196 Security Blogs

Last Updated: 06 Jul 26 17:00 UTC

Blog List | Github | OPML

2026-07-06

Aikido
Predicting MongoDB ObjectId() continuously in Rocket.Chat

Amazon Security
Enforce least-privilege authorization in multi-agent AI chains using Cedar

Malwarebytes
How to tell if an image is AI-generated

RME-DisCo Research Group
Inferring Network Protocols from Traffic with MARISSA

Exodus Blog
Microsoft Windows Installer Folder Delete Privilege Escalation

Jericho
VDBs: Pedantic Nuances on Version Tracking

Auth0
The Single-Tenant Trap: Why Testing in Production Kills Uptime

Rapid7
A Day With Your Vector Command Red Team Pod

ISC SANS
RCS and DNS: The NAPTR Record, (Mon, Jul 6th)

Cloudflare
Your Worker can now have its own cache in front of it

MIT Technology Review
The Download: South Korea’s hottest bachelors, and advancing eye transplants

Malwarebytes
Choose your WhatsApp username carefully

Malwarebytes
NetNut botnet takes a hit. Don’t be part of the next one.

ISC SANS
ISC Stormcast For Monday, July 6th, 2026 https://isc.sans.edu/podcastdetail/9994, (Mon, Jul 6th)

Palo Alto Networks
It Might Feel Like We’ve Been Here Before, But We Haven’t

Schneier on Security
France to Stop Certifying Non-Quantum-Safe Encryption

MIT Technology Review
South Korea’s hottest new bachelors are chip workers

Malwarebytes
A week in security (June 29 – July 5)

Socket
Node.js Considers Public Workflow for Security Reports Amid AI-Driven Surge


2026-07-05

Jericho
Nature Finds a Way


2026-07-04

Jericho
YouTube’s Thumbnail Generation Fraud

ToxSec
The AI Agent Kill Switch Most Teams Don’t Actually Have

Project Black
HestiaCP Admin Takeover & RCE

Project Black
CREST ANZ vs CREST International


2026-07-03

Aikido
Authentication Bypass in the default configuration phpBB

Rapid7
Weekly Metasploit Update: Modules for SMB-to-Meterpreter, Peyara Remote Mouse RCE exploit, and more

MIT Technology Review
A device that revives eyeballs from dead donors could make eye transplants possible

Jericho
F5 Contributes to KEV Confusion

Malwarebytes
Verified X ad spreads Mac malware, while ConsentFix steals Microsoft accounts

Searchlight Cyber
Why Preemptive Cybersecurity Matters

Dark Reading
Chinese LLMs Broaden the Gap Between Attackers & Defenders

SentinelOne
The Good, the Bad and the Ugly in Cybersecurity – Week 27

MIT Technology Review
The Download: a smoking “endgame” and a new Elizabeth Bear story

Schneier on Security
Flock Cameras Can Surveil Cars Without License Plates

MIT Technology Review
The UK’s generational tobacco ban might not work. I’m supporting it anyway.

Troy Hunt
Swimming Pools, Pee, and Trying to Delete Your Data From the Internet

Moonlock
New Gaslight malware uses prompt injection to evade AI analysis

Moonlock
Fake site for the Pearcleaner app is pushing a Mac stealer


2026-07-02

Dark Reading
Aussies Face Reduced Cybercrime Risk, as Pressure Shifts to SMBs

Mend
9-Step AI Governance Implementation Strategy and the Solutions to Know

Step Security
10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions

Step Security
StepSecurity Maintained Actions Are Now Free for Public Repos

Eclypsium
Technical Blueprint: Hardware Security for AI Infrastructure

Ars Technica Security
Newly discovered PamStealer isn't your typical macOS malware

Dark Reading
Apple Reverses Age-Old Patch Policy to Keep Up With AI

Krebs on Security
FBI Seizes NetNut Proxy Platform, Popa Botnet

Dark Reading
FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs

Dark Reading
Ransomware Thugs Masquerade as Interpol to Entice Small Biz

Talos Intelligence
Catan and Mouse

Praetorian
Knossos: Procedurally Generated Decoy Environments

watchTowr Labs
It’s 37oC, And All We Can Think About Is ColdFusion (Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza)

Malwarebytes
Apple’s Hide My Email doesn’t hide it very well

Malwarebytes
Fake Google and Cloudflare verification pages spread multiple malware families

Microsoft Security
Improving security posture across the Microsoft partner ecosystem

Github Security Blog
How GitHub used secret scanning to reach inbox zero

MIT Technology Review
Achieving operational excellence with AI

Jericho
We’re Losing the “Cyber” War to Ourselves

Aikido
AI Pentesting for Compliance

Rapid7
Formalizing Red Teaming Offensive Methodology as a Multi-Agent AI Architecture

Bishop Fox Security
On Favicons: From Browser Icons to Attack Surface Intelligence

MIT Technology Review
Teaching AI to run with the turbines

Malwarebytes
WinRAR flaw could allow attackers to take control of your computer

Dark Reading
Anthropic's AI Finds Bugs. IBM Bets $5B It Can Fix Them.

