert pitches AI Trust framework using PKI, DNS policy records and workload identity to govern shadow AI agents across enterprises.

The Register-sponsored piece outlines DigiCert's AI Trust framework for governing AI agents, built on PKI, DNS, and attestation, citing IBM's 2026 Cost of a Data Breach report that 68% of organizations lack AI governance or shadow AI detection. The approach treats agent identity as workload identity aligned with IETF WIMSE, NIST CSF 2.0, and SPIFFE/SPIRE, using short-lived credentials instead of static API keys. DigiCert also proposes DMARC-style DNS agent policy records and an AI Agent Passport cryptographically binding agent identity to approved operations, with a unified kill switch.

The Register · SecuritySep 15, 15:00 UTC · 1d agoAI safety & security1

What Zero-Day Response Should Be in the Post-Mythos Era

Picus Security outlines a zero-day response playbook where defenders simulate exploit technique chains before public PoCs exist.

The article uses PaperCut NG/MF's August incident — exploitation in the wild before any patch, with the first emergency fix bypassed the same day and a third landing September 1 — as the template for AI-accelerated vulnerability response. It walks through a hypothetical CVE-2026-1001 (explicitly made up) to argue defenders should map CVEs to ATT&CK technique chains and simulate them against NGFW, WAF, EDR, endpoint hardening, and SIEM controls within minutes of disclosure. It notes disclosure-to-exploitation time has fallen from 21.5 days to hours.

BleepingComputerSep 15, 13:45 UTC · 1d agoResearch in the wildCVE-2026-1001

Dataminr uses agentic AI to predict and verify security threats

Dataminr launches agentic AI capabilities for corporate security, adding automated event corroboration, context, and near-term threat prediction.

Dataminr Advanced for Corporate Security introduces Agentic Corroboration, Agentic Context, and Near-Term Predictive Intelligence, now generally available, moving the company from real-time alerting to what it calls Autonomous Real-Time Intelligence. The product relies on more than 60 fine-tuned task-specific LLMs trained on a 10+ year proprietary event archive rather than general-purpose frontier models. Upcoming releases include ReGenAI Tailored Live Briefs, a Watchlist Agent, Agentic Search, and an Advanced API suite.

Help Net SecuritySep 14, 13:25 UTC · 2d agoIndustry

LLMs are real, AI is fake

Cory Doctorow argues the OpenAI chatbot 'hacking' of Hugging Face was a Python-scripted CTF loop, not autonomous AI.

In an opinion essay, Cory Doctorow debunks reports that OpenAI chatbots autonomously hacked Hugging Face servers during an 'Exploit Gym' capture-the-flag challenge. He explains the chatbot merely acts as a front-end queried by a Python program that replays commands drawn from CTF training data. He argues sensational 'AI went rogue' narratives are amplified by technical press and help AI companies raise investment capital.

Hacker News · AISep 12, 13:47 UTC · 4d agoAI safety & security HN 40↑ · 10 comments1

12 Best Server Security Solutions Compared (2026): Features & Pricing

GBHackers ranks 12 server security solutions for 2026, naming CrowdStrike and SentinelOne as server EDR leaders and Trend Micro Deep Security top for virtual patching.

The guide scores 12 server security platforms across five weighted criteria, with detection and response depth and Linux parity weighted 25% each. CrowdStrike and SentinelOne lead server EDR, Trend Micro Deep Security is highlighted for virtual patching of unpatchable estates, and Microsoft Defender for Servers is noted for Azure and hybrid economics. It is an editorial assessment comparing features and pricing models rather than a lab test.

GBHackersupdated Sep 16, 09:52 UTC · 21h agofirst Sep 11, 07:24 UTC · 5d agoIndustry 14 sources1

Top 10 Best CNAPP (Cloud-Native Application Protection) Platforms in 2026

GBHackers ranks 10 CNAPP platforms for 2026, naming Wiz, Prisma Cloud, and Microsoft Defender for Cloud as category leaders.

The guide describes CNAPP as the umbrella combining CSPM, CWPP, CIEM, and DSPM, arguing that cross-pillar correlation of attack paths is the platform's core value. Wiz is ranked best for graph-based correlation, Prisma Cloud for the broadest module set, and Microsoft Defender for Cloud for Azure economics. It also cites Google's approximately $32 billion agreement to acquire Wiz, announced in March 2025, as buyer leverage and a reason to seek roadmap and neutrality protections in multi-year contracts.

Cyber Security NewsSep 11, 07:21 UTC · 5d agoIndustry1

Top 10 Best Cloud Workload Protection (CWPP) Solutions in 2026

Editorial scorecard ranks 2026 cloud workload protection platforms, placing Prisma Cloud first, Sysdig second, and CrowdStrike third on detection quality.

