197 Security Blogs

Last Updated: 12 Jul 26 16:16 UTC

Blog List | Github | OPML

2026-07-12

Step Security
jscrambler npm package publishes malicious preinstall binary

MaskRay's Blog
Irreducible loops


2026-07-11

Socket
jscrambler npm Package Compromised in Supply Chain Attack

ISC SANS
Wireshark 4.6.7 Released, (Sat, Jul 11th)

Rapid7
Weekly Metasploit Update: Exploits for FlowiseAI CSV Agent and MacOS Package Kit


2026-07-10

Schneier on Security
Friday Squid Blogging: “Squidbleed” Vulnerability

Praetorian
Bluetooth Low Energy Security Testing, Consolidated: Introducing Caeruleus

Dark Reading
Jen Ellis: Connecting Cyber Community With Political Machinery

Dark Reading
Cybercriminals Flock to Healthcare Businesses as Attacks Surge

SentinelOne
The Good, the Bad and the Ugly in Cybersecurity – Week 28

Amazon Security
AWS designated as a critical third party to the UK financial sector

Microsoft Security
Securing our future: July 2026 progress report on Microsoft’s Secure Future Initiative

Searchlight Cyber
How Attack Surface Management Powers Preemptive Threat Exposure Management

ISC SANS
My Stack Simulator, (Wed, Jul 8th)

Zero Day Initiative
CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys

Dark Reading
Fresh ATM Crypto Software Bugs: Jackpot or Bust?

Dark Reading
More Countries Jump on the Social Media 'Ban Wagon'

ToxSec
Agentic AI Breaches 2026: 3 Postmortems, No Spin

Malwarebytes
This new Windows malware can take over your PC and wipe it clean

Cloudflare
Improving Smart Tiered Cache for Public Cloud Regions

Dark Reading
AI Coding: Do Security Risks Outweigh Productivity Gains?

MIT Technology Review
The Download: Claude’s inner workings and OpenAI’s “super app”

CISA Alerts & Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog

Malwarebytes
How mule betting scams recruit ordinary people

Schneier on Security
AI Surveillance and Social Progress

Malwarebytes
Two Chrome updates in two days fix critical vulnerabilities

ISC SANS
"Comment stuffing" in an HTML phishing attachment as a mechanism for evading AI-based detection?, (Fri, Jul 10th)

MIT Technology Review
Sperm donors need limits, says a European fertility group

DarkRelay
CVSS vs EPSS Scoring: A Practical Guide to Vulnerability Prioritization

ISC SANS
ISC Stormcast For Friday, July 10th, 2026 https://isc.sans.edu/podcastdetail/10002, (Fri, Jul 10th)

Moonlock
Is WhatsApp safe? Here’s our expert opinion on WhatsApp security

Datadog HQ
Making agentic token costs visible in production


2026-07-09

Amazon Security
Introducing OAuth Support for AWS MCP Server

Mend
Dependency management tools: Key features and 6 tools to know in 2026

Ars Technica Security
Patch for Windows Defender 0-day could allow attackers to fill hard disk

Dark Reading
Iran's Cyber Crosshairs Focus Beyond Critical Infrastructure

MIT Technology Review
Anthropic found a hidden space where Claude puzzles over concepts

Dark Reading
Microsoft Reins in RoguePlanet Zero-Day Threat

Socket
Fake Braintree NuGet Package Skims Credit Cards and Harvests Merchant Credentials

Dark Reading
AI Agents Are a New Kind of Identity — and Most Organizations Aren't Ready

Talos Intelligence
WolfSSL, GeoVision, VTK vulnerabilities

Talos Intelligence
Winning 54% of the time

Step Security
Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys

Github Security Blog
How GitHub gave every repository a durable owner

Moonlock
How to get rid of a fake Apple security alert and why you’re seeing it

Wiz
How ProdSec uses Wiz

Wiz
Wiz in the Verizon DBIR: How AI Acceleration and Cloud Sprawl Impact Modern Defense

Aikido
Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry

Jericho
Random Movie/TV Thoughts and Reviews (July 2026)

