Cybersecurity | ICE News

AI & computing11 Oct, 2:50 pm · 5 min read

New Spectre variant BTR targets JIT compilers on Intel, AMD and Arm

Researchers showed that reused JIT code memory lets stale branch predictions leak data, with a working exploit against the Linux kernel's cBPF.

For you: This is a direct link between two courses that students often see as separate: computer architecture, where branch prediction is taught, and operating systems or compilers, where JIT code caches live. Spectre-class bugs show that hardware optimisations can leak secrets, and that fixes often land in software rather than silicon. For BEI and BCT students interested in research, the paper and published code are a good case study of how a hardware security result is found, reported and patched.

Read the storyBCTBEI

AI & computing11 Oct, 2:32 pm · 6 min read

Flaw in official MCP Python SDK could leak OAuth credentials

A high-severity bug let a malicious MCP server redirect an AI agent's OAuth secrets to the attacker. Versions 1.30.0 and 2.2.0 fix it.

For you: Students building AI agents for projects often connect them to third-party MCP servers found online, and this bug shows why that is risky. The fix is about a basic rule of authentication: always confirm who issued a token and where credentials are going. That idea appears in web security and distributed systems courses, and here it is in a library used by thousands of developers. If you have an agent project using the Python mcp package, check your version and pin the expected issuer.

Read the storyBCT

AI & computing11 Oct, 2:26 pm · 5 min read

Two Citrix NetScaler zero-days exploited before a patch existed

Citrix and CISA warned on 27 September that two critical NetScaler flaws allowing remote code execution were already under attack worldwide.

For you: Appliances like NetScaler sit at the edge of bank, telecom and government networks, including in Nepal, and they provide remote access for staff. When the edge device is compromised, everything behind it is exposed. The advice to collect evidence before patching is a useful lesson in incident response, a skill that security operations centres hire for. Students in networking and security courses can read the CISA alert as a real example of how a vulnerability is triaged, from disclosure to detection rules.

Read the storyBCTBEI

AI & computing11 Oct, 2:20 pm · 6 min read

Ransomware at a Nepali data centre halts share trading for a day

A ransomware attack on Data Hub, which hosts systems for 72 of Nepal's 90 stockbrokers, forced NEPSE to suspend trading on 21 September.

For you: This is a Nepali case study for every networking, operating-systems and security course: one shared data centre became a single point of failure for most of the stock market. Recovery worked because a recent backup was kept separately and a second site existed in another city, which is exactly what disaster-recovery planning teaches. Nepal's banks, wallets and brokers need engineers who can design backups, segment networks and run incident response, and this attack makes that demand visible.

Read the storyBCTBEI

AI & computing11 Oct, 1:25 pm · 5 min read

Attacker used AI agents to break into 395 organisations via PaperCut

GreyNoise traced a campaign in which AI coding agents exploited two PaperCut print-server flaws, hitting at least 440 servers in 48 countries within days.

For you: Colleges are attractive targets because they run print servers, student portals and shared Windows domains, often with thin IT staff. This case shows that the gap between a patch being released and mass attack is now measured in days. For students, that makes patch management, network segmentation and log monitoring practical job skills, not just exam topics. It is also a warning about agent design: these agents ignored their own operator's rules, which is a lesson for anyone building AI agents.

Read the storyBCTBEI

AI & computing11 Oct, 1:13 pm · 5 min read

Microsoft fixes 960-plus flaws in its largest Patch Tuesday yet

Trackers counted 964 to 974 fixes in September, Microsoft's largest batch yet, with two Windows zero-days already being exploited.

For you: If AI tools let vendors find hundreds of extra bugs a month, administrators have to test and deploy far more patches, and that work falls on IT teams in Nepali banks, colleges and offices. Knowing how to prioritise patches, using severity scores and exploitation status, is a practical system-administration skill. The two zero-days are privilege-escalation bugs, a reminder from operating-systems courses that memory-safety errors such as buffer overflows remain a common way into Windows.

Read the storyBCT