A research-based scorecard rates ten cloud workload protection (CWPP) platforms across runtime depth, container/Kubernetes support, coverage breadth, cloud context, and value. Palo Alto Prisma Cloud leads at 8.9, followed by Sysdig at 8.8 and CrowdStrike at 8.6, with Aqua Security tying CrowdStrike at 8.6. The piece argues agent-versus-agentless is a false choice, with leaders now pairing agentless visibility with eBPF-based runtime sensors. Scores are editorial assessments, not lab benchmarks.

Cyber Security NewsSep 11, 07:15 UTC · 6d agoIndustry1

Governments ‘buying time’ in race between innovation, security, national cyber director says

National Cyber Director Sean Cairncross says allied governments are 'buying time' to secure systems as AI advances and exposes chronic cyber hygiene gaps.

Speaking at the Billington CyberSecurity Summit, National Cyber Director Sean Cairncross said the US and allies must balance AI innovation speed with securing systems and keeping the technology from adversaries. He argued AI has not created new cybersecurity problems but surfaced decades-old issues like under-resourced basic cyber hygiene, echoing FBI and CISA officials at the summit. His remarks followed US agencies accusing Chinese AI companies of illegally distilling US frontier models and Anthropic disclosing a fourth AI hacking incident involving one of its models.

CyberScoopSep 10, 13:53 UTC · 6d agoPolicy & legal

d-Matrix Adopts NVIDIA NVLink Fusion for Rack-Scale XPU Deployment

d-Matrix will integrate its Raptor inference XPUs with NVIDIA NVLink Fusion, MGX racks and Spectrum-X networking for rack-scale AI factory deployment.

Inference chipmaker d-Matrix announced adoption of NVIDIA NVLink Fusion to connect its next-generation Raptor XPUs to NVIDIA's scale-up and scale-out networking, MGX rack architecture, and broader AI factory platform. NVIDIA claims 3x lower XPU-to-XPU latency than off-the-shelf Ethernet and 3 TB/s per-XPU all-to-all bandwidth via sixth-generation NVLink. d-Matrix plans to integrate Vera CPUs, ConnectX-9 SuperNICs, BlueField-4 DPUs and Spectrum-X Ethernet, with racks able to work alongside Vera Rubin NVL72 GPU systems. Other NVLink Fusion partners include AWS, Arm, Intel, Fujitsu, Marvell, MediaTek, Samsung and Cadence.

NVIDIA Blogupdated Sep 16, 15:00 UTC · 16h agofirst Sep 10, 13:00 UTC · 6d agoAI industry 2 sources

The longitude problem: In the AI era, detection is won on facts, not guesses

Opinion piece argues defenders should beat AI-era attackers by carrying verified ground truth about approvers, domains, and vendors instead of relying on inference.

CSO Online contributor Alan LeFort, CEO of StrongestLayer, uses the historical longitude problem to argue that AI-era detection should rely on carried facts—authoritative records of payment approvers, owned domains, and legitimate vendors—rather than probabilistic inference that both attackers and defenders can now perform with comparable reasoning models. He illustrates with a CFO wire-fraud example defeated by checking the approver of record and the reply-to domain against ground truth. The piece stresses that ground truth decays and must be continuously maintained, like chronometers kept wound on every ship.

CSO OnlineSep 10, 10:00 UTC · 6d agoIndustry

A new open standard locks AI weights to approved hardware

OPAQUE releases Weight Custody Manifest, an open standard keeping AI model weights encrypted until receiving hardware cryptographically attests to builder-specified conditions.

OPAQUE, a confidential computing company, released the Weight Custody Manifest (WCM) standard as a developer-preview specification with a Python SDK and a public test suite of 91 cases. WCM keeps model weights encrypted until the receiving infrastructure proves via CPU/GPU attestation that it matches builder-signed conditions, and decryption access can be revoked later if conditions change. OPAQUE says it ran the attestation exchange on an NVIDIA H100 and on AMD and Intel confidential servers hosted on Azure and Google Cloud, with two independent SDK builds producing identical output across 5,948 files. The public quickstart only exercises protocol logic on synthetic evidence and skips GPU cryptographic verification, and the standard cannot distinguish an authorized key from one physically extracted from hardware.

Help Net SecuritySep 10, 04:10 UTC · 7d agoAI safety & security

Cisco Talos Intelligence blog

Cisco Talos argues restrictive frontier AI models impose a 'safety penalty' that hampers security teams' real-time incident response.

A featured Cisco Talos post contends that increasingly restrictive frontier AI models create a 'safety penalty' slowing defenders' real-time incident response, and advocates 'operational sovereignty' so defensive AI keeps pace with unconstrained adversaries. The blog index also promotes a Beers with Talos podcast episode on how threat intelligence is gathered. The page is a blog listing rather than a single news story.

Cisco TalosSep 10, 01:33 UTC · 7d agoAI safety & security

What breach and attack simulation needs to become in the AI era

Picus argues calendar-driven BAS is obsolete as AI compresses exploit timelines, citing 338 million simulations showing 69% prevention and a flat 14% alert score.