Malwarebytes
How World Cup crypto prediction sites take your money

Malwarebytes
6.9 million driver’s license numbers stolen from AssuranceAmerica

GitGuardian
GitGuardian Power for Amazon Kiro: Secrets Detection Built Into the Agent

Microsoft Security
GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Dark Reading
As Global Conflicts Go Digital, Businesses Need Wartime Game Plans

Cloudflare
Why we cannot wait for better post-quantum signature algorithms

Hybrid Analysis Blog
Suspected Russian Threat Actor Impersonates Legitimate Crypto Wallets to Deploy Remote Utilities

Socket
Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics

Dark Reading
AI Gateways Offer Attackers the Keys to the Kingdom

Eclypsium
The Two BIOS Passwords Everyone Confuses

MIT Technology Review
The Download: a nuclear landmark, and China eyes Nvidia chips

CISA Alerts & Advisories
Schneider Electric PowerChute Serial Shutdown

CISA Alerts & Advisories
OpenPLC v3

CISA Blog
Lessons from CISA’s Cyber Incident

CISA Alerts & Advisories
Schneider Electric Easergy MiCOM Px40 Series

Malwarebytes
Microsoft fixes RoguePlanet zero-day in Defender

Moonlock
Is my iPhone listening to me? Here’s how to make it stop

Schneier on Security
The Language of AI Could Change How Humans Speak

Dark Reading
'GodDamn' Ransomware Uses BYOVD to Smite US Companies

Aikido
AI Pentesting Buyer's Guide: How to evaluate AI pentesting vendors

Malwarebytes
Turn off this Meta setting before someone generates AI images of you

Sicuranext Blog
Why the HTTP QUERY Method Is a Good Idea but Accept-Query Is Not

Sicuranext Blog
Why the HTTP QUERY Method Is a Good Idea but Accept-Query Is Not

MIT Technology Review
Four nuclear reactors hit a big milestone in the US

Dark Reading
European Organizations Have a Collaboration Security Confidence Gap

Hunt and Hackett
Reporting cyber security incidents starts with understanding what happened

TrustedSec
Vulnify: Giving Your Agents a CVE Brain

ISC SANS
ISC Stormcast For Thursday, July 9th, 2026 https://isc.sans.edu/podcastdetail/10000, (Thu, Jul 9th)

ISC SANS
_HELP_ME_ESCAPE_FROM_BELARUS_PLEASE_ [Guest Diary], (Tue, Jul 7th)

mez0 Blog
Vulnify: Giving Your Agents a CVE Brain

Snyk
Symlinks Are Still Scary (And Yes, You Can Commit Them to Git)

Auth0
Delegation Is a Form of Respect. Here Is What That Actually Means

Fastly
How to protect your MCP Server with Fastly


2026-07-08

Socket
npm v12 Ships With Install Scripts Off by Default, Begins Deprecating 2FA-Bypass Tokens

Dark Reading
Mexico's New Cyber Plan Faces Its First Real Test

Dark Reading
Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours

Socket
Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories

Mend
The ECB just gave banks four months to fix AI vulnerability gaps. Most of the work starts in the software supply chain.

Step Security
Introducing Secret Exfiltration Protection for GitHub Actions

Ars Technica Security
Google pays $250K for Linux vulnerability allowing guest VM escapes

Amazon Security
Designing for the inevitable: System prompt leakage and mitigations in generative AI applications

Moonlock
Is your TikTok account hacked? Here are the telltale signs and steps to recover it

Moonlock
How to spot an Amazon scam and protect yourself from one

Microsoft Security
Protecting Microsoft at AI speed: How SFI proactively hardens our cloud

Dark Reading
Vidar Infostealer Hammers SMBs via Malvertising Campaign

MIT Technology Review
EmTech AI 2026: The Rise of the AI Platform

SentinelOne
HPC AI Workloads Need Runtime Security. The Architecture Already Exists.

