Sep 15, 2026
•
3 min read
A Russian-speaking threat actor pointed a swarm of AI agents at one PaperCut vulnerability — and beat human defenders to the finish line.
patch management
+6
Sep 8, 2026
4 min read
A JFrog Artifactory bug lets attackers skip login entirely — and mint admin tokens for the software supply chain thousands of companies run on.
Software Supply Chain
Sep 1, 2026
A ransomware crew turned a free coding assistant into an attack tool — and it never knew the difference.
+5
Aug 28, 2026
8 min read
An extra issue, off the usual format — on TikTok's $400M fine, Meta's $17.1B settlement, the Roblox lawsuits, and why I think age verification should be a condition of doing business, not a roadmap item.
tiktok
+9
Researchers turned Microsoft Copilot into a full reconnaissance tool using nothing but polite, innocent-sounding questions — and any AI assistant with broad access could do the same.
meta-hacking
The signature that proves a Firefox update is real got exposed — and there's no way to know who saw it
Software Updates
Stolen and resold AI accounts are turning shared logins into a surveillance channel nobody notices
Account Takeover
A hidden instruction in one Word file just proved AI assistants will infect every document they touch next.
Microsoft Copilot
+7
A hidden comment in a pull request is all it takes to hijack the AI gatekeeper your team trusts to ship safe code
Zero Trust
One email is all it takes to plant a permanent lie in your AI assistant's memory — and there's no patch coming, because it isn't a bug.
identity-security
Symlink attacks, hallucinated packages, and prompt injection are turning your AI pair programmer into an attacker's easiest way in
NHI
ConsentFix and ClickFix attacks are turning OAuth consent prompts into skeleton keys — no password theft, no MFA bypass required. Here's how they work and what to revoke today.
Microsoft 365
Practitioner intelligence on identity, AI agents, and enterprise trust.
