2026-11-02
Amazon Security
Beyond DKIM key rotation: understanding email replay attacks
MIT Technology Review
Raising the quality of insights in agentic analytics
GitGuardian
Your Leaked Secrets Now Show Up in Wiz
Dark Reading
Microsoft's AI Risk Report Misses This Key Detail
MIT Technology Review
Stop counting tokens, start counting what ships
MIT Technology Review
The Download: the agentic web arrives and the drive for safer roads
Schneier on Security
AI Vulnerability Finding
Trail of Bits
Backporting security fixes at scale with Codex
Rapid7
Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
MIT Technology Review
The agentic web is here
Malwarebytes
A week in security (October 26 – November 1)
ReversingLabs
The Sky Is Falling (Again): What PHP2Shell Says About AI, The Disclosure Process, and Security
Amazon Security
Inside a successful AWS European Sovereign Cloud exercise to demonstrate independent operation
Infernux Blog
Log Baseline REST API and MCP server
2026-11-01
Step Security
Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines
Yunus Aydın
Sleep: Kodlama Ajanlarına Onaylanabilir Bellek
Yunus Aydın
Sleep: Reviewable Memory for Coding Agents
Rosecurify
Seclog - #202
2026-10-31
Step Security
Binance’s $6.3 Billion Hack: FBI Attribution and the Case for Developer Machine Security
Talos Intelligence
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
Joshua Rogers
npm –ignore-scripts, yarn –version
2026-10-30
Ars Technica Security
Anthropic VS code extension on Cursor backdoored for nearly 12 hours
Schneier on Security
Friday Squid Blogging: Bigfin Squid Off California Coast
Microsoft Security
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Rapid7
Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)
Google Safety & Security
See who has access to your Gmail inbox in 2 minutes.
Schneier on Security
Bloatware in Aftermarket Auto Parts
Ars Technica Security
Hackers steal $6.3 billion from Binance in record crypto heist
CISA Alerts & Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
MIT Technology Review
The Download: GLP-1s and eating disorders, self-aware cities, and forever chemicals
Kevin Beaumont
Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide
MIT Technology Review
Eating disorders are on the rise. GLP-1s could make things worse.
Dark Reading
As Russia's Cyberwar Evolves, Belarus Steps Forward
Infernux Blog
Defender XDR - New custom detection rule fields
2026-10-29
Mozilla Security
Defending the patch gap against automated attackers
Dark Reading
Rethinking Cybersecurity Awareness in the AI Era
Dark Reading
Why CTF Competitions May Be More Important Than Ever
Talos Intelligence
A quiet week in infosec <.<
Eclypsium
Building Trusted AI Infrastructure
Include Security
Abliterated Models in Appsec Pentesting
Microsoft Security
Tracking AI adoption in North Korean threat actor tradecraft
Microsoft Security
IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment
Talos Intelligence
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Bishop Fox Security
A Journey into Claude's Sandbox
Ars Technica Security
Massive leak exposes 41,000 DHS workers and undercover ICE agents
Eclypsium
Building Trusted AI Infrastructure
MIT Technology Review
The Download: AI agent tracking and climate feedback loops
CISA Alerts & Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA Alerts & Advisories
Siemens Mendix SAML Module
CISA Alerts & Advisories
Hitachi Energy TRO600 series products
CISA Alerts & Advisories
Hitachi Energy CoreTec Product
MIT Technology Review
We urgently need to monitor AI agents’ actions in real time
Talos Intelligence
NIK C2: The new AI-enabled command-and-control framework
MIT Technology Review
Our climate models have a big, dangerous blind spot
Eye Security Research
How attackers keep reading mail after M365 session revocation
2026-10-28
Talos Intelligence
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
MIT Technology Review
Creating AI value with enterprise context
Black Hills Info Sec
John Strand's 11 Core Skills: For SOC Analysts
Offensive Security
php2shell: anatomy of two PHP lifecycle bugs
Silverfort
Weaponize your identity debt: Identity Security, decoys, and tripwires in the age of AI attacks
Meta Security
Meta Andromeda: Powering the Next Generation of Ads Retrieval Through Model-System Co-Design
Microsoft Security
The CISO’s evolving role: Protecting and defending in the agentic era
GitGuardian
Rotating 1,000 Service Account Passwords With Zero Outages: Why the Inventory Comes First
Hybrid Analysis Blog
SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks
Malwarebytes
Banks are blocking AI agents from customer accounts
CISA Alerts & Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
Schneier on Security
Studying Fraudulent North Korean IT Workers
2026-10-27
Ars Technica Security
Code-execution flaw in UEFI firmware affects most servers on planet Earth
Amazon Security
AWS becomes first CSP to complete the Cloud High profile assessment with 172 services and features in scope
Socket
Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets
Amazon Security
Part 3 – Cybersecurity journeys: The work behind the work
The Citizen Lab
Serbian Prosecutor Who Investigated Belgrade Trump Tower Project ‘Targeted with Spyware’
Zero Day Initiative
CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft
Meta Security
PrivacyLib: Privacy Controls at the Data Access Boundary
ReversingLabs
Researchers Break Into Anthropic’s Systems in Just 12 Hours—Through Third-Party Software
Malwarebytes
Five election scams to watch out for
Step Security
StepSecurity Now Inventories AI Agent Plugins in Your GitHub Repositories and on Developer Machines
PortSwigger
Scalable Vector Grief
Cloudflare
What took the Internet offline in Q3 2026
Bishop Fox Security
Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
Malwarebytes
Artificial Intimacy: Love and lies in the age of AI
CISA Alerts & Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA Alerts & Advisories
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
CISA Alerts & Advisories
EPICS Base
Escape DAST
Escape research found an auth bypass in Ghost that can wipe all member's votes. It's now CVE-2026-103288.
Schneier on Security
Hiding Capabilities in AI Models
Talos Intelligence
From federal SOCs to Talos: Ryan Fetterman on practical security research
TrustedSec
What is CUI? A Contractor’s Perspective
2026-10-26
Doyensec
ElectroNG is now open source!
Cloudflare
Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang