OpenClaw faces security vulnerabilities and misconfiguration risks despite rapid patches and its transition to an OpenAI-backed foundation.

The post OpenClaw Security Issues Continue as SecureClaw Open Source Tool Debuts appeared first on SecurityWeek.

The Series A funding round, led by Bain Capital, brings the total raised by Cogent to $53 million.

The post Cogent Security Raises $42 Million for AI-Driven Vulnerability Management appeared first on SecurityWeek.

Before tools, before frameworks, before hype, offensive security has always been about one thing: Thinking like an attacker. That foundation now defines the offensive AI security skills practitioners will need as AI reshapes the attack surface. AI systems introduce new behaviors and new failure modes, but the core mindset remains the same: understand how a

The post The Skills That Will Matter for Offensive AI Security in 2026 appeared first on OffSec.

The latest Android version continues to improve security and privacy, according to its developers.

The post Android 17 Beta Strengthens Secure-by-Default Design for Privacy and App Security appeared first on SecurityWeek.

The company will use the investment to scale operations and deepen intelligence and automation.

The post Nucleus Raises $20 Million for Exposure Management appeared first on SecurityWeek.

The startup relies on AI agents to identify software vulnerabilities and validate them before reporting.

The post Zast.AI Raises $6 Million for AI-Powered Code Security appeared first on SecurityWeek.

After a decade and a half of service, the current certificates will expire, and new ones will be rolled out.

The post Microsoft to Refresh Windows Secure Boot Certificates in June 2026 appeared first on SecurityWeek.

More than two dozen advisories have been published by the chip giants for vulnerabilities found recently in their products.

The post Chipmaker Patch Tuesday: Over 80 Vulnerabilities Addressed by Intel and AMD appeared first on SecurityWeek.

Dozens of vulnerabilities, bugs, and potential improvements have been identified by the tech giants’ security teams.

The post Google-Intel Security Audit Reveals Severe TDX Vulnerability Allowing Full Compromise appeared first on SecurityWeek.

Edge devices that are no longer supported have been targeted in attacks by state-sponsored hackers, the US says.

The post Organizations Urged to Replace Discontinued Edge Devices appeared first on SecurityWeek.

As breach costs go up and attackers focus on common web features like dashboards, admin panels, customer portals, and APIs, weak access control quickly leads to lost data, broken trust, and costly incidents. The worst part is that many failures are not rare technical flaws but simple mistakes, such as missing permission checks, roles with too much power, or predictable IDs in URLs.

This post aims to help you control who can access different parts of your website and explain why it matters. 

Continue reading Beyond Login Screens: Why Access Control Matters at Sucuri Blog.

VS Code-integrated configuration files are automatically executed in Codespaces when the user opens a repository or pull request.

The post VS Code Configs Expose GitHub Codespaces to Attacks appeared first on SecurityWeek.

The US National Reconnaissance Office has declassified information about a fleet of spy satellites operating between 1971 and 2006.

I’m actually impressed to see a declassification only two decades after decommission.

A hacker published malicious versions of four established VS Code extensions to distribute a GlassWorm malware loader.

The post Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack appeared first on SecurityWeek.

The likely state-sponsored threat actor had access to the hosting provider for months and targeted only certain Notepad++ customers.

The post Notepad++ Supply Chain Hack Conducted by China via Hosting Provider appeared first on SecurityWeek.

Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes of website compromises.

To help educate website owners about potential threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this past month.

The vulnerabilities listed below are virtually patched by the Sucuri Firewall and existing clients are protected.

Continue reading Vulnerability & Patch Roundup — January 2026 at Sucuri Blog.

Hackers compromised a MicroWorld Technologies update server and fed a malicious file to eScan customers.

The post eScan Antivirus Delivers Malware in Supply Chain Attack appeared first on SecurityWeek.

Last month, while working on a WordPress cleanup case, a customer reached out with a strange complaint: their website looked completely normal to them and their visitors, but Google search results were showing something very different.

Instead of normal titles and descriptions, Google was displaying casino and gambling-related content. We have been seeing rising cases of spam on WordPress websites. What made this even more confusing was where the spam was appearing.

Continue reading Shadow Directories: A Unique Method to Hijack WordPress Permalinks at Sucuri Blog.

From an Anthropic blog post:

In a recent evaluation of AI models’ cyber capabilities, current Claude models can now succeed at multistage attacks on networks with dozens of hosts using only standard, open-source tools, instead of the custom tools needed by previous generations. This illustrates how barriers to the use of AI in relatively autonomous cyber workflows are rapidly coming down, and highlights the importance of security fundamentals like promptly patching known vulnerabilities.

[…]

A notable development during the testing of Claude Sonnet 4.5 is that the model can now succeed on a minority of the networks without the custom cyber toolkit needed by previous generations. In particular, Sonnet 4.5 can now exfiltrate all of the (simulated) personal information in a high-fidelity simulation of the Equifax data breach—one of the costliest cyber attacks in history­­using only a Bash shell on a widely-available Kali Linux host (standard, open-source tools for penetration testing; not a custom toolkit). Sonnet 4.5 accomplishes this by instantly recognizing a publicized CVE and writing code to exploit it without needing to look it up or iterate on it. Recalling that the original Equifax breach happened by exploiting a publicized CVE that had not yet been patched, the prospect of highly competent and fast AI agents leveraging this approach underscores the pressing need for security best practices like prompt updates and patches.

AI models are getting better at this faster than I expected. This will be a major power shift in cybersecurity.

Zero Trust is not a thing; it is an idea. It is not a product; it is a concept – it is a destination that has no precise route and may never be reached.

The post Cyber Insights 2026: Zero Trust and Following the Path appeared first on SecurityWeek.