30
42
Microsoft Patches Record 622 Flaws, Including Two Zero
60
30
Iran-linked APT Mirage Kitten Uses Fake Job Tests to Spread Malware
Kaspersky reports Iran-linked Mirage Kitten delivers new NodeRabbit and PollCat malware to fintech and aviation targets via fake LinkedIn coding assessments.
Kaspersky researchers documented two previously undocumented Node.js malware families, NodeRabbit and PollCat, attributed with high confidence to Iran-linked APT group Mirage Kitten. The malware is delivered via fake recruiter personas on LinkedIn offering coding assessments hosted on Amazon S3, with instructions banning AI assistants so AI code-review tools would not flag the trojanized npm packages. NodeRabbit is cross-platform (Windows, Linux, macOS), uses AES-256-GCM-encrypted C2 on Azure, includes sandbox checks, and one variant installs a fake 'GitHub Copilot Helper' VS Code extension plus Git hook persistence. Victims identified so far are in fintech and aviation organizations across Egypt, Ethiopia, and Afghanistan.
74
30
42
60
30
42
NVIDIA Open-Sources OSMO: One YAML Orchestrates Physical AI Training, Simulation, and Robot Testing
NVIDIA open-sourced OSMO, a Kubernetes-native YAML orchestrator running physical-AI training, simulation, and robot testing across mixed GPU tiers.
OSMO (Apache-2.0, latest release 6.3.1) lets teams describe training, simulation, and hardware-in-the-loop pipelines in a single YAML and routes tasks across datacenter GPUs (GB200), workstation RTX hardware, and edge devices like Jetson AGX Thor. It ships Helm charts and containers on NGC, uses the KAI Scheduler with NVLink topology-aware placement, and includes RBAC, OAuth2, and TLS termination. NVIDIA says it is battle-tested on GR00T, Isaac Lab, Isaac Sim, and Isaac ROS, and integrates with Claude Code, OpenAI Codex, and Cursor agents.
48
42
42
42
60
30
42
60
Why 2026 is the Year to Upgrade to an Agentic AI SOC
Elastic Security Labs argues 2026 is the production inflection point for agentic AI in security operations centers.
Elastic Security Labs argues 2026 is the practical inflection point for agentic AI SOCs, noting nearly two-thirds of organizations are experimenting with AI agents while fewer than one in four have production deployments. The piece outlines operational challenges and recommendations: treat agents as non-human identities with least-privilege tool access, version-control system prompts as code, deploy unified agents with on-demand task packages, and enforce per-agent budgets and rate limits. It stresses explainability via RAG and transparent reasoning traces so analysts can verify and override autonomous decisions.
25
Week in review: High severity WordPress vulnerabilities, fake OAuth IDs bypass sign-in logs
60
60
UC Berkeley Researchers Release CUA-Lite, an Open Platform Unifying Sandboxes, Data, Evaluation and RL for Computer-Use Agents
UC Berkeley's CUA-Lite is an open platform unifying computer-use agent sandboxes, datasets, evaluation and RL; Lite.OSWorld cuts OSWorld memory 4.1 GB to 0.9 GB.
UC Berkeley researchers released CUA-Lite, an open platform placing agents, environments, traces, and training for computer-use agents behind one action space, one LiteSample schema, and one command across desktop, browser, and mobile. Lite.OSWorld reproduces the OSWorld task suite and evaluators in plain Docker containers (0.9 GB RAM vs 4.1 GB, cold start 23.8s, ~4.6× more parallel instances), with scores matching the QEMU/KVM VM across 13 models. The platform claims 30k+ verifiable tasks, 15+ benchmarks, 10+ agents, and 20+ datasets on Hugging Face including Aguvis, OpenCUA, and ScaleCUA. A documented SFT run lifts Qwen3-VL-2B-Instruct mean episode return from 0.138 to 0.237 on the 332-task lite.osworld split.
45
30
30
30
60
42
30
60
60
42
57
60
60
60
60
30
30
60
55