SecurityWeek

The two RCE bugs can be exploited against WordPress, Drupal, Joomla, and other popular applications.

Deceptive prompts lure AI agents into decoys and dead ends, cutting attack success by up to 91% in tests and raising the cost of a successful attack 23-fold.

Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents.

Asymptote Labs raises $5.5M seed led by Tower Research Ventures to commercialize its Beacon AI agent runtime security platform.

The update fixes 353 flaws, including 163 memory corruption and 125 use-after-free vulnerabilities.

In two internal incidents, agents read routine coding instructions as permission to weaken monitoring, and one gave a false answer about it.

The private keys associated with eight certificates were compromised, and root programs and trust stores are blocking them.

The DHS said agencies should remove DeepSeek products as well as third-party products and services developed using DeepSeek from their IT systems.

Tasked with writing an application for a US defense contractor, the model made the code 19% more likely to be hackable.

Tracked as CVE-2026-109618 and CVE-2026-109619, the bugs could potentially lead to unauthenticated remote code execution.

Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader.

The first phase will cover up to 500 utilities, which will get free security tools, equipment, deployment help and training.

NIST, CISA and NSA share ten voluntary practices for preparing for, detecting, responding to, recovering from, and reporting rogue AI agent incidents.

Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework.

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.