All news with #google tag

🛡️ We discovered a vulnerability in the Google Cloud Vertex AI Python SDK that allowed an attacker to hijack a model upload and poison it, enabling remote code execution (RCE) in a victim's serving infrastructure. The issue stems from a predictable default staging bucket name and a missing ownership check in the SDK. By creating the same deterministic bucket in their own project and granting broad permissions, an attacker could replace uploaded model artifacts within a short window before Vertex AI reads them. Google fixed the issue in google-cloud-aiplatform v1.148.0 released April 15, 2026; developers should upgrade to the patched SDK.

🔍 At Google Cloud, collaboration with customers guided a technical sprint in January 2026 with a major telecommunications partner to refine Model Armor, the runtime security service for generative AI. By embedding with the customer's developers and security teams, the Google Cloud Developer Advocacy group observed real-world workflows and identified friction points such as search-first documentation needs, tuning confidence levels to avoid false positives, clearer enforcement guidance, and IAM-related 403 errors during integrations. The team translated these findings into tested code samples, a confidence level matrix, explicit integration guides for Apigee, Gemini Enterprise Agent Platform, and GKE, and deeper technical documentation to improve operational utility and reduce deployment friction.

🤖 Google announces expanded Agentic Data Cloud capabilities, introducing new data agents and tools to enable conversational analytics and agent-driven workflows across BigQuery, Lakehouse, AlloyDB, Spanner, and Cloud SQL. The update includes Data Engineering, Data Science, Database Observability, Looker Dashboard, Data Insights, and Deep Research agents, plus developer toolkits like the Data Agent Kit and Managed MCP servers. These features aim to ground agents in real-time enterprise data with unified governance and near-100% accuracy for tasks such as NL-to-SQL conversions and automated pipeline maintenance.

⚠️ Google issued fixes for 74 Chrome flaws, including an actively exploited V8 out-of-bounds memory access (CVE-2026-11645). This week's recap highlights exploited enterprise bugs like Oracle PeopleSoft and Check Point VPN, large-scale supply-chain and package abuse in Arch's AUR, and the takedown of a major phishing-as-a-service operation. Practical guidance and trending CVEs round out the update.

🔎 The FBI, collaborating with Google and Black Lotus Labs, dismantled a China-linked phishing-as-a-service operation called Outsider Enterprise that used AI and distributed phishing kits across thousands of fraudulent websites and over a million URLs. Authorities seized administrative servers, a Shopify storefront, testing accounts, and roughly $100,000 in USDT, while redirecting many malicious domains to an FBI splash page. Google reports hundreds of thousands of affected users and has filed a civil suit against the infrastructure while coordinating with carriers to block fraudulent SMS campaigns.

🛡️ Google is taking legal, technical, and legislative steps to disrupt large-scale AI-enabled phishing and smishing campaigns. The company filed a civil lawsuit against the China-based “Outsider Enterprise,” coordinated with the FBI and telecom partners to block malicious texts, and is advocating bipartisan federal legislation to strengthen protections. Google also leverages AI-driven detection on Android and messaging defenses to intercept malicious messages at scale.

🔍 Looker introduces dashboard agents in preview to enable conversational, in-dashboard exploration of BI data. The agent leverages the dashboard’s filters, cross-filters, and curated tiles to provide context-aware answers and can access underlying Explores for additional detail. Analysts can configure the agent with natural-language instructions to align responses with business logic, and the system surfaces intermediate reasoning, cited tiles, and applied filters to build user trust. Admins enable the feature in Looker 26.08.11+ via the Gemini settings.

🚀 AWS announces availability of the Gemma 4 family from Google DeepMind on Amazon Bedrock. The offering includes three variants—Gemma 4 31B, Gemma 4 26B-A4B, and Gemma 4 E2B—covering dense and MoE architectures with multimodal and multilingual support. Models run on new Bedrock optimizations for tool calling, structured output, reasoning, and streaming, and are initially available in several AWS Regions.

🔒 CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation. The flaws include an authenticated command injection in Cisco Catalyst SD-WAN Manager (CVE-2026-20245), a V8 out-of-bounds read/write in Google Chrome (CVE-2026-11645), and a tunnel decapsulation issue in Arista EOS (CVE-2026-7473). Agencies must remediate or mitigate these issues by June 23, 2026.

🛡️ Google details how Google Security Operations pairs with Google AI Threat Defense to detect, investigate, and contain AI-accelerated attacks across cloud and enterprise environments. The post explains three specialized agents — Detection Engineering, Triage and Investigation, and Threat Hunting — that translate threat intelligence into custom detections, autonomously investigate alerts, and proactively hunt stealthy compromises. These agents use diverse telemetry, simulated events, and AI-driven automation to reduce time-to-detection and speed remediation, addressing gaps where patching is impossible or delayed.

