Chrome zero-day attacks, router hijacks, Coder’s supply chain breach, image-free QR phishing, and more security news.

Three unauthenticated CVEs in retrieval, serving, and database layers this week - plus a nine-CVE Microsoft identity batch - ...

AI's RAG platform let attackers run arbitrary queries as PostgreSQL superuser - and the default config has auth turned off.

PostgreSQL vulnerability CVE-2026-6471 allows low-privileged attackers to execute code, gain PostgreSQL superuser access and ...

Kane Wu/Chief Asia M&A Correspondent "Financial details of the IPO are actually not finalized at this point, because Moonshot just filed confidentially for a Hong Kong IPO. For ...

The flaw that had gone unnoticed since 2014 could let attackers with low-privileged replication access execute code, gain ...

Microsoft is changing its reporting structure from three segments to two - Agents and Infra and Devices and Consumer - as the company responds to changes brought about by artificial intelligence.

AI model testing organization METR has disclosed two attacks that happened earlier this year, including one in which an attacker stole an API key and spent three weeks consuming public-model credits ...

In one attack, threat actors stole an API key that ultimately led to the consumption of $600,000 in public AI model credits ...

Auth0, CrowdStrike Falcon and Salesforce Service Cloud connectors can now consolidate security data from multiple accounts or tenants into a single Sentinel workspace.

ValleyRAT abuses signed QN Wallpaper software for DLL sideloading, disables Windows Defender, and runs inside a trusted ...

PaperCut issued emergency patches on Friday to address critical vulnerabilities in its print-management software. The company ...