Researchers Using AI Uncovers Powerful Chrome Security Flaws in Just Six Days
Researchers at cybersecurity firm XBOW used AI agents powered by OpenAI’s GPT-5.6 Sol model to discover and combine three previously unknown Google Chrome security flaws into one powerful attack. Built in just six days, the attack could let hackers run programs on a Windows computer simply by getting someone to open a web page—without requiring a click on a link or a file download. Google confirmed the flaws and awarded XBOW its largest possible single reward of $250,000.
The attack worked by breaking through Chrome’s multiple layers of protection, which are designed to keep potentially dangerous web pages isolated from the rest of a computer. The AI agents helped search Chrome’s code, test potential weaknesses, and develop the attack, while human researchers guided the process and checked the results. Although the final attack took six days and about $40,000 in AI costs, XBOW said its first attempt at a similar attack had taken two months, highlighting how dramatically AI can speed up security research.
All three flaws have since been fixed, and XBOW reported no evidence that they were used to attack Chrome users. Because Chrome’s updates only fully take effect after restarting the browser, users should relaunch Chrome and check that they are running version 152.0.7977.82 or later. The discovery also raises a broader concern: AI is making sophisticated cyberattacks faster and potentially cheaper to develop, giving security teams less time to find and fix weaknesses before attackers can exploit them.
Microsoft Reports Record 1,413 Security Vulnerabilities in Latest Update
Microsoft’s latest security update revealed a record-breaking 1,413 software vulnerabilities across its products, surpassing its previous annual record of 1,261. Most of the flaws affected Windows, with others found in Office, developer tools, and SharePoint. Experts say artificial intelligence is helping security researchers discover weaknesses faster, contributing to the growing number of reported vulnerabilities.
Despite the record total, only one of the newly disclosed flaws was confirmed to be actively exploited by attackers. The vulnerability affects Windows Shell, a part of Windows that helps users interact with the operating system and could allow attackers to bypass security protection. Microsoft has introduced a new system to help customers prioritize which vulnerabilities to address first. Security experts recommend focusing on flaws known to be exploited or posing the greatest risk rather than treating every vulnerability as equally urgent.
Cisco Warns of Actively Exploited Critical Email Gateway Vulnerability
Cisco has warned that hackers are actively exploiting a critical security flaw in its Secure Email Gateway, a product organizations use to filter spam, malware, and other email threats. The vulnerability allows an attacker to send a specially crafted email attachment that could let them take control of the device with the highest level of system access. The flaw affects only gateways with specific security settings enabled and an outdated scanning tool. Cisco has not disclosed how many devices have been attacked or confirmed whether attackers successfully gained full control.
Cisco has already released fixes, including a scanning-tool update that can be installed without restarting the device. Administrators should check whether their systems are affected and ensure the Content Scanner Tools version is 25.3.0.5525 or later or install a fixed software release. Cisco also provides a command to check for signs of attempted attacks, although a clean result does not guarantee that a device is safe. Organizations should review their network logs for suspicious activity as well.
If a gateway shows signs of compromise, Cisco recommends contacting its technical support team and following specific recovery steps. For affected virtual appliances, this includes rebuilding the system, changing credentials, and preserving evidence before making changes. The discovery is particularly concerning because it is the second Secure Email Gateway vulnerability Cisco has confirmed being exploited in about a month, highlighting the importance of promptly applying security updates and investigating suspicious activity.
Defensible Strategies
Learn from those who have been attacked
Nearly Half of Organizations Report Unexpected or Unauthorized AI Agent Actions
A new report from cybersecurity firm Salt Security found that nearly half of surveyed organizations had confirmed or suspected that an AI agent took an unintended or unauthorized action in the past year. These actions included making unauthorized transactions and changing or deleting data. As businesses increasingly rely on AI agents to perform tasks and interact with other systems, many are struggling to monitor their activity and prevent mistakes or misuse.
The report highlights major gaps in security and oversight. Although most organizations are already using AI agents, only a small percentage can consistently track everything an agent does, and fewer than one in five can automatically stop an agent behaving unexpectedly. Organizations are also facing risks from unauthorized or improperly configured AI connections and security flaws in AI-generated code, which can go undetected until later testing or deployment.
A separate investigation by Salt Security demonstrated how a malicious email could exploit an AI platform to potentially access connected accounts and run harmful code, even though the platform detected suspicious activity. The vulnerability has since been fixed, but the incident highlights why simply detecting threats is not enough. The report recommends that organizations improve monitoring, strengthen controls over what AI agents can access and do, and introduce automated safeguards that can stop harmful actions before they cause damage.
Fake WatchGuard VPN Site Steals Credentials Using Legitimate Software Downloads
Cybersecurity researchers at Huntress uncovered a scam website impersonating WatchGuard’s official VPN software download page. The attackers used misleading search results to direct users to the fake site, where visitors were asked to enter their VPN server address, username, and password. The website deliberately rejected the first submission, encouraging victims to enter their details a second time, giving attackers another opportunity to capture accurate login information.
To avoid raising security alarms, the fake website then provided the genuine, digitally signed WatchGuard installer, making the download appear completely legitimate and harder for security tools to detect. The fraudulent website was offline as of October 13, when Huntress reported its findings. Organizations should reset any passwords entered on the fake site, enable multi-factor authentication (MFA) for VPN access, monitor for suspicious logins, and download software only from official, trusted websites.
Microsoft-Led Coalition Disrupts Three Major Global Phishing Networks
Microsoft and an international coalition of cybersecurity organizations have disrupted three major phishing toolkits known as CoGUI, Haozi, and Iron Man System. These tools help cybercriminals create fake websites and messages that imitate trusted companies to steal passwords and financial information. Since January 2026, the groups behind these services have reportedly enabled more than one billion fraudulent emails and text messages targeting over 75,000 organizations in more than 150 countries.
The investigation uncovered a wider criminal network that sells phishing tools, stolen accounts, and access to compromised Microsoft and Google cloud services. Criminals use these resources to impersonate banks, government agencies, delivery companies, and popular brands, tricking victims into sharing sensitive information. The toolkits also use sophisticated methods to avoid detection, including fake security checks and alerts that notify criminals when someone interacts with a fraudulent website.
The disruption makes it harder for cybercriminals to obtain the tools and online infrastructure needed to carry out large-scale scams, although it does not guarantee that all related activity has stopped. The operation highlights how phishing has become a coordinated criminal business rather than a series of isolated scams. Individuals and organizations should remain cautious of unexpected messages, verify website addresses before entering personal information, and use multi-factor authentication to help protect their accounts.