Guardicore Labs uncovers a Ransomware detection campaign targeting MySQL servers. Attackers use Double Extortion and publish data to pressure victims.

In the beginning of April, three attacks detected in the Guardicore Global Sensor Network (GGSN) caught our attention. All three had source IP addresses originating in South-Africa and hosted by VolumeDrive ISP (see IoCs).

Our deception technology is able to reroute attackers into honeypots, where they believe that they found their real target. The attacks brute forced passwords for RDP credentials to connect to the victim download and execute a previously undetected malware, which we named Trojan.sysscan.

Data centers were on the ballot in dozens of races last night. They lost most of them.

Tuesday's election was a wholesale rejection of Silicon Valley's worldview and AI-powered kleptocracy.

These are the top threats you should know about this week.

Synthetic CISOs rank AI agents as the top underestimated threat. See key survey findings and learn how to secure overpermissioned agents and vulnerable APIs.

Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Binance has detailed how attackers pulled off the record $6.43 billion theft from the exchange, describing a multi-stage campaign rather than a single breach. It began in June 2026 when a Wallet DevOps engineer downloaded a trojanized Homebrew installer while […] The post InfoSec News Nuggets – 11/04/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Summary Binance disclosed that a DPRK fake employment scheme was behind its $6 billion hack: Attackers used a fabricated job… The post DPRK Hackers Perfected Their Fake Interview Playbook Over Dozens of Attacks Before Binance appeared first on Chainalysis.

Microsoft Threat Intelligence tracks a fake-download campaign that uses trojanized Inno installers to deliver multiple monetization offers and provides detection and investigation guidance across the complete installer session. The post Fake-download campaign uses trojanized installers to deliver monetization payloads appeared first on Microsoft Security Blog.

Read why Gartner named Microsoft a Leader in the inaugural 2026 Magic Quadrant for AI Agent Management Platforms. The post Microsoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms   appeared first on Microsoft Security Blog.

Researchers from the Citizen Lab and Princeton have won the IRTF Applied Networking Research Prize for their work on the network security of Android apps. The post Citizen Lab Researchers Win IRTF Applied Networking Research Prize appeared first on The Citizen Lab.

Slopfest 2k26 continues with an election, a fanfic fiasco, and World of Slopcraft.

The vibe-coded addon problem is getting so bad that Warcraft Logs is changing its API and developers are dealing with theft of their work.

ao3.life was scraping and repackaging fanfiction’ works and turning them into audiobooks for sale without the original authors’ permission.

IDC MarketScape named Akamai a Leader in Managed Edge Services 2026. Discover how edge computing drives low-latency, secure AI inference beyond the GPU.

AI can produce a plausible vulnerability report in seconds, but proving it is real still takes expert judgment. This post explores the economics of false positives, why they burden your most senior people, and why accountability stays human.

FBI links $6.3 billion Binance hack to North Korea The FBI and federal partners have attributed the $6.3 billion theft from cryptocurrency exchange Binance to North Korea’s TraderTraitor hacking group, the same unit blamed for the $1.5 billion Bybit heist in 2025. Blockchain intelligence firm TRM Labs estimates the attackers moved $6.36 billion out of […] The post InfoSec News Nuggets – 11/03/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Early this morning Mercado Bitcoin, Brazil’s largest crypto exchange, suffered a security incident that resulted in approximately $49 million in… The post Disrupting the Mercado Bitcoin Attack: How Chainalysis Led the Freeze of Nearly $10M in Stolen Funds appeared first on Chainalysis.

Learn about CVE-2026-98432, a critical remote use-after-free flaw in the Linux kernel TCP stack, its root exploit risks, affected versions, and mitigation steps.

Discover how Akamai and Skyfire verify AI shopping agents with Know Your Agent (KYA) to securely enable agentic commerce and prevent checkout friction.

Real-world exploitation concentrates in a small, high-impact subset of CVEs. Learn how defenders can prioritize vulnerabilities based on exploitation likelihood, exposure, and potential blast radius. The post What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks appeared first on Microsoft Security Blog.

