Daily news, analysis and practical guides explaining what happened, who is affected and what to do next. We also turn this knowledge into practical training for organisations.
Threats and Incidents Kaspersky documented an espionage campaign using OctLurk, SilkLurk and LurkProxy. We examine memory execution, credential theft and detection.
AI Security Links from ChatGPT, Claude, Gemini and other assistants may be public and archived. We explain the threat model and enterprise data controls.
Vulnerabilities and CVEs Every TeamCity On-Premises release is affected by a critical authentication bypass and RCE. Here are the fixes, containment and investigation plan.
Supply Chain Security Malicious JavaScript from Adform's advertising domain could replace BTC, ETH and TRON addresses in clipboards and forms. We analyse the supply-chain risk.
Vulnerabilities and CVEs Adobe fixed a CVSS 10.0 RCE and an SQL-injection file disclosure in Campaign Classic. We explain which deployments need urgent patching and investigation.
Threats and Incidents Amgen reported data exfiltration from third-party-hosted cloud environments, including potential patient PHI. We analyse shared responsibility and response.
Threats and Incidents Microsoft details a Midnight Blizzard campaign against travellers using DNS manipulation, fake updates, device-code phishing and layered malware.
AI Security Chrome 149 and 150 removed 1,072 security bugs with AI agents, automated triage and testing. Google is now developing restart-free dynamic patching.
Vulnerabilities and CVEs An untrusted image processed by libvips can expose Rails server files, including secrets that enable code execution. Here is how to patch and investigate.
Supply Chain Security Malicious takeovers of orphaned AUR packages forced a temporary block on adoption and pushes. We analyse the loader, stealer, SSH worm and safeguards.
AI Security Misconfigured CTF isolation let Claude models access three companies and publish PyPI malware. We analyse the failure and the controls agent evaluations need.
AI Security Unit 42 reconstructed a campaign where DeepSeek selected CVEs, found targets and ran public exploits through Hermes Agent. We separate evidence from hype.
Supply Chain Security Bitsight found firmware-bundled apps that spoofed TV boxes as phones, clicked ads and sold the owner's connection as a SOCKS5 residential proxy.
Threats and Incidents A phishing LNK launched PowerShell, a fake Python runtime, a Go loader and two Rust backdoors. We break down the chain, detection and response.
Vulnerabilities and CVEs Researchers found 84 new flaws across seven LTE/5G core implementations. We explain GTP-C, PFCP, session hijacking and cloud-native hardening.
Once a month, a concise summary of the vulnerabilities and threats that matter. No spam, unsubscribe anytime.
