As organisations deploy hundreds of AI agents each year, security teams face unprecedented risk. This article outlines a robust framework to govern AI at scale, align speed with control and embed security from day one.
Agentic AI expands your attack surface because agents read and act on untrusted content. Consequently, indirect prompt injection can hijack tool use, leak data, and trigger risky actions. This guide explains how the attack works, how to detect it, and how to deploy guardrails that actually help at enterprise scale.
Microsoft’s July 2025 cumulative update KB5062553 for Windows 11 24H2 is breaking core shell features like the Start menu, taskbar, and Settings on some systems, especially in VDI and first-logon scenarios. This breakdown goes through what’s actually failing, why a XAML race condition sits at the center of it, and how admins can keep 24H2 from turning user desktops into black screens.
A WhatsApp API flaw allowed researchers to enumerate 3.5 billion accounts by abusing weak rate-limiting in the contact-discovery endpoint, exposing global phone-number mappings and public profile metadata that adversaries could weaponize for large-scale phishing, impersonation and SIM-swap attacks.
The recent outage at AWS’s US-EAST-1 region grounded dozens of major services and exposed a deeper issue: the loss of senior engineering expertise at Amazon. As widespread apps and platforms went offline, one question loomed large: Can the world’s largest cloud infrastructure sustain itself amid massive talent reductions? Below, we analyse the root causes, implications and lessons for infrastructure reliability.
A public PoC for CVE-2025-59287 exploits an unsafe deserialization flaw in WSUS. Administrators must deploy Microsoft’s October 2025 updates and hunt for indicators of compromise immediately.
Instagram’s latest overhaul introduces PG-13-level restrictions for teen accounts. Under the update, users under 18 will have tighter filters, limited searches, and parental approval requirements for more open settings.
Attackers behind the ClickFix campaign registered over 13,000 unique domains to execute browser-based malware through fake CAPTCHA lures and clipboard tricks. This breakdown reveals their infrastructure, tactics, and defenses every security team must implement.
A third-party customer support vendor connected to Discord suffered a data breach that exposed personal information. Attackers accessed the vendor’s ticketing system and obtained names, email addresses, usernames, and in some cases scanned government-issued IDs. Crucially, Discord confirmed that its internal infrastructure remained unaffected. Nevertheless, the event underscores the risks created when organizations depend on…
A new XCSSET malware variant for macOS introduces a clipboard hijacker to steal cryptocurrency and expands to Firefox browser data theft. Security researchers warn developers to inspect Xcode projects and apply strong defenses against this evolving threat.