Tag: access
-
Hackers Exploit 24 IoT Vulnerabilities to Install ClingSTUN Linux Backdoor
Meet ClingSTUN, a new Linux backdoor that exploits IoT vulnerabilities, gives attackers remote command access and turns infected devices into proxy nodes. First seen on hackread.com Jump to article: hackread.com/hackers-exploit-iot-vulnerabilities-clingstun-linux-backdoor/
-
Denmark’s CPR breach exposes 8.8 million people as experts warn over trusted third-party access
Personal details belonging to around 8.8 million people have been exposed in a breach of Denmark’s Central Person Register (CPR), after unauthorised parties abused a Danish company’s legitimate access to the national civil registration system, authorities confirmed on Monday. According to the Ministry of Research, Education and Digitalisation, the compromised information includes names, addresses and…
-
ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes
ClingSTUN exploits known IoT flaws and abuses public STUN servers to keep proxy access to devices First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/clingstun-backdoor-unpatched-iot/
-
Apple Strengthens macOS Privacy Controls as AI Agents Become More Autonomous
Apple has announced plans to strengthen macOS controls for Full Disk Access, citing concerns that increasingly autonomous AI agents could raise privacy and security risks by giving applications extensive access to users’ devices. In a developer update on October 2, Apple stated it will introduce additional controls for macOS Full Disk Access, a powerful permission…
-
Google Gemini to Gain Full Computer Access With New Permission
Google is reportedly testing a new Gemini Desktop feature that could give its AI agent extensive control over a user’s Mac. This includes access to files, interaction with installed applications, and network communication, all with fewer prompts requiring user approval for each action. Currently, Google has not publicly released this capability, and it has not…
-
Outband Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940)
Microsoft has pushed out an out-of-band security update for Exchange Server that fixes a high-severity vulnerability (CVE-2026-96940) that may allow authenticated attackers to … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/05/exchange-server-vulnerability-cve-2026-96940/
-
Apple Plans Tighter macOS Full Disk Access Controls Over AI Agent Data Access
Apple has announced that it’s taking steps to tighten controls around a macOS setting called Full Disk Access (FDA) due to security risks posed by artificial intelligence (AI) agents.”Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems”, including files, mail, messages, and even browsing…
-
AWS Fixes AI Agent Flaws Enabling Authentication Bypass and Credential Theft
Tags: access, ai, authentication, credentials, cyber, flaw, open-source, theft, update, vulnerabilityAWS released security updates for three vulnerabilities in its open-source Loom platform, used for AI agent orchestration. These vulnerabilities could allow unauthenticated administrative takeover, disclosure of OAuth2 credentials, and access to internal services. The company strongly urges users to upgrade all Loom deployments and forks to version 1.7.0. AWS announced these issues in Security Bulletin…
-
Why permissions must be the foundation for next-gen identity security
Authentication isn’t enough. Monitor access across humans, machines and AI agents. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/spons/why-permissions-must-be-the-foundation-for-next-gen-identity-security/831732/
-
Apple tightens macOS disk access as AI agents become more powerful
Apple plans to introduce additional controls for Full Disk Access in macOS, citing growing privacy risks as AI agents become more capable and autonomous. Users will need to … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/05/macos-full-disk-access-updates/
-
Autonomous AI Agent Chains Two Zammad Zero-Days in Machine-Speed Cyberattack
An autonomous AI agent breached the Dutch Institute for Vulnerability Disclosure (DIVD) after chaining two previously undisclosed vulnerabilities in the Zammad helpdesk platform, turning an initial application compromise into root access within seconds. The incident, first detected on September 22 after the attacker accessed DIVD systems a day earlier, offers a stark example of how…
-
11 Best CIAM Solutions Compared (2026): Features Pricing
Okta’s Auth0 line is the best CIAM for most product teams the benchmark ecosystem with the procurement fast-pass while Amazon Cognito and Microsoft Entra External ID win the price-floor fight for AWS- and Azure-committed builders. Evaluating the broader market across the top Identity and Access Management (IAM) companies reveals how customer identity has evolved from…
-
GlassWorm Supply Chain Attack Hides Malware Inside VS Code Color Themes
A GlassWorm-linked software supply chain campaign has abused seemingly harmless Visual Studio Code color themes to distribute malicious loaders across the Visual Studio Marketplace and Open VSX Registry. The activity demonstrates how extensions designed only to change editor colors can become high-impact initial-access vectors when they include unnecessary executable JavaScript. Both extensions presented themselves as…
