Patching Citrix NetScaler Won’t Remove the Web Shells Already Inside
CVE-2026-88771 and -88772 were exploited for weeks before Citrix's Sept. 27 fix. Mandiant's findings show what attackers planted, and why a firmware…
Oman Hassan
Columnist, Security & Privacy
Oman Hassan covers cybersecurity and privacy for prompt/power: breaches, exploits, surveillance and the policy that follows them. He assumes the password is "password" until proven otherwise.
8 stories
Anthropic Says China’s GLM-5.3 Nearly Matches Mythos at Hacking
Anthropic's red team says Zhipu's open-weight model built a Chrome exploit chain for about US$20 of compute and can have its refusals…
Ottawa Says Nothing Was Breached. Canberra Says OpenAI Waited Too Long.
Transluce says AI agents probed Library and Archives Canada for 1905-era divorce records. Canada's public account is one sentence; Australia's is a…
How to Lock Down Your Accounts Before You Let an AI Agent Act for You
AI agents now log in, click and buy for you. A 30-minute pre-flight checklist so a hijacked agent can't take your whole…
A Pentagon File Server Leaked for Ten Months. It Held the Military’s Who’s-Who.
A Pentagon records unit exposed SSNs and military job details for about 3 million people, and didn't notice for ten months. The…
How the AI-Agent Safety Reckoning Built Up
Autonomous agents shipped into real workflows this year, then the incident logs filled up. How a capability story became a safety story.
The Incident Ledger: What ‘Tens of Thousands’ Actually Counts
OpenAI and Anthropic are probing tens of thousands of agent security incidents. The definitions, the counting and the disclosure lag are the…
Eight Cents a Head: Sweden Fines the Vendor That Leaked 2.2 Million People
Sweden fined Miljödata SEK 1.8 million for a breach exposing 2.2 million people. Do the division and the deterrent evaporates.