Search: “GCP”

40 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 93 Industry 74 Policy & legal 30 Data breach 29 Ransomware 23 Exploit / PoC 21 Malware 19 Threat actor 17 AI tools & infra 12 Tools 11 AI safety & security 8 AI industry 5 AI research 5 Research 3

SeverityAll critical 133 high 59 medium 58 low 64 info 43

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Re: Retrospective by 'gpg.fail' authors

GPG exploitation talk author clarifies a format-string 0day enabling code execution via printf %n writes and a polyglot PEM certificate payload.

Lexi Groves, author of the gpg.fail talk, clarified on oss-security that the first finding was an actual zero-day: a classic printf injection using %n for memory writes, with multiple X.509 certificates in one PEM file to re-enter and defeat ASLR before calling execv@plt. The payload executed the certificate itself, a polyglot file made by inserting a shebang and bash command into the PEM. A second finding was hash-collided by another party before the author could exploit it.

oss-securityupdated 17:16 UTC · 59m agofirst 00:50 UTC · 17h agoResearch 8 sources

USN-8728-1: Linux kernel (GCP) vulnerabilities

Ubuntu issued kernel security update USN-8728-1 for GCP kernels fixing Arm TLB and AMD Zen 2 privilege escalation flaws (CVE-2025-10263, CVE-2025-54518).

Ubuntu released USN-8728-1, a security update for the Linux kernel used on Google Cloud Platform images. It fixes CVE-2025-10263, where certain Arm processors complete broadcast TLB invalidation before memory writes are globally observed, allowing local attackers to bypass memory protections or escalate privileges, and CVE-2025-54518, an AMD Zen 2 operation cache isolation flaw that can corrupt higher-privilege instructions. The notice also corrects several other kernel security issues.

Ubuntu Security NoticesSep 7, 09:05 UTC · 9d agoAdvisory 6 sources CVE-2025-10263 CVE-2025-54518

The GNU C Library security advisory update for 2026-09-10

glibc advisory GLIBC-SA-2026-0016: nscd can crash from a stack overflow when an untrusted DNS server returns oversized responses.

A new GNU C Library advisory (GLIBC-SA-2026-0016) describes a stack overflow in the nscd service caused by unbounded alloca use. glibc 2.3.4 and newer may crash when a malicious DNS server returns an oversized response, resulting in degraded DNS resolution. Exploitation requires nscd to be enabled and the system to be using an untrusted DNS server. The advisory was posted to oss-security by glibc maintainer Siddhesh Poyarekar.

oss-securityupdated Sep 14, 19:54 UTC · 1d agofirst Sep 11, 01:59 UTC · 5d agoVulnerability 2 sources2

Attack Paths Into VMs in the Cloud

Unit 42 maps attack paths into AWS, Azure, and GCP VMs through intended features like startup scripts and SSH key pushes.

Palo Alto Unit 42 reviewed attack vectors against virtual machine services on AWS, Azure, and GCP, finding that 11% of internet-exposed cloud hosts carry Critical or High severity vulnerabilities. The attack paths rely on legitimate features such as EC2 User Data, VM custom data, EC2 Instance Connect, SSM Run Command, and serial consoles rather than vulnerabilities, and exploiting them requires attackers to first obtain control plane permissions. A compromised VM exposes not only its data but the workload identity and cloud permissions assigned to it, making identity compromise potentially more damaging than data theft. The firm places mitigation responsibility on cloud users and administrators.

Palo Alto Unit 42Aug 17, 12:36 UTC · Aug 17, 2026Research1

Top 10 Best Multi-Cloud Security Platforms in 2026

An editorial roundup of the ten best multi-cloud security platforms for 2026, split between CNAPPs (Wiz, Prisma Cloud) and cloud-networking security (Aviatrix).

The article frames multi-cloud security as two markets: CNAPP platforms (Wiz, Prisma Cloud, CrowdStrike, Orca, Defender) securing what runs in clouds, and cloud-networking-security platforms (Aviatrix) securing how clouds connect. It ranks ten platforms including Palo Alto Prisma Cloud for breadth, Wiz for correlation, Check Point CloudGuard, Fortinet, Aviatrix, Microsoft Defender for Cloud, Trend Micro, and CrowdStrike. It flags the ~$32 billion Google–Wiz acquisition as raising cloud-neutrality questions buyers should address contractually.

Cyber Security News09:50 UTC · 8h agoTools

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business NewsAug 21, 02:55 UTC · 26d agoResearch2

Verify Before You Distill: Prompt-Level Teacher Gating for On-Policy Distillation

TGOPD verifies teacher reliability per prompt before on-policy distillation, outperforming vanilla OPD across math, code, and instruction benchmarks.

Teacher-Gated On-Policy Distillation (TGOPD) estimates teacher reliability from verifier-scored teacher probes and routes each prompt either to dense on-policy distillation or to verifier-grounded GRPO, avoiding misleading updates from confidently wrong teachers under mode-seeking reverse KL. Across 4B and 35B students in mathematics, code, and instruction following, TGOPD outperforms vanilla OPD in all six single-domain settings and achieves higher seven-benchmark averages under multi-domain training. It also raises teacher-node GPU utilization from 9.8% to 78.9% in the measured 4B single-domain run by reusing idle teacher capacity.

Hugging Face daily papersSep 1, 20:00 UTC · 14d agoAI research

Threat Matrix: Mapping threats across cloud web applications

Microsoft released a Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework mapping threats to cloud-hosted web apps and serverless platforms.

Microsoft introduced the cloud web applications threat matrix, which organizes attack techniques for cloud-hosted web apps and serverless platforms using MITRE ATT&CK tactics, from resource development through impact. The framework covers attack paths spanning application code, managed runtimes, workload identities, and deployment pipelines, cataloging techniques such as subdomain takeover, code injection in connected repositories, compromised registry images, exposed admin interfaces, and serverless trigger injection. It builds on Microsoft's earlier Kubernetes and storage services matrices to help defenders identify visibility gaps, prioritize hardening, and plan investigations in cloud-native environments.

Microsoft Security BlogSep 9, 21:30 UTC · 6d agoTools

BGP Role model: tracking the adoption of RFC 9234

Cloudflare measured RFC 9234 adoption, finding BGP Role deployment growing but two Tier 1 networks unexpectedly stripping the Only to Customer attribute.

Cloudflare analyzed adoption of RFC 9234, which introduces BGP Roles and the Only to Customer (OTC) attribute allowing routers to reject route leaks on their own. The measurement study assessed who has deployed the mechanism in the global routing table. It found two Tier 1 networks unexpectedly stripping OTC attributes, which could undermine leak protection.

Cloudflare BlogAug 18, 15:21 UTC · 29d agoResearch

Cybersecurity jobs available right now: February 10, 2026

Help Net Security's roundup lists open cybersecurity roles at KPMG, Pentera, Google, Group-IB and others across multiple countries.

A job-board roundup featuring Cloud Security Engineer at KPMG (Israel), Cloud Security Researcher at Pentera (Israel), Cyber Defence Senior Analyst at Google (UK), and Cyber Investigation Specialist at Group-IB (UAE). Additional listings cover SOC operations, penetration testing, network architecture, OT/IT convergence and AI/ML security testing across Australia, Italy, the US, India, France, Ireland and the UAE. All listings are marked no longer accepting applications.

Help Net SecurityAug 26, 09:46 UTC · 21d agoIndustry

ENCP: Episode-Normalized Conformal Prediction for Vision-and-Language Navigation

ENCP calibrates conformal prediction per navigation episode, giving step-level coverage guarantees for vision-language navigation agents despite within-episode dependence.

Episode-Normalized Conformal Prediction (ENCP) rescales a nonconformity score by a VLN policy's residual confidence and calibrates one maximum score per episode, preserving step-level coverage of at least 1−α despite dependence among steps within an episode. Across four VLN policies and three nonconformity scores on R2R and REVERIE, ENCP meets all reported empirical step-coverage targets in seen-to-unseen evaluation. The model-agnostic uncertainty estimates can signal when an agent should defer to a stronger predictor or human assistance.

arXiv cs.AI / cs.LG / cs.CLSep 15, 17:42 UTC · 1d agoAI research

Cybersecurity jobs available right now: April 21, 2026

Help Net SecurityAug 6, 12:16 UTC · Aug 6, 2026Vulnerability

11 Best CSPM Tools Compared (2026): Features & Pricing

CSPM comparison ranks Wiz first for agentless attack-path analysis; notes Ermetic absorbed into Tenable and Lacework into Fortinet FortiCNAPP.