-
Attackers Abuse Legitimate ScreenConnect Client in Phishing Campaign to Gain Remote Access
Threat actors are increasingly bypassing conventional malware detection by abusing legitimate remote monitoring and management software instead of deploying custom implants. In a recent phishing operation, attackers delivered a genuine, digitally signed ConnectWise ScreenConnect client configured to establish remote access to infrastructure controlled by the operator. The message claimed that a payment of $5,745.65 had…
-
Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: 16-year-old researcher breaks into Microsoft analytics service with access to … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/04/week-in-review-researcher-breaks-into-microsoft-analytics-service-netscaler-rce-0-day-exploited/
-
Ransomware 2026: Wenn gestohlene Daten zum schärfsten Druckmittel werden
Management Summary Daten statt Verschlüsselung: Ransomware-Gruppen erhöhen den Erpressungsdruck zunehmend durch den Abfluss großer Datenmengen; ThreatLabz beziffert das beobachtete Volumen auf 896,2 Terabyte. Führungskräfte werden zum Einfallstor: 62 Prozent der erfassten Opfer bekleideten laut Report mindestens eine Managementposition privilegierter Zugriff und geschäftlicher Einfluss machen sie besonders attraktiv. Vertrauenswürdige Werkzeuge werden missbraucht: Angriffe über Microsoft… First…
-
87 Prozent betroffen: Wenn KI-Agenten ihre Zugriffsgrenzen überschreiten
KI-Agenten erhalten Zugriff auf Daten, Anwendungen und Entwicklungsumgebungen doch vielerorts endet die Kontrolle nach der Anmeldung. Der Delinea-Report zeigt, wie weit Richtlinien und technische Durchsetzung auseinanderliegen. Für CIOs und CISOs folgt daraus eine klare Priorität: Berechtigungen müssen kurzlebig, kontextbezogen und bis zur einzelnen Aktion nachvollziehbar sein. Management Summary Governance-Lücke: Formale KI-Richtlinien sind nahezu flächendeckend… First…
-
Google Gemini could soon get full access to your Mac’s files, apps and the web
Google’s Gemini could soon access any file on your macOS device, open apps, browse the web, and perform actions without asking for permission every time. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/google/google-gemini-could-soon-get-full-access-to-your-macs-files-apps-and-the-web/
-
Danish university DTU breach exposes data of up to 200,000 people
The Technical University of Denmark (DTU) says information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/danish-university-dtu-breach-exposes-data-of-up-to-200-000-people/
-
CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed
GitLab fixes critical AI Gateway flaw that could let authenticated Duo users escape a prompt sandbox and execute commands on self-hosted gateways. GitLab has released patches for a critical vulnerability in its AI Gateway, tracked as CVE-2026-90970 (CVSS score of 9.9), that could allow an authenticated user with access to the Duo Agent Platform to…
-
CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed
GitLab fixes critical AI Gateway flaw that could let authenticated Duo users escape a prompt sandbox and execute commands on self-hosted gateways. GitLab has released patches for a critical vulnerability in its AI Gateway, tracked as CVE-2026-90970 (CVSS score of 9.9), that could allow an authenticated user with access to the Duo Agent Platform to…
-
Apple verschärft Full Disk Access wegen KI-Agenten
Apple plant strengere Kontrollen für Full Disk Access. Grund sind laut Apple wachsende Risiken durch KI-Agenten. First seen on golem.de Jump to article: www.golem.de/news/macos-apple-verschaerft-full-disk-access-wegen-ki-agenten-2610-213673.html
-
AWS AI Agent Vulnerabilities Let Attackers Bypass Authentication and Steal Credentials
Tags: access, ai, authentication, cloud, credentials, cyber, flaw, open-source, service, vulnerabilityAWS has released security fixes for four vulnerabilities affecting its open-source Loom AI agent orchestration platform and Amazon SageMaker Unified Studio. The flaws could allow attackers to bypass authentication, steal OAuth2 tokens and temporary cloud credentials, access internal services, and execute arbitrary code in another user’s SageMaker environment. AWS disclosed the issues in security bulletins…
-
Apple changes full-disk access permissions to curb abuse from AI agents
Meta says FDA isn’t sufficient to Muse reading messages. Apple begs to differ. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/apple-changes-full-disk-access-permissions-to-curb-abuse-from-ai-agents/
-
Apple says it’s tightening macOS ‘Full Disk Access’ controls due to new risks from AI agents
Apple says it will add new controls around macOS’s Full Disk Access permission, warning that increasingly capable AI agents make broad access to users’ files, messages, mail, and browsing history riskier. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/02/apple-says-its-tightening-macos-full-disk-access-controls-due-to-new-risks-from-ai-agents/
-
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers
A critical flaw in GitLab’s AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory.The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own gateway need to act. The flaw…