Sign in Subscribe

ThreatGrid Team

Offensive AI: How Cybercriminals Are Weaponizing Machine Learning

Offensive AI: How Cybercriminals Are Weaponizing Machine Learning

While defenders are using AI to protect networks, cybercriminals are quickly adapting—and sometimes out-innovating security teams. Offensive AI is no longer a concept discussed only at academic conferences; it’s actively being deployed in the wild. Emerging offensive AI tactics in 2025 include: * Deepfake phishing campaigns — Attackers generate ultra-realistic

AI-Powered SOCs: How Automation Is Transforming Threat Detection in 2025

AI-Powered SOCs: How Automation Is Transforming Threat Detection in 2025

In 2025, the traditional Security Operations Center (SOC) is evolving faster than ever. The rise of AI-powered SOCs is changing how security teams detect, investigate, and respond to cyber threats. With global attack volumes increasing and skilled cybersecurity talent still in short supply, automation is no longer just an optimization—

DEF CON's $4M AI Cyber Challenge: What We Learned from the Winners

DEF CON's $4M AI Cyber Challenge: What We Learned from the Winners

At DEF CON 33, DARPA’s AI Cyber Challenge showcased autonomous systems finding and patching vulnerabilities faster and more accurately than ever. With top teams like Team Atlanta and Trail of Bits now open-sourcing their tools, AI is now a fundamental ally in critical infrastructure cybersecurity.

Microsoft Exchange Hybrid Privilege Escalation: CVE-2025-53786

Microsoft Exchange Hybrid Privilege Escalation: CVE-2025-53786

A critical elevation-of-privilege flaw in Exchange hybrid configurations (CVE-2025-53786) allows on-prem administrators to escalate into the cloud. With CISA mandating immediate action, organizations must apply Microsoft's guidance now to avoid domain-wide compromise.

Critical CVEs in Focus: What You Need to Patch Now

Critical CVEs in Focus: What You Need to Patch Now

This post highlights four high-severity CVEs—Trend Micro Apex One, Android GPU drivers, Apple WebKit, and Gigabyte firmware—and explains how to safeguard your systems now.

Gigabyte UEFI Firmware Flaws Open Door to Stealthy Bootkits (CVE-2025-7026 / 7027 / 7028 / 7029)

Gigabyte UEFI Firmware Flaws Open Door to Stealthy Bootkits (CVE-2025-7026 / 7027 / 7028 / 7029)

Four critical firmware vulnerabilities in Gigabyte motherboards can bypass Secure Boot and enable stealthy bootkits. Admin privileges alone—not OS-level access—could grant adversaries persistent control. Users must update BIOS immediately or consider hardware replacement for unsupported models.

Apple WebKit Zero-Day Under Active Exploitation (CVE-2025-6558)

Apple WebKit Zero-Day Under Active Exploitation (CVE-2025-6558)

A critical zero-day, CVE-2025-6558, is being exploited across both Chromium and WebKit engines. It allows sandbox escape through malformed HTML targeting GPU rendering components. Browser and OS updates are urgent and vital to maintain security posture.