As the email administrator for your organization’s domain, you receive a Domain-based Message Authentication, Reporting, and Conformance (DMARC) aggregate report showing email passing DomainKeys Identified Mail (DKIM) verification as though it came from your domain, sent from IP addresses you don’t recognize to recipients you didn’t contact. To clear the issue, you rotate your DKIM […]

On Saturday, October 24, 2026 we conducted a successful exercise demonstrating that the AWS European Sovereign Cloud can operate without depending on any infrastructure outside the European Union (EU). This was the first public technical exercise demonstrating the independence of a sovereign cloud Region. The AWS European Sovereign Cloud is a new, independent cloud partition […]

My polling place was handing out AI slop to midterm voters.

Also: Consider the Apple slop, Texas data center troubles, and more from 404 Media around the web.

Chainalysis Discloses Data Breach Following AI-Driven Cyberattack Blockchain analytics firm Chainalysis has disclosed a data breach after an external actor used offensive agentic AI techniques to gain unauthorized access to its systems and internal tools. The company says investigation content, transaction and query results, and clear-text passwords and secrets were not compromised, but non-sensitive customer […] The post InfoSec News Nuggets – 11/02/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

📖 [The CloudSecList] Issue 362 was originally published by Marco Lancini at CloudSecList on November 01, 2026.

In a new study perfectly timed for Halloween, scientists dug into the chemical properties of a once-popular beverage with purported medicinal benefits: wine made with ground-up Egyptian mummies.

Microsoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it. The post Inside a malicious Claude Code-branded extension and its persistent SSH backdoor appeared first on Microsoft Security Blog.

Wednesday Nov 4, 2026  11:00 P.M. EST Update:  On Monday, we discovered certain customer information including names, usernames, password hashes… The post Updated Nov 4: Chainalysis Security Incident Information appeared first on Chainalysis.

Key takeaways Around 4:20 p.m. ET on October 29, 2026, funds began leaving Binance hot wallets across multiple blockchains. Unauthorized… The post The $6.4 Billion Binance Hack: Tracing the North Korea Link appeared first on Chainalysis.

No content preview

Discover how the Akamai Workforce Protector Partner Playbook helps you secure browser AI interactions, eliminate data visibility gaps, and close deals.

Writer and readers share what they're feeling and doing in the aftermath of the AO3 outage. It's anything but Wattpad.

A newly released database of more than 25,000 anonymized calls from the Fireside Project’s Psychedelic Support Line opens a rare window into psychedelic experiences outside of clinical settings.

The move came after 404 Media published an investigation into how Proton CEO Andy Yen was aggressively pushing AI across Proton despite security concerns and the culture of fear he has created.

This week, we discuss customer service and Proton fallout.

I might finally buy an iPhone now that Apple has been taken down a peg.

Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos. The post From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths appeared first on Microsoft Security Blog.

Binance links $6.3 billion security incident to compromised laptop Binance says a compromised DevOps engineer’s laptop may have let an attacker reach a service container and submit unauthorized withdrawal transactions in an incident with an estimated impact of $6.3 billion. The exchange has frozen roughly $3 billion in affected assets on-chain, kept withdrawals paused while […] The post InfoSec News Nuggets – 10/30/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Learn from my experience and use it in yours. Continue reading on InfoSec Write-ups »

Oh my god?

Leaked audio of Flock's CEO, why Marisa Mayer can't keep pretending, and a CashApp nightmare.

As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed and efficiency of attacks, we’ve identified North Korean threat actors expanding their use of AI with varying levels of adoption. This blog breaks down how North Korean threat actors are utilizing AI across their operations, reflecting a broader trend of threat actors incorporating AI into their attack chains. The post Tracking AI adoption in North Korean threat actor tradecraft appeared first on Microsoft Security Blog.

IDC has named Microsoft a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises. The post IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment appeared first on Microsoft Security Blog.

Explore Akamai Cloud's Q3 2026 updates: expanded NVIDIA RTX PRO™ 6000 GPUs, Valkey Managed Database, LKE Enterprise Kubernetes scaling, and enhanced load balancing.

No content preview

What started as a question about Claude’s sandbox turned into a connected investigation of container internals, process memory, and authorization tokens. Bishop Fox researcher Chris Davis documents what Claude revealed, what it handed over, and what that means for defense in depth.

FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering The U.S. Department of Justice announced the seizure of virtualine[.]net, the domain of a bulletproof hosting provider that allegedly advertised its services on cybercrime forums for phishing, carding, spam and port scanning. Court documents say the service, which also operated under names such […] The post InfoSec News Nuggets – 10/29/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Summary Everyday financial needs are driving Sub-Saharan Africa’s crypto growth. The region’s crypto economy grew 13.4% to $101 billion, making… The post South Africa Leads Sub-Saharan Africa’s 13.4% Crypto Growth appeared first on Chainalysis.

Summary OFAC sanctioned Russian and DPRK nationals that targeted U.S. businesses with fraudulent IT workers, generating cryptocurrency proceeds to fund… The post Treasury Sanctions Russians, North Koreans supporting DPRK IT Worker Fraud appeared first on Chainalysis.

As AI and agents reshape the enterprise, CISOs face two critical priorities: enabling innovation with the right identity and data guardrails, and modernizing defense to keep pace with AI-powered threats. Aarti Borkar shares how security leaders can approach both. The post The CISO’s evolving role: Protecting and defending in the agentic era appeared first on Microsoft Security Blog.

Politicians in Europe and the U.S. are speaking out against the use of advertising technology to infect targets with zero-click spyware. The post Politicians in U.S. and E.U. Say Targeted Ads Are a Security Risk appeared first on The Citizen Lab.

No content preview

CISA warns of hackers now exploiting critical Node2Shell flaw CISA has confirmed that attackers are now actively exploiting CVE-2026-111497, a critical out-of-bounds write flaw in Google’s Brotli decoder that researchers have dubbed Node2Shell, Broccoli2Shell and HTTP2Shell. First identified in Node.js, the bug also affects HTTP servers, clients and other software that rely on vulnerable Brotli […] The post InfoSec News Nuggets – 10/28/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Your workloads reach most destinations by domain name, but a firewall can only act on what it sees in the traffic. For HTTP and HTTPS, AWS Network Firewall domain rules match the name that the client puts in the request, and the client chooses that name. The connections for protocols such as SSH and SSH […]

We continue to expand the scope of our assurance programs at Amazon Web Services (AWS) and are pleased to announce the successful completion of our first ever Cloud High (PBHH) security assessment with 172 assessed services and features. Completion of this assessment, effective September 18, 2026, makes AWS the first cloud service provider (CSP) in […]

The most important work I’ve done in cybersecurity would make for terrible television. There were no countdown clocks and no frantic typing, just a lot of careful reading, a lot of hard conversations, and the occasional quiet moment where everything finally clicked. That’s the part I want to show you this week, because the three […]

Summary The FBI Washington Field Office, working with international law enforcement partners, seized the domain virtualine.net, which, according to the… The post International Law Enforcement Seizes Domain of Virtualine Bulletproof Hosting Service appeared first on Chainalysis.

New findings by the Citizen Lab and SHARE Foundation show that a prominent supporter of Serbia's student movement was targeted with spyware. The post Serbian Prosecutor Who Investigated Belgrade Trump Tower Project ‘Targeted with Spyware’ appeared first on The Citizen Lab.

On September 25, 2026, Mandiant released a report regarding continued mass exploitation of CVE-2026-35273 by the ShinyHunters group. TrendAI’s Zero Day Initiative first reported this CVE to Oracle on June 10, 2026, following an investigation I conducted with Minh Giang and Lucas Miller of TrendAI Research. Although Oracle issued a patch under a single CVE, we reported three distinct vulnerabilities across multiple PeopleSoft components. We are coordinating with Oracle to assign separate CVEs for each issue. In this blog post, we will walk through each of these vulnerabilities, starting with a Server-Side Request Forgery (SSRF) vulnerability. We will also review the validateClient method that Oracle introduced to allow PeopleSoft system administrators to restrict access to certain functiona…

On October 21, 2026, the PHP project disclosed two critical memory-corruption vulnerabilities that can allow unauthenticated remote code execution. Both are fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Every PHP install serving web requests is in scope,

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software A memory-corruption bug in Google’s Brotli decoder, tracked as CVE-2026-111497 and rated 9.2 on CVSS 4.0 by Google, reaches far beyond the Node.js remote code execution first reported on October 21. Because each program bundles its own copy of the […] The post InfoSec News Nuggets – 10/27/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

This blog post presents a LibAFL-Qemu based way to explore state machines and why we failed to find CVE-2026-9539.