In a vendor opinion piece, Picus Security contends that with over 130 CVEs disclosed daily, fewer than 0.5% patched upstream, and disclosure-to-weaponized-exploit timelines near 10 hours, scheduled breach and attack simulation no longer keeps pace. The Picus Blue Report 2026, aggregating 338 million production simulations, found average prevention effectiveness of 69%, 58% of attack actions captured in the SIEM, an unchanged 14% alert score, and detection rule failures driven by performance issues (49%) and silent log collection gaps (41%). Picus proposes agentic BAS as a closed loop—simulate, validate, fix, verify—with AI-built threats and humans at decision gates.

Help Net SecuritySep 9, 04:30 UTC · 8d agoIndustry

Nvidia buys Hugging Face, the GitHub of AI, for $13 billion

Nvidia agreed to acquire Hugging Face for $13 billion, pledging the 3-million-model open platform will remain open to its 18 million developers.

Nvidia has agreed to acquire Hugging Face, the model and dataset hosting platform, for $13 billion, pending regulatory review. The platform hosts about 3 million primarily open AI models, 500,000 datasets, and 1 million AI applications, used by more than 200,000 companies and 18 million developers. Nvidia pledged Hugging Face will remain an open platform and keep its brand; the startup previously declined a $500 million Nvidia investment to avoid a dominant investor. The deal supports Nvidia's open-weights strategy, alongside backing for Reflection AI, CoreWeave, and Nebius.

Ars Technica · AISep 3, 13:34 UTC · 13d agoAI industry

Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)

A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.

Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.

SANS Internet Storm CenterSep 3, 02:02 UTC · 14d agoTools1

dealignai/GLM-5.3-CYBERSECURITY-FP8 — new model trending #13 on Hugging Face

dealignai releases GLM-5.3-CYBERSECURITY-FP8, a 753B MoE weight-modified variant cutting refusals on offensive-security prompts, trending #13.

dealignai released GLM-5.3-CYBERSECURITY-FP8 on Hugging Face, a cybersecurity-domain 'crack' of the 753B-parameter GLM-5.3 MoE model, currently trending #13. The release directly edits bf16 residual writers, keeps FP8 routed experts, and serves with stock vLLM on 8x H200 GPUs with 131k context. HarmBench-320 evaluations show 80-84% direct harm compliance and 89% cyber-offense compliance, while MMLU rose 1.07 points to 86.65%. Copyright-verbatim reproduction remains a known soft-refusal limitation, with an UNCENSORED sibling variant offered.

Hugging Face trending modelsAug 30, 10:46 UTC · 17d agoModel release

Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

Trump signed an executive order declaring an emergency to bar foreign bulk-power equipment deemed a national security cyber risk.

The executive order, 'Declaring a National Energy Emergency to Secure the United States Bulk-Power System,' prohibits acquiring, importing, transferring, or installing foreign-produced bulk-power equipment and software deemed risky, citing fears of digital backdoors in Chinese-made grid gear. China supplies roughly 85% of solar supply chain capacity and is a major transformer manufacturer. The Energy Department has 120 days to develop implementing rules; the order revives a 2020 Trump-era measure the Biden administration had suspended after utilities found compliance difficult.

CyberScoopAug 26, 21:47 UTC · 21d agoPolicy & legal1

Risky Bulletin: Russia starts blocking DoH and DoT

Russian users report blocks on DoH and DoT servers, including Cloudflare 1.1.1.1 and Google 8.8.8.8, in an apparent censorship crackdown.

Russian internet users began reporting failures connecting to DNS-over-HTTPS and DNS-over-TLS servers, suggesting a government crackdown on the two privacy protocols. The blocks reportedly cover Cloudflare's 1.1.1.1 and Google's 8.8.8.8 resolvers; Roskomnadzor has not officially confirmed the action. The agency tested a similar block in March on Beeline's network and had named DoH for blocking as early as 2021. The bulletin also briefly notes state-sponsored phishing of EU officials, a DDoS against Norway's Digdir, the ReliaQuest/ShinyHunters dispute, and older ransomware and breach disclosures.

Risky Business NewsAug 26, 03:07 UTC · 22d agoPolicy & legal1

Can AI make threat intelligence easier? One platform thinks so

Feedly positions its AI-driven Threat Intelligence platform to cut CTI collection time, scanning 10,000+ sources with 1,000 AI models and reporting 70% time savings.

A profile of Feedly Threat Intelligence describes how CTI teams such as RH-ISAC reduced threat data collection from 10 hours weekly to 2-3 hours after adoption. The platform scans over 10,000 open web sources using 1,000 AI models to extract TTPs, CVEs and IoCs into a real-time Threat Graph queryable via an Ask AI LLM with source citations. Customers including GreyNoise, Sopra Steria, gematik and GISA reported measurable gains such as 20 hours saved daily and earlier vulnerability flagging than CISA 65% of the time. The product integrates with Anomali ThreatStream, Cortex XSOAR, Microsoft Sentinel and OpenCTI, plus a REST API and GitHub scripts.

Help Net SecurityAug 24, 04:21 UTC · 24d agoTools