Computer Security Articles

Organizations looking for a faster and more structured way to threat model their AI systems now have access to an open-source resource designed to help identify security risks before they become exploitable vulnerabilities.The OWASP Foundation’sThreat Advisoris an AI-powered assistant that guides users through the threat modeling process by first asking them to describe their AI system and then conducting an interactive interview to identify relevant threats, assess risk, and recommend mitigatio

It started with a phone call from a friend. He’d tried to log into his university’s Student Association website — a site he used constantly and trusted — and hit a strange CAPTCHA screen. Something felt off. He asked me to take a look.I did. Working with RL’s Spectra Analyze, I ran interactive dynamic analysis. What I found was a textbook ClickFix attack. The student site was compromised and used as a “watering hole” to draw in potential victims. Key to the attack was a pixel-perfect fake Google

In early 2026, sources began reporting an uptick in SVG based malware. SVG, standing for scalable vector graphics, is a filetype usually utilized to create vector images. SVGs are special due to their ability to utilize Javascript.Threat actors use this functionality to craft SVG files that can act maliciously. Malicious SVGs can take the form of fake login pages, data exfiltrators, or malicious downloaders, amongst other things. SVGs are frequently overlooked, as they are assumed to be benign i

Open-source software underpins some of the world’s most critical infrastructure. Banking, telecommunications, and utilities all run on software that shares the same OSS libraries. Finding vulnerabilities in that software is pressingly important, but it can take experts weeks to do so. Now, artificial intelligence can find them in minutes.As good as that might sound, the speed of discovery does bring problems. With that in mind, the Linux Foundation and industry heavyweights including Amazon Web

A new report finds weakening trust in AI-only testing — and more willingness to keep humans in the loop.A year ago, nearly three of every 10 organizations were comfortable letting AI run their penetration testing end to end — no humans required. Today, confidence in that model has collapsed.Cobalt’s newAI and Pentesting Pulse Report 2026— based on a survey of 455 cybersecurity professionals — found the share of organizations relying solely on AI automation for testing fell from 29% in 2025 to ju

Remember those words of advice for the over-eager fromWest Side Story? “Boy, boy, crazy boy, be cool boy.” They should be heeded by developers hell-bent on installing the latest updates to open-source software. Adopting a “cooldown” policy on updates can be a simple but effective way to avoid downloading malicious code.Noelle Murata, a senior security engineer at Xcape, said organizations should enforce a three-to-four-day minimum age requirement for new packages and updates.“A short delay gives

Three themes run through RL’s Malware Analysis and Threat Hunting portfolio updates for the first half of 2026: Infrastructure Modernization, Automated Incident Response, and AI-ready Architecture.Here are the key highlights:Spectra Detect v6.1: Kubernetes-Native Deployment for Enterprise ScaleSpectra Detect is engineered for speed, scalability, and extensibility, with the ability to process millions of files per day. With the release of version 6.1, Spectra Detect introduces Kubernetes microser

A whopping 95% of all code will be AI-generated within the next five years, Microsoft’s chief technology officer, Kevin Scott,predicted recently. Because AI-generated code tends to be security-challenged, that will be a big headache for security teams.One studyof more than 100 large language models (LLMs) across Java, Python, C#, and JavaScript found that 45% of the code samples failed security tests and introduced vulnerabilities on the OWASP Top 10.That’s not just a quality problem, Leonardo d