No content preview

No content preview

No content preview

Summary MENA’s crypto economy was essentially flat at $443.3 billion in the 2026 reporting period, a 1.4% decline that tracks… The post War, Shutdowns, and Licensing Reshape MENA’s $443 Billion Crypto Economy appeared first on Chainalysis.

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs An automated campaign that Wiz has tracked since September 15 and named Gheist is using stolen GitHub tokens to plant workflows on new “ci-sync-” branches that print every secret a repository can read into its GitHub Actions logs, encoded in base32 to […] The post InfoSec News Nuggets – 10/26/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

📖 [The CloudSecList] Issue 361 was originally published by Marco Lancini at CloudSecList on October 25, 2026.

Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations. The post Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks appeared first on Microsoft Security Blog.

Senior research associate Kate Robertson spoke about the legal concerns that Canada’s proposed Lawful Access Act poses with the Canadian Internet Society. The post Built-In Weakness: Lawful Access and Encryption in the Age of AI-Powered Cyber Threats appeared first on The Citizen Lab.

The internet is having a very bad cybersecurity day Security teams faced a pile-up of serious problems this week as AI-discovered critical vulnerabilities in PHP knocked government websites offline around the world and prompted the NSA to urge organizations to patch immediately or take affected systems offline. At the same time, Node.js patched four high-severity […] The post InfoSec News Nuggets – 10/23/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

No content preview

PHP2Shell scanning began before official disclosure. F5 Labs examines the first 24 hours of activity, exploit attempts, and what defenders need to know.

No content preview

No content preview

No content preview

Discover how Akamai responded to critical PHP vulnerabilities using agentic AI, real-time telemetry, and rapid action switching to deliver adaptive WAF defense.

No content preview

Kate Pundyk, Siena Anstis, and Marcus Michaelsen write about the rise of AI-enabled digital transnational repression in their piece for Just Security. The post How Generative AI is Scaling Transnational Repression appeared first on The Citizen Lab.

Connecting AI to enterprise systems changes what organizations entrust software to do. An agent that can query internal databases or modify business records has operational authority, and the scope of that authority becomes a security decision.

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert PHP pushed out an out-of-cycle security release on October 21 for two critical remote code execution vulnerabilities rated 9.2 on CVSS v4.0, after details of the embargoed flaws leaked online a day early. Researchers have dubbed the pair “PHP2Shell” and are tracking […] The post InfoSec News Nuggets – 10/22/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

October 29, 2026: We added guidance for end-of-life PHP versions (8.1 and earlier), including the source backports that the PHP security team published for PHP 7.4, 8.0, and 8.1. October 23, 2026 (update 2): The PHP project disclosed CVE-2026-115560, a separate remote code execution issue that the October 21 releases don’t fix. It affects only […]

Four new incidents, and CASI/ARS Score updates

These are the top threats you should know about this week.

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address […]

Using temporary credentials is a security best practice to reduce the risk from credentials getting compromised. With AWS IAM Roles Anywhere, now your workloads outside of Amazon Web Services (AWS) will be able to access AWS resources by obtaining temporary security credentials in AWS Identity and Access Management (IAM). IAM Roles Anywhere relies on public […]

In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.

Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments. The post AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise appeared first on Microsoft Security Blog.

Director Ron Deibert spoke to a crowd at SecTor 2026, warning that threats that the Citizen Lab investigates are being “super-charged” thanks to AI. The post Citizen Lab Director Slams Trump Administration, ‘Techno-Fascist’ Executives appeared first on The Citizen Lab.

No content preview

No content preview

October 20, 2026: This post was republished to reflect the new migration capability from Active Directory to an external identity provider (IdP) or the Identity Center directory, now available in IAM Identity Center. September 2, 2026: This post was republished to include Active Directory migration strategies and automation for permission sets. AWS IAM Identity Center […]

No content preview

At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.

