Cybersecurity

Vulnerabilities, attacks, threats, security tools, cloud security, and identity.

40 Articles

Cybersecurity

NuGet Reduces API Key Expiration to 30 Days to Strengthen Software Supply Chain Security

Starting August 17, 2026, NuGet.org will limit the duration of new API keys to 30 days, while all keys created before that date will expire on November 1. Microsoft recommends that package publishers move to OIDC-based Trusted Publishing.

2026-08-03

Cybersecurity

Microsoft warns of CaptiveCrunch campaign targeting travelers through hotel networks and stealing credentials

Microsoft detected a campaign conducted by Storm-2945, a subgroup of Midnight Blizzard, to manipulate traffic through hotel networks and captive portals in order to distribute malware and steal passwords, cookies, and Microsoft 365 session tokens. The campaign also uses phishing pages that exploit the Microsoft Entra ID device code authentication flow.

2026-07-31

Cybersecurity

An Open Industry Alliance to Develop Secure Tools for Cyber Defense in the Age of AI

NVIDIA and partners from the cloud computing, cybersecurity and open-source software sectors have announced the formation of the Open Secure AI Alliance to develop and share open models, tools and technologies for protecting software and intelligent agents. NVIDIA is contributing models, data and research to the alliance, while also making the open-source NOOA framework available on GitHub.

2026-07-27

Cybersecurity

From Signature-Based Inference to Agentic Intelligence: How Intrusion Detection System Design Is Changing

The article analyzes SnortML’s role in expanding Snort 3’s capabilities to detect new variants of known attacks and compares this with agentic artificial intelligence, which adds temporal context and multisource investigation. It also discusses the limitations of the current approach, the proposed integration architecture, and secure deployment requirements.

2026-07-06

Cybersecurity

Google: Indirect Prompt Injection Attacks Are Emerging on the Web but Remain Limited in Sophistication

A survey conducted by Google’s threat intelligence teams of public web content shows that various actors have begun experimenting with indirect prompt injection to target artificial intelligence systems, with the malicious category increasing by 32% between November 2025 and February 2026. Despite the limited sophistication of the observed attacks, Google expects their volume and complexity to grow as artificial intelligence systems become more capable and the cost of carrying out attacks declines.

2026-04-23

Cybersecurity

Google Integrates Rust into the Pixel 10 Modem to Strengthen the Security of the Cellular Connectivity Stack

Google announced that the Pixel 10 series will be the first Pixel devices to integrate the memory-safe Rust language into cellular modem software by replacing the DNS resolver with a component written in Rust. The company says the move reduces an entire class of memory-safety vulnerability risks, although the component adds approximately 371 kilobytes to the software image.

2026-04-10

Cybersecurity

Google Makes Device-Bound Session Credentials Available to Chrome Users on Windows

Google has announced the public availability of Device Bound Session Credentials on Chrome 146 for Windows users, with plans to expand the technology to macOS in a future release. The technology links login sessions to encryption keys stored in the device’s hardware, making stolen cookies unusable.

2026-04-09

Cybersecurity

How Google Continuously Addresses Indirect Prompt Injection Attacks in Workspace

Google explains its ongoing methodology for combating indirect prompt injection attacks targeting AI applications that use multiple data sources, such as Workspace with Gemini. The methodology relies on detecting and classifying attacks, generating synthetic data, then updating deterministic defenses, machine-learning models, LLMs, and the Gemini model itself.

2026-04-02

Cybersecurity

Google Pays More Than $17 Million to Vulnerability Researchers During 2025

Google announced that its Vulnerability Reward Program paid more than $17 million to more than 700 security researchers worldwide in 2025, an increase of over 40% from the previous year. The program launched a dedicated artificial intelligence track and expanded Chrome rewards, as well as a new program for the OSV-SCALIBR tool, alongside security research events that generated hundreds of reports.

2026-03-31

Cybersecurity

Google Begins Testing Post-Quantum Cryptography in Android 17

Google plans to introduce post-quantum cryptography improvements to Android 17, beginning with the next beta release and followed by the general production release. The changes include Android Verified Boot, Remote Attestation, Android Keystore, and Google Play app signing, with support for the ML-DSA algorithm and hybrid signatures.

2026-03-25

Cybersecurity

Chrome Develops a New HTTPS Certificate Architecture to Resist Quantum Computing

Google has announced a Chrome program to develop HTTPS certificates resistant to quantum computers, based on Merkle Tree Certificates, with a phased rollout plan that begins with live trials in collaboration with Cloudflare and concludes with the creation of a dedicated root store.

2026-02-27

Cybersecurity

Google Expands Android Scam Protection to Samsung Devices and Adds Messaging Support in More Than 20 Countries

Google announced the expansion of its Scam Detection feature for scam calls to the Samsung Galaxy S26 series in the United States, along with enhanced detection of scam messages through an on-device Gemini model. The updates include support for more than 20 countries and several languages, while keeping call processing on the device and leaving the feature disabled by default.

2026-02-25

Cybersecurity

Google Prevents Publication of 1.75 Million Policy-Violating Apps and Bans More Than 80,000 Developer Accounts in 2025

Google revealed the results of its Google Play and Android safety ecosystem in 2025, noting that it prevented the publication of more than 1.75 million policy-violating apps and banned more than 80,000 malicious developer accounts. Google Play Protect also expanded its protection against malware and fraud to 185 markets and more than 2.8 billion Android devices.

2026-02-19

Cybersecurity

How Can a “Sleeper Agent” Be Hidden Inside a Language Model and Awakened When a Specific Trigger Appears?

A Hugging Face article presents an experiment in which a team transformed a Qwen3.6-27B model into an agent capable of behaving normally and then carrying out a malicious task upon detecting a specific semantic trigger. The experiment shows that isolation and behavioral safeguards reduce the risk, but they do not replace code review and the construction of secure runtime environments.

2026-01-14

Cybersecurity

HTTPS Certificate Industry Moves to Eliminate 11 Less Secure Domain-Ownership Verification Methods

Chrome’s Root Program and the CA/Browser Forum have adopted new requirements to gradually phase out 11 outdated methods for verifying control of a domain when issuing HTTPS certificates. The process will take place in stages, with its full security value expected by March 2028, while pushing website owners toward automated methods that can be cryptographically verified.

2025-12-10

Cybersecurity

How Google Is Building Security Layers for Agentic Browsing Capabilities in Chrome

Google explains a multilayered security architecture to protect Gemini’s agentic capabilities in Chrome from indirect prompt injection, data leakage, and unwanted action execution. The architecture includes an independent model for reviewing whether actions align with the user’s goal, sets that restrict the assets the agent is allowed to read or modify, as well as user confirmations and continuous testing.

2025-12-08

Cybersecurity

Android Expands User Protection Trial Against Call Fraud in Financial Apps

Google has expanded an Android protection trial that warns users when they open a financial app while sharing their screen and speaking with an unsaved number, and lets them end the call and stop sharing with one tap. The trial began in the United States with financial institutions and apps such as Cash App and JPMorganChase, alongside its expansion in the United Kingdom and other trials.

2025-12-03

Cybersecurity

Google Enables File Sharing Between Quick Share and AirDrop with Rust Adoption to Enhance Security

Google has announced Quick Share compatibility with AirDrop, enabling two-way file sharing between Android and iOS devices, beginning with the Pixel 10 family. The company says the feature uses a direct device-to-device communication channel and relies on Rust, internal testing, and an independent evaluation by NetSPI.

2025-11-20