Agentic AI, or AI systems that can act autonomously on behalf of users, is emerging as security's next major vulnerability because it operates with limited oversight while having significant access to sensitive systems and data. These AI agents can make decisions and take actions without explicit human approval in each instance, creating a new attack surface that organizations aren't adequately prepared to defend. Security teams need to develop new frameworks to monitor and control these autonomous systems before they become the next preferred entry point for cyber attackers.

A malicious worm dubbed "Mini Shai-Hulud" has successfully compromised multiple high-profile software packages including TanStack, Mistral AI, and Guardrails AI. The attack appears to target the software supply chain by infiltrating these widely-used developer tools and packages, potentially affecting numerous downstream applications and users who depend on these libraries.

A new webinar from Radiant Security addresses a critical problem in security operations centers: why the riskiest alerts often go unanswered. The presentation will explore how security teams can better prioritize and respond to high-risk threats that might otherwise slip through the cracks due to alert fatigue or resource constraints.

Cybersecurity researchers have discovered a new variant of the TrickMo Android malware that uses The Open Network as a command and control system and leverages SOCKS5 proxies to turn infected devices into network pivots. This advanced capability allows attackers to route malicious traffic through compromised Android phones, effectively using them as stepping stones to breach corporate networks and evade detection. The discovery highlights the growing sophistication of mobile malware in enabling broader network attacks beyond just stealing data from individual devices.

Dark Reading, celebrating its 20th anniversary, has profiled 20 influential figures who shaped the modern cybersecurity landscape and the chief information security officer role. The list includes pioneers like Steve Katz who formalized the CISO position at Citicorp, security researchers like Dan Kaminsky and Troy Hunt, and controversial figures including Edward Snowden and convicted cybercriminal Albert Gonzalez, whose massive retail payment card breaches marked a turning point in how law enforcement treated cybercrime as organized business. The retrospective highlights how cybersecurity evolved from technical defense into a board-level concern encompassing business resilience, compliance, and corporate trust.

German police have successfully shut down the second iteration of the Crimenetwork dark web marketplace just days after it was resurrected following an initial takedown in December 2024. The original marketplace, which operated for over 12 years with more than 100,000 users, facilitated the trade of stolen data, drugs, and falsified documents using cryptocurrency, generating an estimated 3.6 million euros in revenue. Authorities arrested a 35-year-old German suspect in Spain believed to be the marketplace's administrator and seized nearly 200,000 euros in assets along with extensive user and transaction data for further investigation.

A new Linux vulnerability called Dirty Frag, which chains two flaws to allow unprivileged users to gain root access, may already be exploited in the wild according to Microsoft. The vulnerability was prematurely disclosed before patches were ready, affecting major Linux distributions and the IPsec and RxRPC kernel components with a notably high success rate since it doesn't require timing-based race conditions. Major Linux vendors including Red Hat, Ubuntu, and Amazon Linux are now rolling out patches after Microsoft detected limited in-the-wild activity potentially indicating exploitation.

Canvas, a widely-used online learning platform serving tens of thousands of schools globally, was knocked offline by a cyberattack just as students were preparing for final exams. A hacking group called ShinyHunters claimed responsibility, saying they accessed nearly 9,000 schools' data including billions of private messages, and demanded individual schools negotiate settlements directly. The platform operator Instructure has since restored service to most users after discovering the hackers exploited a vulnerability in free teacher accounts, though the company hasn't disclosed whether any ransom was paid or the full extent of data compromised.

Cybersecurity firm Checkmarx has warned that a malicious version of its Jenkins AST plugin was published to the Jenkins Marketplace as part of an ongoing supply chain attack. The incident stems from a security breach that began in March when the TeamPCP hacker gang accessed Checkmarx's repositories through a separate Trivy supply chain attack, later followed by data exposure from the Lapsus dollar extortion group. Checkmarx has since released an updated, clean version of the plugin and is urging users to ensure they're running the latest secure iteration available on both GitHub and the Jenkins Marketplace.

Identity management provider SailPoint has disclosed that hackers gained unauthorized access to some of its GitHub repositories on April 20th through a vulnerability in a third-party application. The company says it quickly contained the breach and found no evidence that customer data in production or staging environments was compromised, though it did notify customers whose information was stored in the affected repositories. SailPoint has not identified the threat actors behind the attack or confirmed whether it's connected to the recent wave of supply chain attacks attributed to the TeamPCP hacking group.