The top payout is for high-impact architectural research demonstrating full administrative control.

The post Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward appeared first on SecurityWeek.

The extension performed host reconnaissance and attempted to create a reverse SSH tunnel.

The post Malicious Claude Code Extension Served in Cursor Supply Chain Attack appeared first on SecurityWeek.

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.

The post Nobody Trusts the Security Questionnaire. We Rely on It Anyway. appeared first on SecurityWeek.

Fifteen years after coining the framework, John Kindervag insists zero trust still works in the AI era—if you get the implementation right.

The post Zero Trust Creator Says Model Holds Firm Against AI-Assisted Attacks appeared first on SecurityWeek.

Branch Target Reuse (BTR) is a new Spectre v2 attack targeting JIT compilers in web browsers, language runtimes, and the operating system kernel

The post New Spectre v2 Variant Exposes Intel, AMD, Arm CPUs to Data Leaks appeared first on SecurityWeek.

The company emerged from stealth mode with pre-seed funding from Osage University Partners and DataTribe.

The post RemoteThreat Launches With $7 Million for Offensive Operations Platform appeared first on SecurityWeek.

The malware framework uses a modular architecture and a custom executable file format for long-term persistence.

The post Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft appeared first on SecurityWeek.

Tracked as CVE-2026-32475 (CVSS score of 9.8), the bug described as an arbitrary file upload issue in the function that handles form submissions.

The post Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites appeared first on SecurityWeek.

Noteworthy stories that might have slipped under the radar: Microsoft rolled out patches for cloud services, hackers compromised 5,000 Dropbox accounts, and Guardio is now valued at $1.1 billion.

The post In Other News: Microsoft’s Cloud Patches, Hacked Dropbox Accounts, Guardio’s $1.1B Valuation appeared first on SecurityWeek.

Nearly two dozen issues, tracked collectively as CVE-2026-73749 (CVSS score of 9.8), were addressed with the updates.

The post HPE Patches Critical RCE Vulnerabilities in AOS-CX appeared first on SecurityWeek.

Named CosmosEscape, the vulnerability exposed the primary key for Cosmos DB accounts, granting full read and write access.

The post Critical Flaw Allowed to Azure Cosmos DB Pwnage appeared first on SecurityWeek.

Signed by Microsoft, the vulnerable UEFI shim bootloaders could be abused on any system, regardless of the OS.

The post Old UEFI Shims Expose Systems to Secure Boot Bypass appeared first on SecurityWeek.

The company founded by Yossi Torati, Omer Gull, and Yuval Itzchakov has emerged from stealth mode.

The post A Security Raises $37 Million for Autonomous Offensive Security Platform appeared first on SecurityWeek.

The company has developed a platform that uses specialized AI agents to inspect every incoming message.

The post Ocean Emerges From Stealth With $28M for Agentic Email Security Platform appeared first on SecurityWeek.

The company blocked over 1.1 billion accounts and $2.2 billion in potentially fraudulent transactions.

The post Apple Rejected 2 Million App Store Submissions in 2025 for Security and Fraud Prevention appeared first on SecurityWeek.

The company will invest in its firewall, certified patches, protection extensions, new products, and team expansion.

The post Socket Raises $60 Million at $1 Billion Valuation appeared first on SecurityWeek.

New vulnerabilities are being discovered too fast, the time-to-exploitation is too short, and our visibility into them is largely lacking.

The post Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little Visibility appeared first on SecurityWeek.

The exploitation is mitigated by preventing the FsTx Auto Recovery Utility from starting when the WinRE image launches.

The post Microsoft Rolls Out Mitigations for ‘YellowKey’ BitLocker Bypass appeared first on SecurityWeek.

Digital.ai’s latest threat report warns that agentic AI has erased the distinction between emerging and primary targets, enabling attackers to strike mobile apps within hours of release across every industry.

The post AI-Powered App Attacks Are Faster, More Frequent and Harder to Stop appeared first on SecurityWeek.

A compromised maintainer account was used to publish malicious package versions across the @antv namespace.

The post Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack appeared first on SecurityWeek.