Articles

3 Frameworks to Protect CISOs & Orgs Against AI Liability (opens the original source in a new tab)

Cyber leaders can get ahead of AI liability with rigorous documentation, transparency, and smart contract negotiations with AI vendors.

External Teams Chats Anchor 15-Minute Malware Delivery (opens the original source in a new tab)

Main bombing sis getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang.

SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack (opens the original source in a new tab)

A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises.

Beware the Slasher: AI Could Kill Off Cybersecurity Pros' Skills (opens the original source in a new tab)

Nathan Hamiel outlines potential SecOps horror in the AI midst, as core technical capabilities go the way of reading an atlas or remembering phone numbers.

'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants (opens the original source in a new tab)

The malware's focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint.

So Many AI Security Benchmarks, But None Tell the Whole Story (opens the original source in a new tab)

Measuring AI model security gets complex, fast, thanks to a growing patchwork of benchmarks targeting different variables in the equation. But none replace testing against your own code and workflows.

Risks & Rewards: How AI Is Redefining the CISO's Role (opens the original source in a new tab)

Nvidia security executive Mark Weatherford says CISOs must help business leaders weigh AI's pros and cons, and ensure those deploying it own the risks.

In-the-Wild Attack Abuses AI Agents' Trust in Markdown (opens the original source in a new tab)

A new AI agent prompt injection technique exploits how coding assistants consume local instruction files, blurring the line between text documents and executable actions.

'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets (opens the original source in a new tab)

An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.

10 Software Security Practices Built for the Next 250 Years (opens the original source in a new tab)

This Cybersecurity Awareness Month's theme, Securing the Next 250, asks us to look beyond vulnerabilities and consider what will make our digital systems resilient for generations.

Trust Is Not What It Seems — and Fraudsters Are Counting on It (opens the original source in a new tab)

Threat actors don't need to rely on malware to breach organizations anymore. They're simply calling help desks and politely asking for access, with a little help from artificial intelligence.

Exposed to PHP2Shell? Cyber Experts Weigh in With Advice (opens the original source in a new tab)

Fixing the critical PHP flaws is not as simple as clicking Update. Here's how to assess your risk, and what you can do to protect yourself.

AI Tools Are Generating Massive Attacks for Little Cost (opens the original source in a new tab)

One campaign targets 105 sites using open-weight models; in another, public models gained full domain control for $12. Cyber-defense will have to change.

Why Caribbean Threats Cascade Into Global Cyber-Risk (opens the original source in a new tab)

The region is demonstrating what happens when exploits accelerate but assurance does not.

Cyber Insurance's New Reality: Underwriting Isn't Enough (opens the original source in a new tab)

Rising AI, social engineering, and cloud risks are pushing carriers beyond risk transfer and deeper into cybersecurity itself.

AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack (opens the original source in a new tab)

Microsoft's Project Perception adds Guardian Agents to monitor and contain anomalous AI agents, but experts warn that policing unpredictable agents with other agents may compound — not contain — the risk.

State Bank of India Suffers a Customer PII Data Leak (opens the original source in a new tab)

Relatively small data breaches in India can turn quite serious, thanks to a sophisticated underground market for trading PII.

Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack (opens the original source in a new tab)

The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.

What We Missed: Feds Lasso Texas Laptop Farms (opens the original source in a new tab)

In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, from busting up North Korea's stateside infrastructure in Operation Lonestar Justice to Staples' gift card bonanza.

Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jour (opens the original source in a new tab)

Des centaines de magasins ont subi des pertes se chiffrant en millions d'euros parce qu'ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de climatisation.

As AI Risks Grow, Insurers Split on Covering the Damage (opens the original source in a new tab)

Some build specialized agentic AI coverage, while major carriers quietly exclude it — leaving enterprises exposed without their knowledge.

UAE Transitions 50% of Government Services to Agentic AI (opens the original source in a new tab)

The United Arab Emirates says it's creating a foundation of security and safety as it transforms its public service footprint.