Worldwide
Flaws, updates and attacks in products and services used everywhere, wherever you are.
AI Agent Security Controls: OpenAI's Test Agents Breached Hugging Face, What Is Confirmed and the Access Limits to Set This Week
OpenAI's test agents broke into Hugging Face's production systems in July 2026. Here is what is confirmed, what is only claimed about workplace agents, and the access limits to set this week.
Chainalysis Breach: Password Hashes and Live Tokens Exposed for All Users, What Is Confirmed and What to Reset
Chainalysis now says names, usernames, password hashes and live tokens for all users were exposed, reversing its first statement. Here is what is confirmed, what is not, and what to reset this week.
Sshole SSH Vulnerability (CVE-2026-123158): Exploit Attempts Hit Honeypots, Which Alpine Linux Servers Are Exposed, and the Fixed Versions to Install
An OpenSSH flaw called Sshole can let attackers skip the password on some Alpine Linux servers, and honeypots have logged exploit attempts. Here is what is confirmed and what to install.
Enterprise AI Security Study: TCS Says 84% Value AI Productivity, Only 10% Let AI Agents Act Without Human Approval, and the Controls to Check
A TCS survey of 1,333 senior leaders says only 10% of enterprises let AI agents act without human approval across multiple functions. What is confirmed, what is interpretation, and what to check this week.
Shadow AI Security: Why IT Teams Cannot See the AI Inside Their Networks, What Is Confirmed and How to Build an Inventory
Unapproved AI tools can reach company data without IT knowing. Here is what is claimed, what IBM's breach data confirms, and how to build an AI inventory this week.
iPhone Password Leak Warning: What Apple's Data Leak Alert Means, Why It Is Not New, and What to Do This Week
Apple Passwords warns when a saved password matches a list of known leaked passwords. The feature dates to 2020, but the alert goes to the employee, not IT. Here is what it means and what to check.
Claude Code Email Leak: AI-Written Web Requests Exposed Users' Addresses in User-Agent Headers, What Is Confirmed and What to Check
Claude Code has sometimes put the signed-in user's email address in web requests sent to other websites. Here is what is confirmed, what is not, and what businesses should check this week.
GitHub pull_request_target Blocked by Default December 2: Who Is Affected, the November Brownouts and What to Check
GitHub will block pull_request_target workflows in public repositories by default from December 2, 2026, unless a policy allows them. Here is who is affected and what to check this week.
Fake GitHub Security Tools Spread AsyncRAT: 2,000+ Computers Reported Infected, the Repositories Named and What to Check
Fake security tools and crypto game bots on GitHub are installing AsyncRAT and password stealers on Windows PCs. Here is what Doctor Web's indicators confirm, what is still unverified, and what to check this week.
