Google puts new limits on AI agents that hunt threats and fix vulnerabilities
Google Cloud is adding new controls to CodeMender, its AI tool for finding and fixing software vulnerabilities, allowing businesses to isolate attack simulations and target …
Stolen AI access leaves companies with cloud bills of up to $1 million
Criminals who break into corporate cloud accounts are using the stolen access to run AI models at the victim’s expense, in some cases racking up more than $100,000 in charges …
Google disrupts XCPE botnet, bans the company behind it
Google shut down the servers behind XCPE, a backdoor hidden in the firmware of Android TV set-top boxes. Google’s Threat Intelligence Group attributes the operation with high …
Google says Gemini 4 Carbon beats its predecessors at finding and fixing security flaws
Google’s Gemini 4 Carbon is a frontier AI model designed for software engineering and cybersecurity tasks, with safeguards built on those of its predecessor, Argon. SEC-bench …
Brotli bug reaches far beyond Node.js (CVE-2026-111497)
A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known as …
Google open-sources the Elephant-Goldfish Model plugin its engineers use to catch AI coding mistakes
Google has open-sourced the Elephant-Goldfish Model plugin, an internal tool that makes an AI coding agent write and defend a design document before it touches any code. The …
Google opens its cloud to rival OpenAI, promises business data won’t train models
Google Cloud is adding OpenAI models to its platform, initially through a private preview for selected business customers. The launch includes GPT-6 Astra, GPT-6.1 Sol and …
Chrome puts insecure sites behind a permission prompt
Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, …
eMudhra security blunder left trusted CA signing keys exposed to anyone
Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public …
Chrome flags malicious commands that scammers pass off as fixes
Google is updating Chrome’s Enhanced Protection mode to detect scam websites and warn users when a page tricks them into copying a malicious command. The company introduced …
Android adds AI-powered scam alerts, hangs up on bank impostors
Google’s new scam protections cover Google Messages and third-party messaging apps, with an enhanced protection mode, expanded scam alerts and safeguards against …
Google quadruples Chrome bug bounty base pay, offers up to $20,000 for sandbox escapes
Google is updating its Chrome Vulnerability Rewards Program (Chrome VRP), increasing payments for memory corruption vulnerabilities and expanding rewards for other security …
Featured news
Resources
Don't miss
- Vercel ties login sessions to devices, rolls out AI security reviews in public beta
- Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441)
- A banking malware sample led researchers to an Android bug that can loop-crash phones
- AI agent detection signals that still work when agents look human
- Live Q&A: CISSP exam prep with ISC2 experts