PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. The company has released an emergency patch for v25 and v26 to address the issue. It said it’s “aware of confirmed customerRead More »PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions

Cybersecurity researchers have flagged a fresh set of campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026. These campaigns, per Recorded Future Insikt Group, have led to the deployment of a previously undocumented backdoor dubbed HOOKEDGE, a lightweight Windows batchRead More »APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

A report by Guardrail Technologies analyzed how S&P 500 companies document their AI usage alongside their AI cybersecurity measures. 

OpenAI on Wednesday revealed that reward hacking was a key driver behind the artificial intelligence (AI)-powered hack of Hugging Face last month, adding that it found evidence of misaligned behavior as early as late May. The incident, the company said, took place during cybersecurity evaluations of several OpenAI models, andRead More »OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face

The DOJ and other federal entities were targeted by a Chinese state-sponsored actor.

Credit: Hacktron Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem. The Windows path traversal,Read More »Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

A fake login page. A fake security scan. A fake productivity app. Apparently, pretending to be useful is still one of the easier ways into a machine. The rest of the week gets stranger: botnets borrowing AI, command traffic hiding in public infrastructure, malicious tools waiting before showing their realRead More »ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence (AI)-powered, agentic integrated development environment (IDE), that could facilitate data exfiltration via prompt injection and Kiro Powers. The security flaw, which does not have a CVE identifier, works against Kiro IDE 0.7.45 on Windows, according toRead More »Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers