AI presents both opportunities and significant risks for growing businesses. Cybercriminals are leveraging AI to launch more effective and targeted attacks. For example, AI-automated phishing has proven to be 4.5 times more effective than traditional methods, creating new challenges for business leaders balancing growth and security.
A spoofing vulnerability in Microsoft Exchange Outlook Web Access (OWA) is being actively exploited. The U.S. CISA is urging organizations to prioritize patching. Microsoft has released a fix and recommends enabling Extended Protection for Exchange Server (EEMS) to mitigate the significant risk.
New AI agents can automatically find and exploit obscure software vulnerabilities. At the same time, developers are increasingly using AI to generate large volumes of code that may contain new flaws. This dual threat is forcing security teams to rethink their defensive strategies and adapt quickly.
A critical security flaw in NGINX Plus and NGINX Open is being actively exploited in the wild, just days after it was disclosed. The vulnerability, CVE-2026-42945, is a heap buffer overflow affecting a wide range of NGINX versions from 0.6.27 through 1.30.0.
A phishing kit named Tycoon2FA has been updated to bypass two-factor authentication on Microsoft 365 accounts. It uses a technique called device-code phishing and abuses legitimate click-tracking URLs to evade detection, posing a significant threat for organizations using Microsoft's cloud services.
A recently published guide demonstrates how a vulnerability in SAR2HTML version 3.2.1 can be exploited for remote code execution. The walkthrough, based on a TryHackMe challenge, shows how attackers can gain root privileges and full control over a target system by leveraging this specific software flaw.