The Citizen Lab
AI Surveillance Is Being Supercharged–And It Will Chill Social Progress

Moonlock
What is whaling, or whale phishing? Here’s how whaling attacks work

Black Lantern Security
BBOT 3.0

Amazon Security
The CISO’s guide to post-quantum mandates and migrations

Wiz
GhostApproval: A Trust Boundary Gap in AI Coding Assistants

Black Hills Info Sec
Finding the “Goldilocks” Zone: A Practical Approach to Alert Triage

Troy Hunt
Weekly Update 511: Live from my Riad in Marrakech

Cloudflare
Introducing Meerkat: an experiment in global consensus

Rapid7
Security Teams Are Ready To Become More Preemptive. What’s Holding Them Back?

Bishop Fox Security
Cracking Firmware with Claude: Senior-Level Skill, Junior-Level Autonomy

Krebs on Security
Felons, Fraudsters Flog Offensive Cybersecurity Startup

Wiz
Wiz ASM for any environment, any risk, everywhere

Malwarebytes
Your next car could be watching your face

MIT Technology Review
The Download: worms fight pollution, and geoengineering faces reality

Sicuranext Blog
Protect Your WordPress Using Claude Code and Karna

Sicuranext Blog
Protect Your WordPress Using Claude Code and Karna

Searchlight Cyber
July 7th – This Week’s Top Cybersecurity and Dark Web Stories

Schneier on Security
Cybersecurity and the Gap Between Skill and Ability

Trail of Bits
Mutation testing comes to DAML

Escape DAST
Product Updates: Quick fix issues by prompting your agents and follow a live tree of agents in your pentest

Dark Reading
State IDs for AI Agents: Will Estonia Set a Precedent?

Ars Technica Security
Hackers can use 9 of the most popular AI tools to assemble massive botnets

Socket
pnpm 11.10 Hardens Registry Authentication to Block Token Redirection

DarkRelay
Nmap for Pentester: Host Discovery Guide

Arch Cloud Labs
Kexec & Btrfs Subvolumes for Kernel Testing

ISC SANS
ISC Stormcast For Wednesday, July 8th, 2026 https://isc.sans.edu/podcastdetail/9998, (Wed, Jul 8th)

Elastic Security Labs
ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

Teleport Blog
When AI Agents Call AWS, Who Does AWS Think They Are?

Auth0
How to Pick the Right Auth0 Customization for Your App

Datadog HQ
Monitor your .NET MAUI apps with Datadog RUM

Datadog HQ
Protect AWS Strands Agents with Datadog AI Guard

Hacktron
GLM and DeepSeek Are Catching Frontier Models at Finding Vulnerabilities

Fastly
Fastly Joins DIMPACT to Collaborate on Digital Sustainability


2026-07-07

Palo Alto Networks
What It Takes to Secure Claude Cowork Across the AI Enterprise

Step Security
GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps

Dark Reading
Big Brand Jobs Scam Targets Marketing Pros' Google Accounts

Dark Reading
Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft

Aikido
Top Burp Suite alternatives for web application security testing

Amazon Security
Enforce zero data retention on Amazon Bedrock with Bedrock Projects and service control policies

Socket
Coordinated npm and PyPI Campaign Typosquats Popular Secure Payment Apps

ISC SANS
More Odd DNS Records: NIMLOC, (Tue, Jul 7th)

Malwarebytes
How the Reddit and Discord false report scam steals accounts

Dark Reading
'GitLost' Flaw Leaks Private Data From GitHub's Agentic Workflows

Jericho
CISA KEV’s Revolving Door

GitGuardian
Every Laptop Is a Credential Store: Where Secrets Hide

Xint
How to Safely Implement Autonomous AI Agents for Pentesting Live Apps

Mend
Best AI Governance Platforms for Enterprises: Top 6 in 2026

Malwarebytes
Fake Netflix, Coca-Cola, and FIFA job scams target marketers

Red Siege InfoSec Blog
Improving Your Simple Windows Domain for Offensive Testing: Elastic Defend EDR

ToxSec
Cisco’s Agent Runtime SDK Bakes Security Into the Build

Cloudflare
Cloudflare proudly joins the UK government's Cyber Resilience Pledge

Eclypsium
Post-Mythos Cybersecurity: Can You Automate Infrastructure Assurance with AI?