Protect sensitive data by pairing Cyera's data discovery with Akamai Guardicore Segmentation to enforce dynamic, data-aware microsegmentation rules.

📖 [The CloudSecList] Issue 360 was originally published by Marco Lancini at CloudSecList on October 18, 2026.

Kate Robertson warns that Bill C-22 poses risks to Canada's national security in this piece for The Globe and Mail. The post The Lawful Access Act’s threats to Canada’s national security appeared first on The Citizen Lab.

We applied AWS Security Agent (now part of AWS Continuum), our autonomous penetration-testing agent, to 37 real, recently disclosed Common Vulnerabilities and Exposures (CVEs), each packaged as a live, containerized target with a flag hidden at the vulnerability’s intended sink. Starting from an unauthenticated or low-privilege position (an endpoint URL and a one-line hint, no […]

Testing AI security without clear scoping produces superficial coverage and unaddressed risk. This post breaks down how to define boundaries, select the right assessment type, and align AI penetration testing, red teaming, and architecture reviews to the decisions that actually matter.

No content preview

The internship 2026-2027 season at Quarkslab is open! Our internship positions cover a wide range of topics and expertise, and aim at tackling new challenges in various fields.

These are the top threats you should know about this week.

Most security tooling that fits into a CI/CD pipeline—static analysis (SAST), software composition analysis (SCA), and dynamic scanners (DAST)—flags potential issues from patterns and signatures. A flagged pattern shows you where to look; penetration testing is what confirms whether something is actually exploitable. That confirmation has traditionally come from a periodic, out-of-band engagement that runs […]

Closing the door doesn’t make a room secure. Alethe Denis breaks down how physical penetration testing evaluates whether unauthorized people can reach sensitive spaces, interact with equipment, or leave something behind without anyone noticing or reporting it.

Summary North America’s $3 trillion crypto economy remained the most influential in the world, with advancements in agentic commerce, exports… The post North America: Inside the Growth of Agentic Commerce appeared first on Chainalysis.

If you’ve ever looked at a list of cybersecurity jobs and felt like none of them fit you, you might just be looking at a short list. Most career guides cover the same few roles, like the analyst watching alerts or the pen tester (penetration tester, someone hired to legally break into systems to find […]

Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland, because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously – I’m out of ideas). If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for October 2026 For the first part of the October release, Adobe released 11 bulletins addressing 174 unique CVEs in Adobe Dimension, Commerce, Substance 3D Sampler, ColdFusion, Photoshop, FrameMaker, Experience Manager, Substance 3D Stager, Content Credentials SDK, Bridge, and Substance 3D Designer. Here’s this month’s overview table: Adobe Pa…

Summary Chainalysis Reactor’s evidentiary admissibility has now withstood scrutiny at two levels of federal court. In September, the D.C. Circuit… The post Chainalysis Reactor Withstands Daubert Scrutiny Again on Appeal appeared first on Chainalysis.

A crafted link, one page load, and no clicks required. Bishop Fox found a reflected XSS in Siemens Teamcenter’s login redirect that auto-submits its own form, turning attribute injection into zero-interaction code execution and a silent surrogate delegation change on the victim’s account.

No content preview

MyReport is a report generation software often used as a component of web-based applications. We describe a privilege escalation and remote code execution vulnerabilities in MyReport Updater 2.1.1 through its update configuration and gRPC service.

Amazon GuardDuty Extended Threat Detection correlates weak GuardDuty signals into a single, critical-severity attack sequence finding when their composition crosses a threshold of credibility. On May 20, 2026, the service started attaching five new indicator types to those sequences: MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY. For more information, see Document history for Amazon GuardDuty and […]

You want to set a cryptographic algorithm policy and stop non-compliant choices from being made in your Amazon Web Services (AWS) environment. This post shows you how. As you adopt post-quantum cryptography, one of the first decisions you face is which algorithms and parameter sets fit your business needs, balancing security against signature size, key […]

Software supply chain attacks have grown in both frequency and sophistication. Recent high-profile compromises of build systems and open source dependencies demonstrate that attackers increasingly target the trust mechanisms that verify software integrity. Those trust mechanisms rely on digital signature algorithms, and today many use traditional algorithms such as Rivest-Shamir-Adleman (RSA) and the Elliptic Curve […]

No content preview

Discover why traditional security tools leave gaps in enterprise AI use and how AI Usage Control (AIUC) provides crucial identity, data, and prompt-level risk governance.

