State-backed attackers are using QR codes to slip past enterprise security and help themselves to cloud logins, the FBI says North Korean government hackers are turning QR codes into credential-stealing weapons, the FBI has warned, as Pyongyang’s spies find new ways to duck enterprise security and help themselves to cloud logins.… READ MORE HERE…

Huntress analysis suggests VM escape bugs were already weaponized in the wild Chinese-linked cybercriminals were sitting on a working VMware ESXi hypervisor escape kit more than a year before the bugs it relied on were made public.… READ MORE HERE…

Image generation paywalled on X after ministers and regulators start asking awkward questions Grok has yanked its image-generation toy out of the hands of most X users after the UK government openly weighed a ban over the AI feature that “undressed” people on command.… READ MORE HERE…

Authentication is basically solved. Authorization is another thing entirely… CrowdStrike has signed a $740 million deal to buy identity security startup SGNL. The move underscores the growing threat of identity-based attacks as companies struggle to secure skyrocketing numbers of non-human identities, including AI agents.… READ MORE HERE…

Company says it dropped the ball, apologizes for wasting people’s time Logitech says an expired developer certificate is to blame after swaths of customers were left infuriated when their mice malfunctioned.… READ MORE HERE…

Prompt injection lets risky commands slip past guardrails IBM describes its coding agent thus: “Bob is your AI software development partner that understands your intent, repo, and security standards.” Unfortunately, Bob doesn’t always follow those security standards.… READ MORE HERE…