PHP’s developers will release a patch Wednesday for two vulnerabilities rated 9.2 on the CVSSv4.0 scale that risk unauthenticated remote code execution. CERT-EU warned organizations unable to apply the fixes to prepare to take PHP-based websites offline temporarily.

BoA CEO Brian Moynihan said the bank brought in 1,000 contractors to help remediate vulnerabilities uncovered by Anthropic’s Mythos AI model, spending over $200 million on fixes. The contractors, added in Q2 to the bank’s 3,000-person technical staff, remain on hand as patching continues.

The Defense Manpower Data Center, which maintains Pentagon personnel records, notified roughly 3 million people that their Social Security numbers and other personal data were exposed after unauthorized users accessed an unencrypted file-sharing server for about nine months before discovery in July.

A mother says Facebook's Meta AI assistant volunteered a question asking who her daughter was in a video, then surfaced years of names, birth dates, photos, and location details about her kids. Meta told The Verge the feature never should have prompted questions like that and said it has fixed the issue.

A dark web service called Nexus is selling scans of more than 153 million drivers licenses from the U.S. and Canada, apparently sourced from a breach at a Louisiana identity verification company.

Researchers at ReliaQuest found attackers hijacking hotel and conference-center Wi-Fi routers to silently redirect travelers to fake Microsoft 365 login pages, a DNS-poisoning tactic observed across the U.S., India, and Saudi Arabia.

A full-screen popup warns that your Apple ID or Amazon account was just charged $149.99, urging you to call a number for help. Both the Apple and Amazon versions share the same phone number — a telltale sign it's a scam.

New research from Zscaler ThreatLabz looks past the headlines to examine which employees are compromised at the start of a ransomware attack, and what makes managers with elevated authority especially valuable targets for initia

A Pitt professor wasn't surprised when OpenAI's CEO said one of its AI systems autonomously hacked into another AI company, Hugging Face, using stolen credentials and a previously unknown vulnerability to access its servers.

The FBI's Internet Crime Complaint Center warns that scammers are creating fake social media profiles and AI-generated videos of officials, then offering to help recover funds from prior scams in order to steal from victims a second time.

The FBI reports Americans lost nearly $900 million to AI-powered scams in 2025, driven by voice cloning, deepfakes, and AI-generated scripts that supercharge romance scams, extortion calls, fake influencers, and government impersonation fraud.

As identity becomes the primary attack surface, attackers increasingly log in with valid privileged credentials rather than breaking in. This piece outlines why traditional access controls fall short and how auditors should test detection and response instead.

Google says the ShinyHunters group, responsible for the Canvas breach, may have accessed data at more than 100 organizations by targeting Oracle's PeopleSoft software; 68% of the targets identified so far are higher education institutions.

CAPTCHA checks — or pop-ups with a quick test to determine if the computer user is a robot — have become inescapable on the modern web. The FTC is warning that fraudsters are spreading fake CAPTCHA requests to take advantage of consumers. If you aren’t paying attention, criminals can quickly take control of your device.

Pitt's Office of Research Protections has rolled out a shorter Research Security Refresher Course to meet federal training requirements. The streamlined version reviews disclosure rules under the CHIPS and Science Act and is now available through CITI.

"Ghost tapping" lets scammers exploit near-field communication technology to charge tap-to-pay cards without physical contact. Schneider Downs outlines the risks for organizations that have added corporate cards to digital wallets and how to guard against it.

Google's Threat Intelligence Group identified a cybercrime group using AI to develop a zero-day exploit bypassing two-factor authentication in an open-source admin tool, marking the first known AI-generated exploit found in the wild.

Google's Threat Intelligence Group is tracking a threat actor that impersonates IT help desks, contacting victims over Microsoft Teams and using a fake "Mailbox Repair Utility" page to install malware and a malicious browser extension.

The anticipated release of new research security requirements related to NSPM-33 and the CHIPS and Science Act has been delayed due to the recent Presidential administration transition.

New research shows that instead of attention-grabbing subject lines, scammers are going with more subtle pitches to get you to click.

With the latest advances in LLMs, artificial intelligence (AI)-based code development assistants are increasingly part of day-to-day software development. A recent study of 500 U.S.-based developers showed that 92% use them for increased productivity and to automate repetitive tasks so that they can focus on higher-level challenging tasks. This article discusses some of the challenges arising from this wide-spread adoption.

The NIH has issued new restrictions on use of NIH Controlled-Access Data Repositories, including a prohibition of access by countries of concern and restrictions on the use of  the data for generative AI models.

The NIH has issued new restrictions on use of NIH Controlled-Access Data Repositories, including a prohibition of access by countries of concern and restrictions on the use of  the data for generative AI models.

In light of the uncertainty looming over the company’s future, you should do one thing to protect your privacy today: delete your 23andMe account.

As temperatures rise, you may be gearing up for summer travel. Whether you’ll be taking a semester abroad, doing on-site research, or just enjoying some well-earned rest and relaxation, keeping your devices safe while traveling is essential for a stress-free journey.