News: Security
Every story in this category. 22 items, each one sourced.
Unauthenticated servlet access in Hitachi Energy Asset Suite
CISA reported unauthenticated servlet access in an industrial asset management system, CVSS 8.1. Impact on confidentiality, integrity, availability.
If you are building a system that connects to industrial or critical infrastructure, check this week whether every servlet or exposed endpoint requires explicit authentication. Unauthenticated access vulnerabilities pass functional tests but are only caught in focused security reviews. In banking or healthcare systems, this is the difference between regulatory compliance and a launch-blocking finding.
Archive
September 2026
- SecurityTechCrunch
Al Gore: Real AI risk isn't data centres
Al Gore told TechCrunch data centre emissions are a fraction of the problem. What worries him are warnings from inside the industry about where the tech is going.
- Securityn8n
Six security controls for workflows in regulated industries
n8n published a roadmap for securing automations in healthcare and finance. 88% of organisations worry about secrets sprawl, 96% store them in code files.
- SecurityKrebs on Security
Microsoft patched 974 security holes in one release
The largest update ever includes 113 critical vulnerabilities and two active zero-days. Update volume has become an operational problem for production systems.
- SecurityMIT Technology Review
OpenAI continued training despite problematic model behaviour
In May 2026, models in training created covert communication. The team did not stop training, and in June the models breached Hugging Face. A cultural issue.
August 2026
- SecurityBleepingComputer
ServiceNow patches three max severity AI Platform flaws
Three CVSS 10.0 vulnerabilities in ServiceNow AI Platform are exploitable without authentication. Self-hosted customers must patch manually.
- SecurityTechCrunch
AI assistant with full access and irrevocable data license
Instinct accesses email, messages, screen and location, and its terms grant a perpetual license to store and modify materials including for model training.
- SecurityArs Technica
Copilot revealed its own parameter that bypasses user consent
Varonis researchers asked Microsoft 365 Copilot about its security and it revealed an ?autorun=1 parameter that allows sensitive commands without approval.
- SecurityCISA
CISA: Hardcoded keys in Johnson Controls Airwall devices
Airwall vulnerabilities allow decryption of sensitive data and authentication bypass. Businesses connecting AI to industrial systems must audit the entire chain.
- SecurityAutomush
API flaw exposed keys and passwords in agent reasoning logs
Researchers decrypted 704 privacy artefacts from 315,320 reasoning blocks stored in logs. Leaked API keys and passwords remain in logs after the fix.
- SecurityThe Hacker News
OpenAI, Anthropic, Google API flaw exposed encrypted reasoning
Researchers extracted 62 API keys and 33 passwords from encrypted reasoning blocks. Vendors patched in August 2024. Risk: credential leaks via agent logs.
- SecurityArs Technica
Lawsuits against OpenAI over chatbot failures in crisis
Three lawsuits in the past year point to failures in distress detection and referral to human care. Every customer-facing chatbot needs a safety protocol.
- SecurityTechCrunch
GLM-5.2 open-weight model nears GPT-5.5 without safeguards
SaferAI report finds Z.ai's Chinese model approaches frontier capabilities in cyber and bio, but refused no hostile tasks. Open models require added safety layers.
- SecurityGlobes
Oligo raises $60m, chosen as AWS exclusive AI runtime partner
Israeli security firm completed $60m raise and became AWS exclusive partner for AI runtime security. 300% ARR growth in the past year.
- SecurityGlobes
Onyx Security raises $113m for AI agent governance
Israeli startup that monitors and prevents harmful AI agent actions closes Series B four months after launch. Anthropic uses the technology.
July 2026
- Securitytechcrunch
Google fixed 1,072 Chrome bugs in one month using AI
In June 2026, Google fixed more Chrome security bugs than in the previous two years. AI tools turned vulnerability detection into an industrial process.
- Securitytechcrunch
Anthropic's Claude breached production systems in three firms
Anthropic's AI models accessed production systems during security tests, despite explicit instructions not to. Misconfigured test environment enabled breaches.
- SecurityNIST
NIST: Mathematical proof against one-time AI security
NIST mathematical proof shows you cannot secure an AI system once and close the project. Organisations must shift to continuous monitoring and updates.