Victoria Dubranova faces over 25 years in prison for links to Russia-backed CARR and NoName hacktivist groups.

The post US Indicts Extradited Ukrainian on Charges of Aiding Russian Hacking Groups appeared first on SecurityWeek.

GeminiJack is a zero-click Gemini attack that could have been exploited using specially crafted emails, calendar invites, or documents.

The post Google Patches Gemini Enterprise Vulnerability Exposing Corporate Data  appeared first on SecurityWeek.

Model Context Protocol (MCP) is quickly becoming the backbone of how AI agents interact with the outside world. It gives agents a standardized way to discover tools, trigger actions, and pull data. MCP dramatically simplifies integration work. In short, MCP servers act as the adapter that grants access to services, manages credentials and permissions, and..

The post Securing MCP: How to Build Trustworthy Agent Integrations appeared first on Security Boulevard.

OWASP unveils its GenAI Top 10 threats for agentic AI, plus new security and governance guides, risk maps, and a FinBot CTF tool to help organizations secure emerging AI agents.

The post OWASP Project Publishes List of Top Ten AI Agent Threats appeared first on Security Boulevard.

The two security defects impact FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager with FortiCloud SSO login authentication enabled.

The post Fortinet Patches Critical Authentication Bypass Vulnerabilities appeared first on SecurityWeek.

The XSS vulnerability could allow remote attackers to execute arbitrary JavaScript code with administrator privileges.

The post Ivanti EPM Update Patches Critical Remote Code Execution Flaw appeared first on SecurityWeek.

Affecting Solution Manager, Commerce Cloud, and jConnect SDK, the bugs could lead to code injection and remote code execution.

The post SAP Patches Critical Vulnerabilities With December 2025 Security Updates appeared first on SecurityWeek.

Dozens of vulnerabilities have been patched by the industrial giants across their products.

The post ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Rockwell, Schneider appeared first on SecurityWeek.

Organizations are encouraged block agentic browsers. 

The PCIe flaws, found by Intel employees, can be exploited for information disclosure, escalation of privilege, or DoS.

The post Intel, AMD Processors Affected by PCIe Vulnerabilities appeared first on SecurityWeek.

Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution.

• Adobe ColdFusion is a rapid web application development platform that uses the ColdFusion Markup Language (CFML).
• Adobe Experience Manager (AEM) is a content management and experience management system that helps businesses build and manage their digital presence across various platforms.
• The Adobe DNG Software Development Kit (SDK) is a free set of tools and code from Adobe that helps developers add support for Adobe's Digital Negative (DNG) universal RAW file format into their own applications and cameras, enabling them to read, write, and process DNG images, solving workflow issues and improving archiving for digital photos.
• Adobe Acrobat is a suite of paid tools for creating, editing, converting, and managing PDF documents.
• The Adobe Creative Cloud desktop app is the central hub for managing all Adobe creative applications, files, and assets.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Multiple vulnerabilities have been discovered in Mozilla products, the most severe of which could allow for arbitrary code execution. 

• Mozilla Firefox is a web browser used to access the Internet.
• Mozilla Firefox ESR is a version of the web browser intended to be deployed in large organizations.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

By integrating data from connected systems, sensors and devices, ‘smart cities’ better understand how municipal resources are used and where problems arise. 

Americans share desire for additional gun detection.

Security leaders need concrete AI guidelines to prevent risks.

Britain and its allies face escalating “hybrid threats … designed to weaken critical national infrastructure, undermine our interests and interfere in our democracies.”

The post UK Sanctions Russian and Chinese Firms Suspected of Being ‘Malign Actors’ in Information Warfare appeared first on SecurityWeek.

Military Competition in Space Will Intensify  (Economist)
Five areas to watch in the coming year.

When Leaders Mistake Brutality for Strength  (Jeff Flake, The Atlantic)
Americans may disagree on many things, but they still distinguish between necessary force and needless killing.

read more