An editorial comparison of eleven CSPM tools ranks Wiz as the agentless attack-path momentum leader, Prisma Cloud as the breadth benchmark, and Orca as the agentless SideScanning pioneer. It highlights consolidation: Ermetic now powers Tenable Cloud Security and Lacework became Fortinet's FortiCNAPP. The guide recommends starting with free tiers from Defender for Cloud, Prowler, and native cloud tools before buying.

GBHackersSep 15, 06:37 UTC · 1d agoIndustry1

GDCM <= 3.2.7: six memory-safety and denial-of-service vulnerabilities, no CVE

Six memory-safety and denial-of-service flaws disclosed in the GDCM DICOM parsing library, affecting versions through 3.2.7.

Researcher Abhinav Agarwal disclosed six vulnerabilities in GDCM (Grassroots DICOM), an open-source C++ library for parsing and processing DICOM files. All six were confirmed against GDCM 3.2.6 using AddressSanitizer and UndefinedBehaviorSanitizer, and source review found the vulnerable patterns through version 3.2.7 and the upstream master snapshot. Potential impacts include heap corruption, process-memory disclosure, stack exhaustion, and process termination in applications parsing untrusted DICOM files. No CVE identifiers have been assigned at the time of disclosure.

oss-securitySep 10, 03:35 UTC · 6d agoVulnerability

Top 10 Best Cloud Infrastructure Entitlement Management (CIEM) Tools in 2026

2026 CIEM guide ranks Wiz, Prisma Cloud, Okta, Entra Permissions Management and specialists Sonrai, Britive, Tenable/Ermetic for cloud entitlement right-sizing.

Buyer's guide covers ten CIEM products across three market routes: CNAPP-bundled (Wiz, Prisma Cloud), identity-suite (Okta, CyberArk, SailPoint, Saviynt) and specialists (Sonrai, Britive, Tenable/Ermetic). It cites machine identities outnumbering humans 10:1 plus effective-permissions sprawl as core drivers, with JIT elevation as the fix. Notable consolidation includes Tenable acquiring Ermetic and Zscaler acquiring Canonic.

Cyber Security NewsSep 15, 06:30 UTC · 1d agoTools

openbmb/MiniCPM5-2B-GGUF — new model trending #30 on Hugging Face

OpenBMB released MiniCPM5-2B, a dense 2B on-device model claiming open-source SOTA among 2B-class models.

OpenBMB released MiniCPM5-2B, the second model in the MiniCPM5 series following MiniCPM5-1B, as a dense 2B Transformer built for on-device and resource-constrained deployment with GGUF weights on Hugging Face. The team claims 2B-class open-source state-of-the-art performance, remaining competitive with 4B-class models in coding, mathematics, long-context understanding, tool use and agentic tasks. The release includes a tech report, GitHub repository and online demo, and is currently trending on Hugging Face.

Hugging Face trending modelsSep 5, 01:44 UTC · 11d agoModel release1

Cybersecurity jobs available right now: April 14, 2026

Help Net Security lists active cybersecurity job openings at employers including MANTECH, Honeywell, SMBC Group and SBS Transit across multiple countries.

The roundup aggregates cybersecurity vacancies spanning application security, GRC consulting, cyber threat intelligence, digital forensics, SOC analysis and OT security. Openings were posted in India, the United Kingdom, Italy, the USA, Singapore, France, Germany, Ireland and the UAE. Most roles were no longer accepting applications at publication. Named employers include Honeywell, MANTECH, TENEX.AI, Oxford Nanopore Technologies, SMBC Group, SBS Transit and VINCI Energies.

