ReversingLabs

Key takeawaysAgent permissions, not the prompt, are the real security boundary— coding agents that can touch repos, shells, and production systems create risk if their access isn’t tightly scoped.Overpermissioning compounds silently— agents typically inherit their user’s full access, and that spreads further when agents spawn sub-agents, breaking traceability back to the authorizing human.Goal-driven, non-deterministic agents will exploit any slack they’re given— the OpenAI–Hugging Face incident

Key takeawaysSame old flaws, bigger stakes: ~40% of CISA’s exploited-vulnerability catalog traces back to well-understood, preventable weaknesses (memory safety, input validation, injection).Attackers aren’t chasing zero-days: CVE disclosures more than doubled year over year, but exploited vulnerabilities grew only 20% — known gaps are still the target.AI raises the urgency: it speeds up vulnerability discovery and exploit development, shrinking the window before flaws get found and weaponized.T

Key takeawaysCISA/NSA’s report cited memory-safety issues behind 66-71% of major OS CVEs and 75% of in-the-wild exploited vulnerabilities, driving real adoption momentum.Adoption faces real headwinds: legacy C/C++ is too vast to rewrite wholesale, and experts say MSLs work best for new code, not replacing proven systems.AI is accelerating migration (Google’s Gemini-assisted Rust rewrite ofgiflibis an early proof point), but human review is still required — the AI-generated code itself had defect

AI is increasing both the volume and speed of cyberthreats, pushing organizations to invest more in AI-powered security capabilities to keep pace. Yet overall cybersecurity budgets are barely growing, suggesting that much of the increased spending on AI is coming at the expense of traditional security tools.Arecent survey by IANS and Articoshows that AI investments in cybersecurity have become a priority for 69% of organizations, with 24% giving AI its own security budget line. Others are foldin

Short-form videos on social media apps are currently being leveraged by threat actors as a phishing vector, utilizing tutorial style content with the promise of free premium software to lure victims onto malicious sites.This is an important threat to be cognizant of, as the videos can trick users into directly downloading malware. In order to best defend organizations, steps can be taken to mitigate the risks associated with these videos, both in user training and technical guardrails.Here’s wha

Listen to the AI hype machine enough and you will believe that the security operations center of tomorrow will be staffed by a couple of button-pushers, with AI doing all the heavy lifting. Agentic workflows in everything from triage to vulnerability research will wipe out the need for many well-established roles. SOCs will be where cyber careers go to die.Not so fast, say many cybersecurity veterans. They believe there’s going to be more than enough work to go around — and that cyber expertise

Application programming interfaces arrived with enormous promise — and minimal security standards. But APIs were widely adopted nonetheless, and it was only after a decade of painful breaches that API security became a real discipline.The AI analog of APIs is the Model Context Protocol (MCP) — and it’s following the same pattern. But a compromised MCP integration can wreak havoc faster and more broadly than any compromised API and be harder to trace.Here’s what your security team needs to know a

ITScape (CVE-2026-46316) is a guest-to-host escape vulnerability in thevGIC-ITS(Interrupt Translation Service) emulation within KVM/arm64, disclosed by researcher Hyunwoo Kim (V4bel) viaoss-securityon June 10. The root cause is a race condition in thevgic_its_invalidate_cache()function that produces a double-put use-after-free, ultimately enabling host kernel code execution.Because the bug lives entirely within in-kernel KVM rather than QEMU user-space, successful exploitation yields host kernel