Attackers are hitting every layer of the stack. |
Today’s news brings an emergency Windows patch, an authenticator flaw risking login codes, AI observability data exposure, phishing targeting encrypted messaging, and new scam defenses rolling out across social platforms. Read past newsletters here. |
|
|
Here’s what you need to know: |
|
|
Microsoft Hotpatch Fixes Windows 11 RRAS Flaws |
Microsoft rushed out an out-of-band hotpatch to fix three critical Windows 11 vulnerabilities tied to the Routing and Remote Access Service (RRAS) management tool. Tthe flaws could allow attackers to execute code or trigger denial-of-service attacks if an admin connects to a malicious server through the RRAS interface. |
Microsoft did not report any exploitation in the wild at the time of publication.
Apply the latest patch, restrict RRAS access to authorized administrators only, and block connections to untrusted servers to reduce the risk of exploitation. |
Microsoft Authenticator Vulnerability Exposes MFA Login Codes |
A vulnerability in Microsoft Authenticator could allow malicious apps on a smartphone to intercept authentication codes intended for the widely used MFA tool.
With more than 75 million users, the flaw could allow a malicious app to intercept authentication codes via deep links on Android or iOS if a user installs the app and lets it handle the login request. A patch has been released for the issue. Update Microsoft Authenticator and restrict installation of untrusted apps that could intercept authentication links. |
LangSmith Flaw Exposes Enterprise AI Data |
Researchers discovered a LangSmith vulnerability that could allow attackers to hijack accounts and access sensitive enterprise AI workflow data.
The flaw could redirect authenticated API requests to attacker-controlled servers, enabling token theft and potentially exposing sensitive LLM trace data such as internal queries, prompts, and API responses if a logged-in user visits a malicious webpage. There are no reports of exploitation in the wild and a fix has been released for the vulnerability.
Patch LangSmith to the latest version and monitor logs for unusual API calls or unexpected access to AI trace data that could signal token misuse.
|
|
|
When an emergency patch drops, what’s your move? |
|
|
Yesterday's Pulse Check Results |
Should human review be legally required for AI facial recognition suspects? |
|
|
Security Tools You Can Use |
|
|
Russian Phishing Operation Targets Messaging Apps |
European intelligence agencies are warning of a large-scale phishing campaign tied to Russian state actors targeting users of Signal and WhatsApp.
The campaign relies on social engineering rather than software flaws, with attackers impersonating support staff or security bots to trick targets into sharing verification codes or linking malicious devices. |
The campaign is active in the wild. Regularly review linked devices in messaging apps, educate users, and never share verification codes or PINs with anyone claiming to be platform support. |
Meta Rolls Out AI Scam Alerts Across Apps |
Meta is rolling out AI-powered scam detection and warning systems across Facebook, WhatsApp, and Messenger to combat rising online fraud.
The company says it removed more than 159 million scam ads in 2025 and is expanding tools that flag suspicious friend requests, warn users about risky WhatsApp device-linking attempts, and detect scam patterns in Messenger conversations. The effort targets evolving social engineering schemes — such as fake job offers and impersonation scams — and could help reduce large-scale fraud across the company’s billions of users. Train employees and users to pause when platforms display scam warnings and verify suspicious requests before clicking links, scanning QR codes, or approving device connections. |
|
|
For years, cyber resilience was treated as a recovery problem. Backups, restores, continuity plans. Today’s security leaders know that mindset is no longer enough. Cohesity’s modern approach reflects this shift, where resilience must exist across data, environments, and decisions before, during, and after an attack. |
|
|
Where Are the Risks in Your AI Supply Chain? |
AI systems often depend on third-party models, datasets, plugins, and open-source libraries — creating a growing supply chain that attackers can target and exploit. Compromised models, poisoned training data, or malicious dependencies can quietly introduce vulnerabilities into AI-driven applications and enterprise workflows. |
How to secure your AI supply chain: |
- Only use trusted model repositories, validate signatures or checksums, maintain an SBOM, and use third-party risk management tools to evaluate the security of external AI models, libraries, and vendors.
- Protect training pipelines by validating dataset integrity and enforcing least-privilege access so only authorized users can modify models, prompts, or data.
- Use dependency scanners and AI observability tools to detect vulnerable packages, unusual model behavior, or signs of tampering.
|
Protecting the AI supply chain requires verifying trusted sources, monitoring model behavior, and controlling access to reduce the risk of compromised components or poisoned data. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