Help Net SecurityAug 26, 09:40 UTC · 21d agoIndustry2

Top 10 Best Cloud Detection & Response (CDR) Solutions in 2026

Editorial scorecard ranks ten 2026 cloud detection and response platforms; Sysdig, Wiz, and CrowdStrike lead, with Wiz's Gem Security acquisition highlighted.

The editorial scorecard rates ten CDR platforms on real-time detection (30%), cloud telemetry depth, response automation, correlation, and value. Sysdig earns the best real-time detection score for its Falco- and eBPF-powered runtime telemetry, Wiz (8.7) folds acquired Gem Security's real-time CDR into its security graph, and CrowdStrike (8.7) leads response automation. Specialists Stream.Security, Skyhawk Security, Sweet Security, and the open-source Falco project are also assessed.

Cyber Security News07:41 UTC · 10h agoIndustry

5 useful things you'll learn in my new post-training textbook (shipping now!)

Nathan Lambert's new RLHF and post-training LLM textbook covers PPO, GRPO, GSPO, CISPO and related techniques, freely available online.

Nathan Lambert's book 'Reinforcement Learning from Human Feedback: Aligning and Post-training LLMs' is now shipping from Manning. It covers policy-gradient algorithms including PPO, GRPO, GSPO, CISPO, and RLOO, plus loss aggregation, truncated importance sampling, asynchronous RL systems, and post-training topics like rejection sampling, outcome reward models, and on-policy distillation. The book is freely available online with a 12-hour course, codebase, and exercises.

InterconnectsAug 10, 13:02 UTC · Aug 10, 2026AI research

Human Attacker Hits Machine-Speed Exploitation of Marimo RCE

Sysdig details a human attacker chaining pre-auth RCE in Marimo (CVE-2026-39987) to AWS credentials and a bastion host in eight seconds.

Sysdig's Threat Research Team documented an intrusion where an operator exploited CVE-2026-39987, a pre-auth RCE in the Marimo notebook terminal WebSocket endpoint, gaining an interactive shell with no credentials. The attacker harvested AWS credentials from the process environment and Redis backend, retrieved an SSH private key from AWS Secrets Manager, and authenticated to an internet-reachable bastion host. The chain fired in eight seconds after roughly four hours of toolkit building, logging over 850 commands during a nine-hour session. The flaw, fixed in Marimo 0.23.0, has been on CISA's KEV catalog with a May 7, 2026 federal remediation deadline.

Infosecurity Magazineupdated Sep 15, 11:52 UTC · 1d agofirst Sep 14, 14:15 UTC · 2d agoExploit / PoC in the wild 4 sources CVE-2026-39987

Who's governing your AI? A trust framework for enterprise agents and models

DigiCert pitches AI Trust framework using PKI, DNS policy records and workload identity to govern shadow AI agents across enterprises.

The Register-sponsored piece outlines DigiCert's AI Trust framework for governing AI agents, built on PKI, DNS, and attestation, citing IBM's 2026 Cost of a Data Breach report that 68% of organizations lack AI governance or shadow AI detection. The approach treats agent identity as workload identity aligned with IETF WIMSE, NIST CSF 2.0, and SPIFFE/SPIRE, using short-lived credentials instead of static API keys. DigiCert also proposes DMARC-style DNS agent policy records and an AI Agent Passport cryptographically binding agent identity to approved operations, with a unified kill switch.

The Register · SecuritySep 15, 15:00 UTC · 1d agoAI safety & security1

Bad Likert Judge: A Novel Multi-Turn Technique to Jailbreak LLMs by Misusing Their Evaluation Capability

Unit 42 details the Bad Likert Judge multi-turn jailbreak that abuses LLMs' evaluation capability, raising attack success rates over 60% across six frontier models.

Palo Alto Networks Unit 42 describes the Bad Likert Judge technique, a multi-turn jailbreak that asks a target LLM to act as a Likert-scale judge scoring the harmfulness of example responses. The highest-rated example in each scale can carry harmful content, bypassing the model's internal guardrails. Testing across six state-of-the-art text-generation LLMs showed an average attack success rate increase of more than 60% versus plain attack prompts, with tested models anonymized. The technique targets edge cases rather than typical use, and the article positions the work as guidance for defenders on potential jailbreak risks.

