2026-11-10
Ars Technica Security
Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
Dark Reading
How to Assess OT Incident Response Preparedness
Eclypsium
Php2shell: A Network Edge Risk Playbook
Zero Day Initiative
The November 2026 Security Update Review
Dark Reading
AI Coding Agents Leak Thousands of Secrets to GitHub
Github Security Blog
Git security vulnerabilities announced
Shielder Blog
Kubernetes Non-Core Security Audit
MIT Technology Review
The Download: Pelosi’s successor targets AI and data centers face power woes
MIT Technology Review
Evolving metal extraction processes
Project Discovery
Probably Not Exploitable
Schneier on Security
New OpenSSH Vulnerability
CISA Alerts & Advisories
CISA Adds Six Known Exploited Vulnerabilities to Catalog
TrustedSec
CUI and Export Controls
Joshua Rogers
Annoying ChatGPT data usage
Datadog HQ
Detect and respond to PHP2Shell with Datadog
Teleport Blog
Announcing beam-init - a Rust init process for agents
Teleport Blog
Phases: Git for container filesystems, or, what I built after leaving CNCF buildpacks.io
Teleport Blog
Introducing Teleport Beams: A Trusted Runtime for Securing Agents in Production Infrastructure
2026-11-09
Dark Reading
People Are Getting Weird About AI
Dark Reading
Black Hat India 2026 Makes a Landmark Debut in Bengaluru, Bringing the Global Cybersecurity Community to India
Microsoft Security
FORGE Lab uses agentic tools to identify memory safety issues in Rust
Ars Technica Security
Vulnerability that lets hackers SSH into Linux devices is under active exploitation
MIT Technology Review
The backlash about data centers might really just be about electricity
Amazon Security
Help defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validation
Include Security
Why Don’t We Just Use AI?
Ars Technica Security
Claude Code is accidentally exposing secrets all over GitHub
MIT Technology Review
Nancy Pelosi’s replacement is ready to regulate AI
Dark Reading
NIST: Solo Shouldn't Mean Less Secure
Socket
Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor
Offensive Security
LEVEL 20: Same Game. New Level.
MIT Technology Review
The Download: empty AI climate claims, and an Nvidia investigation
MIT Technology Review
Innovating with AI in the special chemicals industry
Cloudflare
Launching the Vite Ecosystem Fund
Hunt and Hackett
Your security seems to be under control, but can you prove it?
Schneier on Security
AI Security
CISA Alerts & Advisories
CISA Adds Four Known Exploited Vulnerabilities to Catalog
MIT Technology Review
The climate case for AI has not been made
Malwarebytes
A week in security (November 2 – November 8)
Step Security
@ethersphere/bee-js 13.3.0 Compromised
Joshua Rogers
What’s going on with Taiwan’s RDAP server?
Fastly
Do You Have a Green Website?
2026-11-08
Naveen Srinivasan
My W^X Hook Was Letting Things Be W+X
Joshua Rogers
You can no longer star archived GitHub repositories
LogTriage Research
What finds a new MCP server: directories, monitors and scanners
Rosecurify
Seclog - #203
2026-11-07
Ars Technica Security
British soldier ignored order to pull his SIM card, then got blackmailed
Microsoft Security
ARTEX abuse expands as cybercriminals target financial sector
MaskRay's Blog
四色滑道：从博物馆的益智玩具到一道OI题
2026-11-06
Schneier on Security
Friday Squid Blogging: New Jurassic Squid Predecessors
GitGuardian
The Agents Have Now Found Your Secrets On GitHub: ARTEX Is Abusing Public Secrets Right Now
Amazon Security
Addressing protocol security gaps in multi-tenant Kubernetes
Ars Technica Security
Chainalysis says hackers stole credentials and tokens for all of its customers
Dark Reading
AI Gave Your Incident Archive a Second Job
Socket
Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools
Schneier on Security
Pinpointing Location of Videos from Background Airplane Sounds
Dark Reading
Why Europe's Freezer Hacks Spread So Far, So Fast
Cloudflare
The post-quantum future of web privacy
Offensive Security
What AI Changes About the Cybersecurity Skills Your Team Needs
MIT Technology Review
The Download: a humanoid cleans house and Samsung builds for the AI boom
GitGuardian
How to Handle Secrets in Helm
CISA Alerts & Advisories
CISA Adds One Known Exploited Vulnerability to Catalog
MIT Technology Review
I watched a humanoid robot clean my apartment. It felt like a taste of the future.
