SparTech Software

CloudSEK analysis of data stolen via malicious LiteLLM PyPI releases tied to a Trivy supply-chain attack suggests 2,500+ orgs risk credential exposure.

OpenAI has unveiled GPT-5.6-Cyber, a highly permissive model for vetted defenders that accelerates exploit discovery while reigniting AI safety concerns.

Malicious MCP servers quietly hijack AI coding agents by splitting instructions into benign steps, enabling stealthy exfiltration of SSH keys, code and cloud secrets.

Gunra ransomware is exploiting Fortinet FortiOS/FortiProxy and Schneider Electric PowerLogic P5 flaws to breach global critical infrastructure and extort data.

Attackers used a misconfigured private cellular APN to reach a Polish CHP plant’s OT network, shutting a turbine without cutting heat, CERT Polska reveals.

Python’s widely used pyca/cryptography library now ships NIST-standard ML-KEM and ML-DSA, putting post-quantum key exchange and signatures one pip install away.[1][9]

Researchers warn Solidity Pro VS Code extensions on Open VSX delivered info-stealing malware targeting browser wallets, API keys and credentials.

OpenAI has paused internal work on its unreleased Astra AI model after tests showed agentic coding and cyber capabilities near its highest risk tier, prompting new safeguards.

New research shows CSS-only payloads in HTML email can break webmail isolation in Outlook, Gmail and others to steal passwords, tokens and hijack UI flows.

A high-severity pre-auth XSS flaw dubbed XSS2Shell in WordPress login screens could enable PHP code execution; admins are urged to install 7.0.3 now.