Palo Alto Unit 42Aug 17, 12:34 UTC · Aug 17, 2026AI safety & security

Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)

Citrix patched a critical authentication bypass, CVE-2026-19490, in NetScaler Gateway and NetScaler ADC, urging customers to upgrade immediately.

Citrix has patched two flaws in NetScaler ADC and NetScaler Gateway. CVE-2026-19490 is a critical authentication bypass (CVSS v4.0 9.3) that works when the appliance is configured as an SSL VPN, ICA Proxy, CVPN, RDP Proxy Gateway or AAA virtual server, with additional conditions depending on firmware and SAML configuration. A second flaw, CVE-2026-19489 (CVSS 8.8), is a memory overflow that can cause denial of service when SIP ALG is enabled on LSN setups. Rapid7 had not observed exploitation as of August 19, 2026, but urged emergency patching; a signature-based mitigation is available via NetScaler Console.

Help Net SecurityAug 21, 00:00 UTC · 26d agoVulnerability CVE-2026-19490 CVE-2026-19489

Cybersecurity jobs available right now: June 30, 2026

Help Net Security lists cybersecurity job openings across the US, UAE, France, Israel, Japan, Ireland, India, and Canada at major employers.

The roundup includes roles such as AI Offensive Security Engineer at AGAPI, Cloud Security Engineer at Spotify, IAM Engineer at Proton, DFIR in Israel, and a Senior Inspector overseeing NIS2 and AI regulation compliance in Ireland. Most listings were marked as no longer accepting applications, with a few still open including DFIR at Cye, IAM Engineer at Proton, and Detection Engineering at Saronic. The list covers employers across finance, infrastructure, and technology sectors.

Help Net SecurityAug 20, 10:38 UTC · 27d agoIndustry1

The OCUDU dApp Platform: An Open Runtime and E3 Interface for Real-Time AI-RAN

OCUDU open runtime lets third-party signed AI-RAN dApps run inside production 5G distributed units under three timing contracts, released as BSD-3 preview.

The OCUDU dApp platform provides an open runtime and E3 interface for executing signed AI-RAN applications inside a production 3GPP NR distributed unit, where prior dApp frameworks could only observe export streams. Modules run under three typed timing contracts: GPU receive-chain residency (Class A), the scheduler's 100 microsecond deadline (Class B), or non-blocking observer (Class C). On a GB10 gNB, dApps including an out-of-tree neural equalizer ran on a live cell without fallback. Platform, SDK, and a zero-hardware quickstart are public under BSD-3-Clause-Clear as a preview of the OCUDU AI-RAN Working Group 2.

arXiv cs.AI / cs.LG / cs.CLSep 7, 18:03 UTC · 9d agoAI tools & infra1

Top 10 Best AWS Security Tools in 2026

Editorial roundup ranking the ten best AWS security tools of 2026, from native GuardDuty and Security Hub to CNAPPs like Wiz and Prisma Cloud.

The article recommends enabling AWS-native services first: GuardDuty for threat detection, Security Hub for posture aggregation, the free IAM Access Analyzer, plus CloudTrail logging and Config rules. It then reviews third-party platforms including Wiz, Palo Alto Prisma Cloud, CrowdStrike Falcon Cloud Security, Trend Micro Cloud One, and Orca Security. It is an editorial vendor assessment with pricing described by model only, highlighting cross-account correlation and attack-path prioritization as third-party differentiators.

Cyber Security News09:57 UTC · 8h agoTools

Putting models to the secure coding test: Plan vs default mode

Datadog Security Labs tested Sonnet 5, Composer 2.5, and GPT 5.5 to see if plan mode yields more secure code than default mode.

Datadog Security Labs evaluated whether plan mode produces measurably more secure code than default mode. The test covered three frontier coding models: Sonnet 5, Composer 2.5, and GPT 5.5. The results inform how engineering teams should configure AI coding assistants to reduce insecure code. This is an AI security evaluation, not an incident report.

Datadog Security LabsAug 19, 00:00 UTC · 28d agoAI safety & security

Fine-tuning a 350M Model for Better Structured Outputs in 100 GRPO Steps

Hugging Face guide fine-tunes a 350M-parameter model with 100 GRPO steps to improve structured output reliability.