🛡️ Google released fixes for 74 vulnerabilities in Chrome, including an actively exploited high-severity V8 issue, CVE-2026-11645 (CVSS 8.8). The flaw is an out-of-bounds memory access in the V8 JavaScript and WebAssembly engine that could allow code execution inside a sandbox via a crafted HTML page. Researcher "303f06e3" reported the bug on April 27, 2026, and received a $55,000 bounty. Users should update Chrome to the latest 149.0.7827.102/.103 versions and apply corresponding updates for other Chromium-based browsers.

🛡️ Microsoft and Google warn that cybercriminals are repurposing familiar social-engineering tactics around AI tools and trusted cloud services, impersonating platforms like ChatGPT, Copilot, and Claude to distribute malware, steal credentials, and run investment scams. Both advisories note attackers rely on longstanding techniques—urgency, trusted-brand abuse, and redirection chains—while adapting lures to where AI is embedded in daily workflows. The trend shifts the threat surface from code to employee behavior, demanding resilience beyond blocking single phishing campaigns.

🔒 Google has released an emergency update for Chrome addressing 74 vulnerabilities, including a high-severity zero-day that has been exploited in the wild. The bulletin, published on June 8, fixes 17 critical, 55 high-severity and two medium-severity flaws, with updates rolling out to Windows, Mac and Linux users over the coming days and weeks. The exploited V8 bug, CVE-2026-11645, was reported April 27 and earned the researcher $55,000.

🔒 Google has released an emergency update to address CVE-2026-11645, the fifth Chrome zero-day fixed this year. The flaw, an out-of-bounds read/write in the V8 JavaScript engine, can be exploited by crafted HTML to achieve arbitrary code execution from within the browser sandbox. Patched Stable channel versions for Windows, macOS, and Linux are rolling out, and Google warns details may stay restricted until most users are updated.

🛡️ Google outlines recent global scam trends and mitigation efforts, highlighting sophisticated Adversary-in-the-Middle (AITM) phishing, QR-code and calendar-based scams, AI-driven cryptocurrency fraud, mobile extortion apps, and government impersonation campaigns. The advisory describes technical responses, policy enforcement, and legal actions to disrupt abuse, plus practical safety tips for users.

🛡️ Researchers at Cyera disclosed six vulnerabilities in protobuf.js, a JavaScript implementation of Google’s Protocol Buffers, that allow untrusted schema data to influence application behavior. The most severe issues enable code generation and injection via manipulated schema metadata, potentially leading to remote code execution when crafted inputs are accepted. The flaws affect protobuf.js versions up to 7.5.5 and 8.0.1 and also impact protobuf.js-cli; patches are available in updated releases.

🛡️ depthfirst's autonomous agent discovered 21 previously unknown zero-day vulnerabilities in FFmpeg, producing reproducible PoC inputs for each at a reported cost of about $1,000 for the run. In the same week, Google released Chrome 149 with fixes for a record 429 security bugs, over 100 of which are critical or high severity, following an overhaul of its bounty program to cope with a surge of AI-generated reports. The findings illustrate how AI is accelerating vulnerability discovery and increasing pressure on triage and patching processes across widely used software.

🛡️ A Magecart campaign uses Google Tag Manager and Stripe's API to host both the card‑stealing payload and exfiltrated payment data. The skimmer, delivered via legitimate‑looking GTM containers, targets Magento/Adobe Commerce checkouts and reads a specific Stripe customer record to retrieve and execute obfuscated JavaScript. Stolen card details are XOR‑obfuscated, stored locally, then uploaded into fake Stripe customer metadata, with variants using Google Firestore as an alternative backend.

🔔 A SafeBreach researcher demonstrated that a single malicious notification from apps like WhatsApp, Slack, SMS, Signal, Instagram, or Messenger could hijack Google Gemini's voice assistant on Android. The technique, called Fake Context Alignment, let notifications be treated as executable context, enabling fake replies, app launches, smart-home control, and even persistent memory poisoning. Google patched the issue server-side after being notified; Android users can disable Gemini's notification reading to mitigate exposure.

📱 Google is rolling out a new fake call detection feature for Android 12+ devices, starting with Pixel phones and enabled by default. When both parties use Phone by Google and RCS-enabled Messages, the caller's device sends a silent encrypted confirmation to the recipient; if absent, the recipient's device pings the contact's phone to verify authenticity and shows a warning if the contact denies making the call. The feature aims to counter AI voice-cloning and number-spoofing scams.