Cyber News

Severity scores alone don’t tell security teams how urgently, or how deeply, to respond. This week’s LoadMaster, Metabase, and TP-Link vulnerabilities show why smart response design matters as much as the risk score itself.

Patching isn’t always the right first move. Four disclosures this week, from an unpatched flaw to a bug buried in AI pipelines, show how security leaders decide between remediating, isolating, or temporarily accepting risk.

A medium-severity WordPress bug and a critical REST API flaw look unrelated on a severity chart, but CISA flagged both after attackers chained them into one critical attack path, proof that exploitability matters more than the score.

Cisco’s advisory said there was no evidence of active exploitation of its Unified Communications Manager flaw. That single line is doing more work deciding patch urgency than most security teams realize, and it isn’t the whole story.

AI has made finding vulnerabilities faster than ever, but this week’s security news shows the real bottleneck has moved downstream, to validating, prioritizing, and actually fixing the flaws that matter.

Researchers say the JadePuffer campaign is the first fully documented ransomware attack run start to finish by an AI agent, with no human at the keyboard, after breaking in through an old, unpatched Langflow flaw.

The invitation emails are genuinely sent from OpenAI’s own servers. Researchers found attackers creating fraudulent OpenAI tenants to lure employees at cybersecurity and tech firms into feeding sensitive data straight into an attacker-controlled workspace.

A breach at a third-party vendor exposed driver’s license numbers, passport numbers, and contact details for over 3 million Texas hunting and fishing license holders, exactly the data attackers need to run convincing phishing campaigns.

A malicious ad for “chatgpt” leads not to a fake site but to a real chatgpt.com share link, one that every URL reputation checker trusts. Researchers detail how the LLMShare campaign hides malware delivery behind ChatGPT and Claude’s own domains.

Instructure, the company behind the Canvas learning management system, paid the ransomware group ShinyHunters after a second breach exposed 3.6 terabytes of data and defaced login pages across its platform.