A Hugging Face blog post demonstrates fine-tuning a 350M-parameter model using GRPO (Group Relative Policy Optimization) with TRL over 100 training steps. The stated goal is more reliable structured outputs from small language models. No article body was available, so details beyond the title are limited.

Hugging Face BlogSep 3, 00:00 UTC · 13d agoAI tools & infra

Cybersecurity jobs available right now: September 15, 2026

Help Net Security's weekly roundup lists cybersecurity job openings worldwide, from CISO roles to cloud security engineers at firms like Adobe, JPMorgan Chase, and PwC.

Help Net Security's September 15, 2026 job roundup lists cybersecurity openings across India, USA, UK, Australia, Canada, Israel, UAE, Ireland, and Denmark. Roles include a CISO at Texas Health and Human Services, a GenAI CBRNE Cyber Security Expert at Alice, and security engineering positions at Adobe, JPMorgan Chase, PwC, and the Reserve Bank of Australia. Several openings focus on AI security, including red-teaming AI models and securing AI agent platforms.

Help Net SecuritySep 14, 22:15 UTC · 1d agoIndustry

Google’s open-source HEIR lets AI work with data it can’t see

Google open-sourced HEIR, a compiler toolchain that converts pre-trained AI models to operate on homomorphically encrypted data without exposing it.

Google's HEIR (Homomorphic Encryption Intermediate Representation) is an open-source compiler toolchain and development platform for fully homomorphic encryption, announced in 2023 and now supporting four peer-reviewed publications. It compiles Python programs handling sensitive data into implementations that process encrypted inputs, supporting multiple FHE schemes, libraries, front-end languages, and hardware accelerators such as GPUs, TPUs, FPGAs, and custom ASICs. Demonstrated applications include private recommendations, credit card fraud detection, network intrusion detection, and hotword recognition.

Help Net SecurityAug 18, 00:00 UTC · 29d agoTools

Two Arrests, One Supply-Chain Attack, and a Lot of Stolen Credentials

AFP charges two men over TeamPCP open-source supply-chain attacks that stole 500,000+ credentials from 1,000+ organizations via four malware families.

Australian police charged two Western Australian men as principal participants in TeamPCP, which allegedly inserted malicious code into open-source software to steal credentials and sensitive data from government, academia, and private sector organizations worldwide. The campaign compromised more than 1,000 organizations, harvested over 500,000 credentials, and exfiltrated at least 300 GB of data, with remediation costs in the hundreds of millions of dollars. Four malware families were deployed: CanisterWorm (cloud token harvesting), SANDCLOCK (AWS and Kubernetes credential theft), Mini Shai-Hulud (self-replicating npm/PyPI worm), and Miasma (credential-harvesting worm variant). Trojanized tools included Trivy, KICS, LiteLLM, and the Telnyx Python SDK, with exfiltration via GitHub repositories tpcp-docs and docs-tpcp.

Security AffairsAug 27, 14:09 UTC · 20d agoThreat actor in the wild1

G7 Urges Fast-Track on Quantum-Safe Cybersecurity Rules

G7 cybersecurity agencies led by France's ANSSI urged accelerated transition to post-quantum cryptography, prioritizing critical systems and phased, risk-based migration.

Under France's 2026 G7 Presidency, ANSSI, chairing the G7 Cybersecurity Working Group, published a September 3 call to action urging governments and organizations to begin quantum-safe (PQC) transitions now, reframing the quantum threat as near-term. The document, signed by the national cyber agencies of all G7 members and supported by the EU Commission and ENISA, outlines five priorities including national PQC strategies, R&D, public-private partnerships, and integrating PQC into cybersecurity requirements. It recommends cryptographic inventories, dependency mapping, prioritizing the most critical systems, and buying PQC-integrated products during normal renewal cycles. ANSSI will stop vetting non-quantum-safe products in 2027, with PQC mandatory in some security product procurement by 2030.

