TrendAI™ is deepening its focus on the CISA KEV Catalog as a proven signal of active risk. With AI, TrendAI™ combines TrendAI™ ZDI research, exploit intelligence, exposure context, and business risk to drive continuous, AI-assisted prioritization, helping security teams make better decisions and act faster.
TrendAI™ Research uncovered an open redirect in Dify's post-login flow that could have handed a freshly authenticated session, token and all, to an attacker, and worked with the vendor to close it across every sign-in path before the details went public.
The Singapore Police Force (SPF), working closely with Pakistan's National Cyber Crime Investigation Agency (NCCIA) and INTERPOL has arrested two individuals linked to Tycoon2FA, a phishing operation that served criminal customers across four continents.
Disruption reported across at least seven states, from equipment left accessible online. The issue is largely a matter of configuration and access control, and here's what to fix first.
TrendAI™ is deepening its focus on the CISA KEV Catalog as a proven signal of active risk. With AI, TrendAI™ combines TrendAI™ ZDI research, exploit intelligence, exposure context, and business risk to drive continuous, AI-assisted prioritization, helping security teams make better decisions and act faster.
TrendAI™ Research uncovered an open redirect in Dify's post-login flow that could have handed a freshly authenticated session, token and all, to an attacker, and worked with the vendor to close it across every sign-in path before the details went public.
The Singapore Police Force (SPF), working closely with Pakistan's National Cyber Crime Investigation Agency (NCCIA) and INTERPOL has arrested two individuals linked to Tycoon2FA, a phishing operation that served criminal customers across four continents.
Disruption reported across at least seven states, from equipment left accessible online. The issue is largely a matter of configuration and access control, and here's what to fix first.
TrendAI se junta à Nvidia como parceiro inaugural na Open Secure AI Alliance, avançando em modelos abertos, ferramentas e pesquisas para fortalecer a defesa cibernética.
Os próprios modelos da OpenAI saíram de um ambiente de teste e invadiram os servidores da Hugging Face para resolver uma avaliação, sem a participação de um atacante humano. O incidente mostrou que manter a segurança da IA agente agora depende de como ela é contida, não apenas de como é treinada.
Um ataque à cadeia de suprimentos atingiu a Axios quando invasores usaram credenciais npm roubadas para publicar versões maliciosas contendo uma dependência fantasma. Isso acionou um RAT multiplataforma durante a instalação e substituiu seus arquivos por iscas limpas, tornando a detecção desafiadora.
PeckBirdy é um sofisticado framework de C&C baseado em JScript usado por grupos APT alinhados à China para explorar LOLBins em vários ambientes, entregando backdoors avançados para atingir indústrias de jogos de apostas e entidades governamentais asiáticas.
CVE-2025-55182 é um RCE de pré-autenticação com CVSS 10.0 que afeta os Componentes de Servidor React. Em meio à enxurrada de explorações de prova de conceito falsas, scanners, explorações e equívocos generalizados, esta análise técnica pretende cortar o ruído.
A tokenizer lies at the core of every large language model. When it drifts, whether from unseen flaws or adversarial interference, costs rise and performance drops. We explore this emerging risk, its implications, and the measures to prevent it.
August 6th, 2026 
5 min read
