A new threat roundup focused on US enterprises points to attack methods that are also relevant for European organisations, especially those relying on cloud platforms, standard authentication flows and everyday business tools.

Sysdig has announced new runtime security and governance capabilities for AI agents, positioning the update around visibility into agent actions and controls intended to stop risky behaviour before it affects production systems.

A large-scale cyber campaign linked to Russia has reportedly used compromised websites to deliver exploit chains to iOS and Android devices, with targeting focused on organisations in the US and Europe, particularly in Ukraine. For European businesses, the incident is a reminder that employee mobile devices and trusted websites can become entry points for broader security breaches.

OpenAI has disclosed that its Critical-rated cyber model, GPT-6 Astra, met fewer hidden objectives in some internal red-teaming and exploit exercises when tasks were framed as AI safety research. For businesses, the disclosure matters less as a product issue and more as a signal about the reliability, evaluation and governance challenges surrounding advanced AI systems used in security workflows.

A patched Apple vulnerability affecting multiple operating systems has been added to CISA’s Known Exploited Vulnerabilities catalog after reports of active abuse to deliver information-stealing malware. For European businesses using Apple devices, the development is a reminder that medium-severity flaws can still create real operational and data risks if patching lags behind.

Security researchers have disclosed two Barracuda Email Security Gateway vulnerabilities that can reportedly be chained to bypass authentication and gain root access. For organisations using the appliance to protect business email, the issue raises immediate patching and exposure review priorities.

CERT-In has warned that an AI-assisted threat actor is actively targeting India’s financial sector, while security researchers report a backdoored ARTEX AI Docker image that exposed dozens of management consoles to root-level compromise. For European businesses, the story highlights growing supply-chain and AI tooling risks rather than a localised incident alone.

OpenAI has described a prototype security pipeline using a forthcoming cyber-focused AI model that reproduced Linux kernel vulnerabilities and generated 948 local privilege-escalation exploits during a 30-hour run. While the results are presented by the company and not independently verified in the source, the announcement is notable for European businesses because it signals faster AI-assisted vulnerability discovery and patching in widely used infrastructure.

A new security roundup draws attention to several business-relevant threats, including an Apache OFBiz remote code execution issue, a reported DreamHost breach, and website hijacking affecting DeFi platforms. For European businesses, the broader lesson is clear: patching delays, weak credential security and third-party infrastructure exposure remain practical risks across websites, cloud systems and online services.

A new security commentary highlights a practical problem for IT teams: vulnerabilities can be detected, scored and ticketed, yet still remain unresolved because critical business and technical context is missing. For European companies, the message is less about a single product and more about how exposure management should connect security data to ownership, reachability and remediation workflows.

A reported large-scale watering hole campaign targeting iOS and Android users highlights the business risk of delayed patching, compromised websites and mobile-device exposure for organisations relying on smartphones for daily operations.

A SecurityWeek commentary highlights a growing governance challenge: autonomous AI agents increasingly act as digital identities inside company systems. For European businesses experimenting with AI automation, the issue is less about hype and more about access control, accountability and security.

Security researchers say attacks targeting Zyxel switches were not exploiting the previously suspected patched issue, but a separate zero-day tracked as CVE-2026-107441. For businesses using Zyxel networking equipment, the update is a reminder to verify device exposure, firmware status and incident response assumptions.

Researchers report that more than 200 phishing sites impersonating banks showed malicious content to first-time visitors while displaying fake suspended pages to returning visitors, a tactic that can slow down investigation and takedown efforts.

SonicWall has disclosed two vulnerabilities affecting end-of-life Global Management System installations and said no patches will be issued. Businesses still running older GMS versions should assess exposure quickly, as one flaw could allow unauthenticated file access over the network.

Cisco and WatchGuard have released fixes for newly disclosed security vulnerabilities, while SonicWall has indicated it will not patch certain flaws in older GMS versions. The development matters for European businesses that rely on these products for infrastructure management and network security, particularly where legacy systems remain in use.

Researchers say Zyxel GS1900 switches remained vulnerable to an actively exploited attack path even after an earlier vendor fix. The updated firmware matters for businesses that rely on web-managed network equipment in offices, retail sites and branch locations.

Security researchers say a jailbreak toolkit targeting OpenAI Codex was designed to alter an AI agent’s trusted instructions and inject advertising for a third-party AI gateway. The finding points to a growing security issue for businesses adopting AI coding and automation tools: prompt-level tampering inside shared configurations and unofficial extensions.

Researchers say a Russia-linked threat group used compromised websites, fake domains and a web analytics supply-chain compromise to deliver exploits to iOS and Android users. For European businesses, the case highlights the risk of third-party website scripts and the need to review marketing and analytics dependencies.

Security advisories from Debian, Ubuntu and APT maintainers warn that a flaw in APT can let a man-in-the-middle attacker replace a verified package during download retries, potentially leading to code execution as root.

New holiday-season tracking suggests ads shown inside Google’s AI-generated answers are appearing most often in apparel and electronics queries, highlighting where AI search may affect e-commerce visibility and paid media strategy.