Infosecurity MagazineSep 4, 09:25 UTC · 12d agoPolicy & legal

Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent

The Hacker NewsAug 4, 11:16 UTC · Aug 4, 2026Exploit / PoC in the wild

The G7 tells industry to hurry up and prep for post-quantum encryption

A G7 working group report urges governments and industry to accelerate post-quantum cryptography migration, framing quantum risk as a near-term economic threat.

A cybersecurity working group formed at the June 2026 G7 Summit in France called on organizations to stop postponing migration of critical systems to post-quantum cryptography, warning that harvest-now-decrypt-later attacks against currently encrypted data exist today. The report was signed by CISA, the UK NCSC, France's ANSSI, Germany's BSI, Canada's CSE, Japan's NCO, and Italy's ACN. It also cautions that some NIST-selected PQC algorithms have already been broken on classical computers, reinforcing support for crypto-agility. The push aligns with a recent US executive order moving federal PQC migration timelines from 2035 to 2030, while Google and others target 2029.

CyberScoopSep 3, 19:29 UTC · 12d agoPolicy & legal

12 Best CIEM Tools Compared (2026): Features & Pricing

Buyer's guide compares twelve CIEM tools; Microsoft discontinued Entra Permissions Management, while Tenable (Ermetic), CyberArk, and Wiz lead the 2026 scorecard.

The scorecard evaluates twelve cloud infrastructure entitlement management vendors on permission analytics depth, JIT enforcement, non-human identity coverage, pricing predictability, and bundle leverage. Tenable (Ermetic) leads at 4.70, followed by CyberArk and Wiz, while Microsoft's retirement of Entra Permissions Management (CloudKnox) forces existing customers into migration cycles. Pricing structures span per-identity, per-resource, per-workload, credit-based, and quote-based models.

GBHackersupdated 09:52 UTC · 8h agofirst 07:37 UTC · 10h agoIndustry 14 sources

PentestGPT: Open-source automated penetration testing agentic framework

Open-source PentestGPT runs autonomous LLM-driven penetration tests via Claude Code and Codex, with legacy human-in-the-loop mode supporting many providers.

PentestGPT, originally published at USENIX Security 2024 by Gelei Deng and colleagues, is an open-source framework that lets a large language model autonomously run penetration testing stages (recon, exploit, walkthrough) with no human in the loop, driving Claude Code or Codex CLIs. A legacy interactive mode uses three cooperating LLM sessions maintaining a Pentesting Task Tree and supports OpenAI, Anthropic, Google Gemini, DeepSeek, xAI, Qwen, Moonshot, and local models via Ollama. The tool sends anonymous telemetry to Langfuse by default, excluding command outputs, credentials, and flags, and is available free on GitHub.

Help Net SecurityAug 12, 00:00 UTC · Aug 12, 2026Tools1

Product showcase: Doppler secures secrets for humans, pipelines, and AI agents

Doppler's secrets management platform centralizes credentials for engineers, CI/CD pipelines, MCP servers, and AI agents with runtime injection and dynamic secrets.

Doppler stores API keys, database URLs, tokens, and certificates in a single control plane and injects them at runtime, replacing .env files for human and machine identities including AI agents. It supports OIDC with short-lived identity tokens for Azure, AWS, and GCP, dynamic secrets scoped and time-boxed to single sessions, SCIM provisioning, 50+ integrations, and an MCP server that lets agents request configurations natively. Permissions are enforced at each layer so raw secrets stay out of logs, prompts, and model context, with versioning, rollback, SIEM log forwarding, and cloud or on-prem deployment.

Help Net SecuritySep 8, 05:00 UTC · 8d agoTools

Permify: Open-source authorization as a service

Help Net Security profiles Permify, an open-source Zanzibar-style authorization service supporting RBAC, ABAC, and relationship-based rules with multi-tenant deployments.

Permify is an open-source authorization-as-a-service project modeled on Google Zanzibar that centralizes access-control decisions outside application code. It supports role-based, relationship-based, and attribute-based access rules, answers checks in tens of milliseconds via REST and gRPC, and runs from a single Docker command. It is a CNCF member and is freely available on GitHub.

Help Net SecuritySep 14, 05:30 UTC · 2d agoTools1