NewsroomLatest briefings
Every security and AI story SECBORN has published, newest first.
CISA Adds Exploited SharePoint RCE Flaw to KEV, Orders Federal Patch
A high-severity deserialization vulnerability in Microsoft SharePoint is now actively exploited, prompting CISA to mandate federal agencies patch within three days under…
Defending Against Prompt Injection in AI Applications
Prompt injection is the top security risk for tool-using AI systems. Here is how attacks work, why they are so dangerous in…
Quest NetVault Backup SQL Injection Flaw Enables Remote Code Execution
A high-severity SQL injection vulnerability in Quest NetVault Backup allows authenticated attackers to execute arbitrary code remotely, with the added complication that…
Unraid File Upload Flaw Enables Authenticated RCE, Patched in 7.3.0
A command injection vulnerability in Unraid's FileUpload.php allows authenticated remote attackers to execute arbitrary code. A fix is available in Unraid version…
X.Org Server Use-After-Free Bug Enables Local Privilege Escalation to Root
A use-after-free vulnerability in X.Org Server's SyncAwait object handling allows a local attacker with low privileges to escalate to root. A patch…
FBI Seizes NetNut Proxy Platform and Popa Botnet Infrastructure
The FBI, working with Google, Lumen, and Shadowserver, seized hundreds of domains tied to NetNut and the Popa botnet, a network of…
UK National Cyber Action Plan Delayed by Labour Leadership Crisis
Britain's forthcoming cybersecurity strategy has been postponed again following Prime Minister Keir Starmer's resignation, raising fresh concerns about the country's commitment to…
How Unit 42 Built WebAuthn Redirection Into a Browser-Based RDP Client
Palo Alto Networks' Unit 42 engineered WebAuthn virtual channel support directly into a browser-native RDP client, a feat that required reverse-engineering undocumented…
Microsoft Teams Gets New Admin Controls to Block Unauthorized AI Bots
Microsoft has introduced a new Teams admin policy that forces explicit organizer approval before external bots can join meetings, addressing growing privacy…
Scattered Spider Suspect, 19, Extradited from Finland to Face U.S. Charges
Peter Stokes, a dual U.S.-Estonian citizen, has been extradited from Finland and appeared in a Chicago federal court on charges of conspiracy,…
ChocoPoC RAT Targets Security Researchers via Trojanized GitHub PoCs
A Python-based remote access trojan named ChocoPoC is being distributed through weaponized proof-of-concept exploit repositories on GitHub, targeting cybersecurity researchers who test…
Scattered Spider Suspect Extradited to US After Finnish Arrest
A 19-year-old dual US-Estonian citizen faces federal charges tied to a luxury retailer breach and an $8 million ransom demand, after being…