SquareX Shows AI Browsers Fall Prey to OAuth Attacks, Malware Downloads and Malicious Link Distribution

As AI Browsers rapidly gain adoption across enterprises, SquareX has released critical security research exposing major vulnerabilities that could allow attackers to exploit AI Browsers to exfiltrate sensitive data, distribute malware and gain unauthorized access to enterprise SaaS apps. The timing of this disclosure is particularly significant as major companies including OpenAI, Microsoft, Google and The Browser Company have announced or released their own AI browsers. With Chrome and Edge alone representing 70% of the browser market share, it is very likely that the majority of consumer browsers in the future will be AI Browsers.

Lightship Security and the OpenSSL Corporation Submit OpenSSL 3.5.4 for FIPS 140-3 Validation

Lightship Security, an Applus+ Laboratories company and accredited cryptographic security test laboratory, and the OpenSSL Corporation, the co-maintainer of the OpenSSL Library, announce the submission of OpenSSL version 3.5.4 to the Cryptographic Module Validation Program (CMVP) for FIPS 140-3 validation. This submission confirms that the code is complete and that all included algorithms have successfully passed NIST testing and independent laboratory review. The final CMVP review and certificate issuance remain as the last step in the process.

We need to redefine "critical infrastructure" #cybersecurity #ransomware #criticalinfrastructure

When a city gets hit with ransomware, residents can't pay utility bills, access emergency services, or even get married. When the water treatment plant goes down, the hospital can't operate, no matter how well you've secured it. We've been asking the wrong question. Instead of "does this technically qualify as critical infrastructure?" we should be asking "who needs help?" Small organizations like schools, nonprofits, water systems, and local governments face the same cybersecurity challenges but lack the resources to defend themselves.

How to Prevent Cross-Site Scripting (XSS) on Payment Pages

Many teams believe that cross-site scripting, or XSS, is a problem of the past. Modern frameworks promise built-in protections, and developers often assume the browser will handle the rest. The reasoning sounds logical: if React auto-encodes output, XSS can’t happen. However, XSS prevention doesn’t work on assumptions; it works on visibility. We’ve learned that XSS prevention is about maintaining continuous control over the browser environment where your application runs.

Penetration Testing for Financial Services: Meeting Compliance and Security Benchmarks

The financial sector has always been a prime target for attackers, but the scale and sophistication of threats have grown exponentially. In just the first half of 2025, over 742 million attacks were recorded across more than 600 global banking and financial services (BFS) sites, averaging 1.2 million attacks per site, a 51% increase compared to the same period in 2024.

Identity automation in the age of agentic AI with Matthew Chiodi

Defender Fridays - Identity Automation in the Age of Agentic AI with Matthew Chiodi Join us for this session of Defender Fridays as we explore identity automation in the age of agentic AI with Matthew Chiodi, Chief Strategy Officer at Cerby. At Defender Fridays, we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.