No content preview

📖 [The CloudSecList] Issue 359 was originally published by Marco Lancini at CloudSecList on October 11, 2026.

Senior researcher John Scott-Railton speaks to WIRED about the lack of oversight at spyware company Paragon Solutions. The post The Secrets of a US Spyware King appeared first on The Citizen Lab.

Open enrollment puts payer infrastructure, security, APIs, and member experiences under pressure. Learn six ways that health plans can prepare from edge to core.

No content preview

Day Three of Pwn2Own Ireland 2026 wrapsup with 17 attempts scheduled, roughly $1.33 million on the board. The headliner is the Google Pixel 10, which draws three separate attempts: Xint at 11:15 AM, Ikotas Labs at 2:00 PM, and the Valsamaras/Ken Gannon (Djini.ai)/Valsamara team closing things out at 6:30 PM — by far the single biggest payday in play all week. The Samsung Galaxy S26 gets one more run too, from BunkyoWesterns at 4:15 PM. Smart Home stays busy with three attempts on the Philips Hue Bridge Pro and two closing attempts on Home Assistant Green, while AI Infrastructure sees two more shots at Oracle's Autonomous AI Database plus a single run at Chroma. Printers round things out with steady, lower-stakes attempts on the Brother, Canon, and Lexmark targets — and with Team MAMMOTH's …

This post shows you how to configure an AI model to perform structured, evidence-based vulnerability triage with the consistency of a seasoned security analyst. You’ll learn the design decisions behind five configuration sections that enforce structural verification, evidence-based scoring, and infrastructure-aware prioritization across every analysis session. Our companion post—Building your AI vulnerability harness—covered the architecture; […]

Vulnerability scanners produce findings faster than manual triage can process them. Your developers ship more code with more dependencies, and the volume of candidate findings grows with it. Many findings a scanner produces are unlikely to be exploited. The ones that matter need to reach an engineer fast, with enough evidence that they can act […]

If you’ve ever wondered whether your background qualifies you for a career in cybersecurity, you’re not alone — and you’re probably more prepared than you think. My name is Shannon Brazil, and I work in security communications at Amazon Web Services (AWS). I have been in the security space for over a decade, and my […]

Discover how securing shadow and zombie APIs helps banks meet the ECB cyber action plan mandates, improve posture, and mitigate AI-enabled threats.

No content preview

These are the top threats you should know about this week.

Day Two of Pwn2Own Ireland 2026 has 24 attempts on the docket, with roughly $780,000 up for grabs, running 9:30 AM to 7:30 PM IST. Samsung's Galaxy S26 will be attempted three separate times — by Valsamaras/Ken Gannon (using Djini.ai)/Valsamara at 1:00 PM, Kyeongmin Kim at 3:15 PM, and PetoWorks at 5:30 PM — worth watching since only the first successful demo claims the cash. Home Assistant Green is the day's most-attempted device, with five researchers scheduled to take a run at it. AI Infrastructure stays active with four attempts on tap (Dynamo, two at Chroma, two at Oracle's Autonomous AI Database), Wellness has just one attempt scheduled, and Printers see steady action with three separate attempts on the Lexmark CX532adwe. Yesterday, we awarded $388,500 for 32 unique 0-days. Stay tune…

Sensor Intel Series: October 2026 CVE Trends

In cloud-centered environments, establishing trust between workloads is fundamental to securing machine-to-machine communication. Traditional approaches such as API keys, shared secrets, and static service account credentials weren’t designed for the scale and ephemeral nature of cloud workloads. This drives an organizational need to shift from long-term, static credentials to short-lived cryptographic workload identities. Organizations are […]

Psiphon, a software company that helps internet users under oppressive regimes evade online censorship, plans to leave Canada if the lawful-access bill passes. The post Toronto-Based VPN Provider Plans to Quit Canada Over Lawful-Access Bill appeared first on The Citizen Lab.