Logo
Search
HOME
ARCHIVE
SIGN IN
SUBSCRIBE
Logo
ALPHA
Dennis Andrade
Dennis Andrade
Add social links

patch management

+6

AI Agents Just Broke Into 440 Companies in 48 Hours

Sep 15, 2026

•

3 min read

AI Agents Just Broke Into 440 Companies in 48 Hours

A Russian-speaking threat actor pointed a swarm of AI agents at one PaperCut vulnerability — and beat human defenders to the finish line.

Dennis Andrade
Dennis Andrade

Software Supply Chain

+6

Someone Just Minted Themselves Admin Access to Thousands of Companies

Sep 8, 2026

•

4 min read

Someone Just Minted Themselves Admin Access to Thousands of Companies

A JFrog Artifactory bug lets attackers skip login entirely — and mint admin tokens for the software supply chain thousands of companies run on.

Dennis Andrade
Dennis Andrade

Software Supply Chain

+5

Someone Just Used AI to Break Into 10 Companies

Sep 1, 2026

•

3 min read

Someone Just Used AI to Break Into 10 Companies

A ransomware crew turned a free coding assistant into an attack tool — and it never knew the difference.

Dennis Andrade
Dennis Andrade

tiktok

+9

I Won't Let My Kids on TikTok, Instagram  Roblox. Here's the $400 Million Reason Why

Aug 28, 2026

•

8 min read

I Won't Let My Kids on TikTok, Instagram Roblox. Here's the $400 Million Reason Why

An extra issue, off the usual format — on TikTok's $400M fine, Meta's $17.1B settlement, the Roblox lawsuits, and why I think age verification should be a condition of doing business, not a roadmap item.

Dennis Andrade
Dennis Andrade

meta-hacking

+9

Your AI Assistant Is Spying for Strangers

Aug 25, 2026

•

3 min read

Your AI Assistant Is Spying for Strangers

Researchers turned Microsoft Copilot into a full reconnaissance tool using nothing but polite, innocent-sounding questions — and any AI assistant with broad access could do the same.

Dennis Andrade
Dennis Andrade

Software Updates

+6

Firefox's Master Key Was Sitting on GitHub

Aug 18, 2026

•

3 min read

Firefox's Master Key Was Sitting on GitHub

The signature that proves a Firefox update is real got exposed — and there's no way to know who saw it

Dennis Andrade
Dennis Andrade

Account Takeover

+6

Your AI Login Isn't Yours Anymore

Aug 11, 2026

•

3 min read

Your AI Login Isn't Yours Anymore

Stolen and resold AI accounts are turning shared logins into a surveillance channel nobody notices

Dennis Andrade
Dennis Andrade

Microsoft Copilot

+7

Your Copilot Caught a Virus

Aug 4, 2026

•

3 min read

Your Copilot Caught a Virus

A hidden instruction in one Word file just proved AI assistants will infect every document they touch next.

Dennis Andrade
Dennis Andrade

Zero Trust

+6

Your AI Code Reviewer Just Approved Malware It Never Saw

Jul 28, 2026

•

5 min read

Your AI Code Reviewer Just Approved Malware It Never Saw

A hidden comment in a pull request is all it takes to hijack the AI gatekeeper your team trusts to ship safe code

Dennis Andrade
Dennis Andrade

identity-security

+6

The Email That Convinced Your AI You're Allergic to Penicillin

Jul 21, 2026

•

3 min read

The Email That Convinced Your AI You're Allergic to Penicillin

One email is all it takes to plant a permanent lie in your AI assistant's memory — and there's no patch coming, because it isn't a bug.

Dennis Andrade
Dennis Andrade

NHI

+6

The 3-Minute Security Audit Every Developer Should Run Before AI Touches Their Code

Jul 14, 2026

•

4 min read

The 3-Minute Security Audit Every Developer Should Run Before AI Touches Their Code

Symlink attacks, hallucinated packages, and prompt injection are turning your AI pair programmer into an attacker's easiest way in

Dennis Andrade
Dennis Andrade

Microsoft 365

+6

You Just Gave Microsoft Permission to Let Strangers Into Your Account. It Took Three Seconds

Jul 7, 2026

•

3 min read

You Just Gave Microsoft Permission to Let Strangers Into Your Account. It Took Three Seconds

ConsentFix and ClickFix attacks are turning OAuth consent prompts into skeleton keys — no password theft, no MFA bypass required. Here's how they work and what to revoke today.