Aikido
Top Chainguard alternatives 2026

MIT Technology Review
The Download: your stake in OpenAI, and the Treasury’s AI warning

CISA Alerts & Advisories
Hitachi Energy PROMOD V

CISA Alerts & Advisories
CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA Alerts & Advisories
Siemens SINEC OS

CISA Alerts & Advisories
Digi International PortServer TS, Digi One SP IA

CISA Alerts & Advisories
Hitachi Energy e-mesh EMS

CISA Alerts & Advisories
Labcenter Proteus 9

CISA Alerts & Advisories
Siemens Mendix Studio Pro

CISA Alerts & Advisories
Hydro-Québec Le Circuit Electrique charging station backend

CISA Alerts & Advisories
CISA Adds One Known Exploited Vulnerability to Catalog

Malwarebytes
Claude Code’s hidden tracker was an “experiment,” says Anthropic

MIT Technology Review
The foundational elements of AI architecture that IT leaders need to scale

Schneier on Security
Google Is Suing Chinese Scammers Who Are Using Gemini

Talos Intelligence
UAT-7810 continues building ORB networks using new malware

MIT Technology Review
Why worms (and microbes) are catching on as a manure pollution solution

Escape DAST
Introducing Escape's Partner Program

Malwarebytes
Scammers are using AI to sell impossible flowers

NVISO Labs
Reducing Microsoft Sentinel Costs Without Compromising Detection – Part 2: The Firewall Quest

Compass Security Blog
Cyber Resilience Act – Part II

Resecurity
Artificial Intelligence Safety Law: Landmark Industry Regulation Bill

TrustedSec
Welcoming ObfusGit

Moonlock
Signal app scams: What the app can’t protect you from

Moonlock
12 Tinder scams: Warning signs, scam types, and what victims should do

ISC SANS
ISC Stormcast For Tuesday, July 7th, 2026 https://isc.sans.edu/podcastdetail/9996, (Tue, Jul 7th)

Teleport Blog
Kubernetes for Agentic AI: Best Practices for Identity and Access

Rosecurify
Seclog - #185

Fastly
Fastly recognized as a Gartner® Peer Insights™ Customers' Choice for Edge Distribution Platforms

Auth0
Adding Auth0 to Hono on Cloudflare Workers: A Practical Guide

Datadog HQ
DASH 2026 recap: Product news, sessions, and highlights


2026-07-06

Dark Reading
'BusySnake' Infostealer Slithers Into Critical Infrastructure Networks

Dark Reading
CitrixBleed-ing Again? NetScaler Vulnerability Under Attack

Praetorian
FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 2 of 2)

White Knight Labs
Introduction to Tokenizers in LLMs

Aikido
Predicting MongoDB ObjectId() continuously in Rocket.Chat

Amazon Security
Enforce least-privilege authorization in multi-agent AI chains using Cedar

Dark Reading
JadePuffer: The First Complete LLM-Driven Ransomware Attack

Malwarebytes
How to tell if an image is AI-generated

Microsoft Security
5 insights from Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management

RME-DisCo Research Group
Inferring Network Protocols from Traffic with MARISSA

Exodus Blog
Microsoft Windows Installer Folder Delete Privilege Escalation

Jericho
VDBs: Pedantic Nuances on Version Tracking

Auth0
The Single-Tenant Trap: Why Testing in Production Kills Uptime

Rapid7
A Day With Your Vector Command Red Team Pod

ISC SANS
RCS and DNS: The NAPTR Record, (Mon, Jul 6th)

Cloudflare
Your Worker can now have its own cache in front of it

Malwarebytes
Choose your WhatsApp username carefully

Malwarebytes
NetNut botnet takes a hit. Don’t be part of the next one.

Palo Alto Networks
It Might Feel Like We’ve Been Here Before, But We Haven’t

Schneier on Security
France to Stop Certifying Non-Quantum-Safe Encryption

Malwarebytes
A week in security (June 29 – July 5)

Resecurity
CVE-2026-48282: Adobe ColdFusion RDS Path Traversal Leading to RCE

Socket
Node.js Considers Public Workflow for Security Reports Amid AI-Driven Surge

Datadog HQ
Monitor watchOS and visionOS apps with Datadog RUM

Datadog HQ
Reduce SAST false positives with agentic evaluation and Bits Memories