On January 26, 2026, Microsoft issued emergency out-of-band security patches for a high-severity security feature bypass vulnerability in Microsoft Office, tracked as CVE-2026-21509. This vulnerability...

Our research team discovered a complete LLMjacking supply chain. Attackers scan for exposed AI endpoints, validate access through systematic API testing, then resell discounted access to compromised infrastructure...

Learn more about Double Agent: Service Agent Privilege Escalation in Google Vertex AI . Read more on XM Cyber website.

How enterprises can use SaaS for secrets management without giving providers access to secrets, certificates, or encryption keys. Learn how Akeyless enables zero-knowledge security for regulated environments.

YouTube video by Javvad Malik

Here's a curious thing about people, sometimes we crave the familiar, and sometimes we demand the novel.

Dear British Airways, I saw your latest business class sale advert. Beautiful photography, tasteful fonts, the usual tasteful smattering of champagne, winglets and folded duvets. Very on brand. And yet, in a strange way, it completely misses the point. From the ad, one can only assume the principal desire of the modern traveller is to drink, eat and lapse into a coma for the duration of the flight.

One of the world's most prominent cyber-criminals speaks to the BBC in an exclusive interview.

: Retailer's tech systems aren’t down anymore, but the same can’t be said for its rocky financials

Investigation launched after discovery that Chinese supplier had remote access to vehicles’ control systems

The CISO's guide to agentic browser security provides the top-six steps for cybersecurity teams to take with the advent of agentic browsers.

AI agents' rise has transformed software, as they make decisions and coordinate tasks. However, their security is often weak due to poor authentication and ad-hoc controls. The Model Context Protocol ...

The Blue Report 2025 reveals why modern data breaches mirror the Louvre heist, exposing how weak controls let attackers steal critical data.

The ForcedLeak AI agent vulnerability raises the question, "What is the difference between AI prompt injection and XXS vulnerabilities?"

Go beyond model scores and blind fuzzing, test your agentic systems against real-world risks.

AI agents still rely on static API keys, leaving them exposed to breaches and prompt injection attacks. Since API keys aren’t true identities, the solution isn’t better secrets management—it’s elimina...

There’s an old story about a village that finally got electricity. Everyone bought fridges. A few months later, the elders gathered and suggested the unthinkable… “get rid of them!” Before the fridges, leftover food was shared. No one went to bed hungry. After the fridges, leftovers were hoarded “just in case,” forgotten for days, and then thrown out. The tech solved an individual problem and quietly broke a community system that worked.

How attacks have moved away from endpoints and internal networks to the browser — a blind spot for traditional security tools.

Read more to understand the strengths and limitations of AI pen testing compared to human pen testing expertise.