Software

Mozilla announced today that it updated the GPG key used to sign Firefox and Thunderbird releases after it was accidentally exposed on GitHub. However, in a Monday blog post, it noted that the risk of a supply chain attack in which threat actors could distribute malicious installers signed with the exposed key is low because

Every agent incident disclosed this summer ends the same way: the agent completed its task with everything it had. The problem is how much it had. Taken one at a time, the flood of recent reports about AI agents breaking containment reads like a series of security failures. When we shift the viewpoint from the

Cloudflare says it mitigated more than 800 network-layer distributed denial-of-service (DDoS) attacks exceeding 1 Tbps in the second quarter of the year. Compared with the first quarter, when the company recorded just 130 attacks above 1 Tbps, the latest figure represents a more than fivefold increase. Cloudflare is a major web infrastructure and security firm

CISA confirmed today that ransomware gangs have begun abusing a high-severity Microsoft SharePoint remote code execution vulnerability, which has been flagged as actively exploited since early July. Tracked as CVE-2026-45659, this security flaw stems from a deserialization of untrusted data weakness and allows attackers with low privileges to execute arbitrary code on unpatched SharePoint servers.

Taiwanese news site United Daily News reports that, according to one source, Microsoft is charging Original Equipment Manufacturers (OEMs) significantly more for Windows licensing fees this year than in previous years (via Wccftech). These are the fees that PC makers, for instance, must pay to Microsoft to package their machines with the operating system. UDN

Cisco warned of two high-severity vulnerabilities affecting the Secure Endpoint Connector that allow threat actors to crash the ClamAV scanning process in denial-of-service (DoS) attacks. The security flaws (tracked as CVE-2026-20337 and CVE-2026-20338) were found in the ZIP archive parser of ClamAV (Clam AntiVirus), the open-source and cross-platform engine used to scan files for malware.

Earlier this year, Google Chrome annoyed a whole lot of adblock users by killing support for Manifest V2 extensions. It’s a Manifest V3 world now, which means the permissions and APIs that thoroughgoing adblockers like uBlock Origin rely on are a thing of the past on Chrome (it’s since been replaced by a pared-down version:

U.S. federal agencies and South Korea’s National Policy Agency warned government and critical infrastructure organizations worldwide to secure their systems against Gunra ransomware attacks. In a Monday joint advisory, they said the ransomware group uses a malware variant based on the Conti ransomware source code leaked in February 2022, in attacks targeting a wide range

Identity security is under growing strain. The passwords, multi-factor authentication (MFA) responses, IP reputation, geolocation and browser characteristics organizations have traditionally used to judge whether a login is legitimate are becoming easier for attackers to steal, imitate or work around. AI is adding to that pressure, not by creating a completely new class of attack,