ZeroPath
Brief Summary: SonicOS CVE-2026-107154 Management Interface Session Validation Flaw (CWE-291)
Hacktron
Partnering with OpenAI
ZeroPath
Overview of CVE-2026-120537: Unauthenticated Stored XSS in the TranslatePress Dictionary Endpoint
ZeroPath
Overview of CVE-2026-17147: Authenticated Path Traversal to Code Execution in IBM API Connect
ZeroPath
Brief Summary: IBM API Connect CVE-2026-17324 Missing Authentication for a Critical Function
ZeroPath
Brief Summary: IBM API Connect CVE-2026-17403 Hard-Coded Credentials Enabling Administrative Control
ZeroPath
Brief Summary: SonicOS CVE-2026-107155 Permissive Cross-Domain (CORS) Policy in the Management API
2026-11-05
Microsoft Security
Threat actors use agentic AI tooling to find and abuse exposed secrets
Ars Technica Security
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
Black Hills Info Sec
Core Skills in the Age of AI
core-jmp
Picking apart PHP2Shell
Amazon Security
Introducing AWS account access manager: IAM role flexibility with centralized workforce access
Talos Intelligence
Bring a tent, I've got the coffee: Lessons from it-sa
Microsoft Security
New investments to reduce on-premises security risk
Cloudflare
Agents aren’t humans (but they kinda are)
Microsoft Security
What’s new in Microsoft Security: November 2026
Offensive Security
Keys to the Kingdom: The eMudhra Weak-Key Compromise
Microsoft Security
Email threat landscape: Q3 2026 trends and insights
Red Siege InfoSec Blog
DigDug: Making Your Payload Too Big to Scan
Bishop Fox Security
What Is an Agent Harness? How AI Security Tools Work
MIT Technology Review
The Download: Texas’s fragile AI boom and energy policy shifts
Escape DAST
Launching Continuous AI Pentesting: sharper with every finding, auditable with every release
CISA Alerts & Advisories
US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems
CISA Alerts & Advisories
Post-Quantum Questions to Ask Your Vendors
Step Security
CVE-2026-109518: apt Flaw Lets Attackers Swap Packages After Verification and Run Code as Root
Krebs on Security
Want to Rent an Internet Address at the White House?
ZeroPath
Overview of CVE-2026-110932: Unauthenticated Disk Exhaustion via the Keycloak Theme Gzip Cache
Nebula Security
One Call Is All It Takes: NebuSec Researchers Uncover Telegram Android Memory Corruption
ZeroPath
FreeSWITCH CVE-2026-116779: SIP MESSAGE to API Command Injection (PoC, Patch, and Detection)
ZeroPath
Brief Summary: FreeSWITCH CVE-2026-116784, an Out-of-Bounds Read in RTCP NACK Feedback Parsing
Datadog HQ
Highlights from Oracle AI World 2026
ZeroPath
Brief Summary: Keycloak SAML SOAP Endpoint Memory Exhaustion Denial of Service (CVE-2026-82965)
2026-11-04
Ars Technica Security
Hackers exploited iOS and Android flaws to infect phones
Ars Technica Security
Binance says hackers who stole billions in crypto spent months planning heist
Step Security
Malicious Files: Find What Supply Chain Attacks Leave Behind in Your GitHub Repositories and on Developer Machines
White Knight Labs
Exploiting PHP Foundational Vulnerabilities
Dark Reading
Incidents Move Too Fast for Pen & Paper
Elastic Security Labs
Modernising threat hunting: Using Semantic Search to Find Risky AI Agent Behavior
CISA Alerts & Advisories
CISA Adds One Known Exploited Vulnerability to Catalog
NVISO Labs
Detection Engineering: Implementing Detection-as-Code in an Existing Environment: Part 2 – Execution
Elastic Security Labs
When trust becomes the payload: Inside the threats, etc quarterly report
ZeroPath
Quick Look: Linksys E5350 CVE-2026-121932 Pre-Auth OS Command Injection in the Setup Wizard
ZeroPath
Overview of CVE-2026-35259: Open Redirect in the Oracle WebLogic Server Console Rated CVSS 8.8