Dennis Andrade
Dennis Andrade

third-party integrations

+3

Nobody Is Talking About AI Agent Skills Yet. They Will Be

Jun 30, 2026

•

5 min read

Nobody Is Talking About AI Agent Skills Yet. They Will Be

Malicious code is now delivered as helpful app features — and 26,000 AI agents just installed one.

Dennis Andrade
Dennis Andrade

authentication

+3

Your Password Is Safe. You're Still Getting Hacked

Jun 23, 2026

•

4 min read

Your Password Is Safe. You're Still Getting Hacked

The attack that broke Microsoft's login doesn't need your password at all.

Dennis Andrade
Dennis Andrade

defense evasion

+4

The Security Camera Footage of Your Digital Life Is Being Erased While You're Being Robbed

Jun 16, 2026

•

4 min read

The Security Camera Footage of Your Digital Life Is Being Erased While You're Being Robbed

Attackers aren't breaking in anymore. They're deleting the evidence that they were ever there.

Dennis Andrade
Dennis Andrade

identity

+5

The Security Experts Protecting America Just Got Caught Doing the Thing They Tell You Never to Do

Jun 9, 2026

•

3 min read

The Security Experts Protecting America Just Got Caught Doing the Thing They Tell You Never to Do

CISA left government cloud keys in public GitHub. Microsoft shipped a debug flag to 3 billion phones. Meta's AI gave away Instagram accounts. Same week.

Dennis Andrade
Dennis Andrade

identity-security

+7

Ransomware Doesn't Break In. It Logs In

Jun 2, 2026

•

4 min read

Ransomware Doesn't Break In. It Logs In

The forensics always leads back to the same place — an account that shouldn't have existed, with access it shouldn't have had. Here's what to fix before the 2 AM alert.

Dennis Andrade
Dennis Andrade

Credential Security

+5

The Agency Protecting America's Infrastructure Just Leaked the Keys to It on GitHub

May 26, 2026

•

4 min read

The Agency Protecting America's Infrastructure Just Leaked the Keys to It on GitHub

CISA left live AWS GovCloud credentials in a public repo named "Private." It sat there for six months. Nobody inside the agency noticed.

Dennis Andrade
Dennis Andrade

Zero Trust

+6

Your AI Coding Assistant Just Cloned Your Entire Repository. You Told It To.

May 19, 2026

•

3 min read

Your AI Coding Assistant Just Cloned Your Entire Repository. You Told It To.

Convention files, prompt injection, and why the line between productivity tool and data pipeline just disappeared

Dennis Andrade
Dennis Andrade

chrome-extensions

+7

The Free AI Tool You Installed Last Week Is Robbing You Blind

May 12, 2026

•

3 min read

The Free AI Tool You Installed Last Week Is Robbing You Blind

You clicked "Add to Chrome" because it promised to make you faster. You actually installed a wiretap.

Dennis Andrade
Dennis Andrade

AppSec

+7

The Apps on Your Phone Are Installing Themselves Now. They're Also Stealing From Each Other

May 5, 2026

•

3 min read

The Apps on Your Phone Are Installing Themselves Now. They're Also Stealing From Each Other

A self-spreading worm just ran through the tools developers use to build every app you touch. Here's what that means for you — and what to do about it.

Dennis Andrade
Dennis Andrade

Oauth Security

+7

Your Token Budget Just Became Your Attack Surface

Apr 28, 2026

•

3 min read

Your Token Budget Just Became Your Attack Surface

The Vercel breach wasn't a credential failure. It was a token problem — and your IAM program probably can't see it.

Dennis Andrade
Dennis Andrade

Least Privilege

+4

Your AI Agent Has More Access Than Your Domain Admin

Apr 21, 2026

•

3 min read

Your AI Agent Has More Access Than Your Domain Admin

Five vendors. Six weeks. The same architectural failure. Here's why agents keep shipping with godmode permissions — and what good actually looks like.

Dennis Andrade
Dennis Andrade
Your Autonomous Agents Are Running With God Mode Permissions

Apr 14, 2026

•

6 min read

Your Autonomous Agents Are Running With God Mode Permissions

The Agent Permission Paradox

Dennis Andrade
Dennis Andrade

identity-governance

+2

The Debt Your Security Team Isn't Tracking

Apr 7, 2026

•

7 min read

The Debt Your Security Team Isn't Tracking

Most enterprises are carrying identity debt they can't see. Here's what it looks like — and where to start paying it down.

Dennis Andrade
Dennis Andrade

Home

Archive

Subscribe

Sign Up

Login

Reset Password

Search

Profile

STAY CONNECTED

© 2026 Identity Decoded.
beehiivPowered by beehiiv