MIT Technology Review
The Download: a startup has a solution for AI’s groupthink problem

CISA Alerts & Advisories
Gardyn IoT Hub

CISA Alerts & Advisories
CubeSpace CW0057 Reaction Wheel

CISA Alerts & Advisories
ST Engineering iDirect iQ-Series Terminals

Schneier on Security
Cybersecurity Mission Creep in the US

Wiz
Build AI Security Agents with Wiz MCP

Trail of Bits
GPT-5.5-Cyber built a zlib fuzzing lab in a day

MIT Technology Review
Why California’s carbon manure math doesn’t add up

TrustedSec
Inheriting the Receipts: Securing the AI Your Company Already Adopted

Moonlock
How to spot a FedEx scam and what to do if you’ve already clicked

ISC SANS
ISC Stormcast For Thursday, July 2nd, 2026 https://isc.sans.edu/podcastdetail/9992, (Thu, Jul 2nd)

Wiz
Breaking Down the White House’s Actions on Post-Quantum Cryptography Readiness

Conduition
Silent Payments Harvest-Now-Decrypt-Later Attack

Elastic Security Labs
Inside Elastic InfoSec's agentic SOC: cutting alert triage from 30 minutes to under 3

Sansec Threat Research
Amasty patches 25 Magento extensions, 1 critical


2026-07-01

Leviathan Security
“UEFI is the New BIOS”: Lab Setup

Dark Reading
Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS

Malwarebytes
Fake Perplexity Chrome extension spies on your searches

Dark Reading
And the Winner in Dominant Malware Delivery? ClickFix

RME-DisCo Research Group
The Simpler, the Stealthier: Benchmarking Adversarial DGA Models in a Unified Framework

Amazon Security
Secure Amazon container workloads using container attribute-based rules in AWS Network Firewall

Google Safety & Security
The latest AI news we announced in June 2026

Step Security
15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers

Step Security
Secure Registry now tells you which machine pulled a compromised package

Step Security
Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised

Step Security
Maven Support Comes to GitHub Checks and OSS Package Search

Step Security
Multiple @immobiliarelabs Backstage Plugins Compromised on npm

Step Security
simonecorsi/mawesome GitHub Action has been compromised

Step Security
codfish/semantic-release-action GitHub Action has been compromised

Socket
PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems

Ars Technica Security
NASA inspector general suggests Boeing's Starliner will now be a decade late

Meta Security
Meta’s AI Storage Blueprint at Scale

Microsoft Security
Microsoft named a leader in the Frost Radar for cloud and application runtime security

Github Security Blog
6 security settings every GitHub maintainer should enable this week

Amazon Security
How to use the AWS Workload Credentials Provider for cross-account secret retrieval and prefetching secrets

Dark Reading
When Too Much Security Data Becomes the Risk

Rapid7
5 Myths About AI in the SOC Security Teams Need to Rethink

Dark Reading
'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat

Jericho
And AI Tech Bros Still Want to Gamble…

NVISO Labs
The Road to Post-Quantum Readiness Part 2 of 2: The Migration Playbook

Zero Day Initiative
The June 2026 Apple Security Update Review

MIT Technology Review
LLMs are stuck in a groupthink groove. This startup is trying to get them out.

Mend
Evaluating AI Security Posture Management Tools: 7 Key Criteria

Black Hills Info Sec
Finding and Addressing Vulnerable and Outdated Web Application Components

JFrog
Where Severity Scores Go Wrong: “Just Add Prototype Pollution”

ToxSec
Google SAIF: The Agent Security Map

SentinelOne
The Autonomous SOC, Revisited: What 18 Months on the Road Has Taught Us

Cloudflare
Your site, your rules: new AI traffic options for all customers

Cloudflare
Making AI search smarter

Dark Reading
Safe Events Start With Threat Intel & Digital Security

Cloudflare
Announcing the Monetization Gateway: charge for any resource behind Cloudflare via x402

Cloudflare
Content Independence Day, one year on: building the business model for the agentic Internet

Malwarebytes
BioShocking: when “gaming” AI agents is no longer a game

CISA Alerts & Advisories
CISA Adds One Known Exploited Vulnerability to Catalog

CISA News
CISA Announces New Advisory Council to Strengthen Partnerships and Secure Critical Infrastructure

Malwarebytes
Chrome needs another whopper update to fix 382 security bugs

Hunt and Hackett
Investigating AI-assisted credential access

Schneier on Security
Papa Johns Surveillance-Based Advertising

Talos Intelligence
Martin Lee: Running through the Arctic (and the threat landscape)

Talos Intelligence
ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365

Searchlight Cyber
June 30th – This Week’s Top Cybersecurity and Dark Web Stories

Malwarebytes
ChatGPT produced graphic violent images that shocked researchers

Cloudflare
Unmasking the crawls with Attribution Business Insights

ISC SANS
Why Ask Credentials If There Are Secret Codes?, (Wed, Jul 1st)

Aikido
And another one. GitHub ships break-glass credential revocation

ISC SANS
ISC Stormcast For Wednesday, July 1st, 2026 https://isc.sans.edu/podcastdetail/9990, (Wed, Jul 1st)

Dark Reading
China-Linked Group Targets Southeast Asia Critical Systems

Auth0
Auth0 and Incode Boost Authentication Security with Biometric Identity Verification

Teleport Blog
How to Meet EU Cyber Resilience Act (CRA) Requirements

Fastly
State of Pay: Agentic Commerce, Payments, and the Edge


2026-06-30

Socket
Risky Biz Podcast: AI Agents Are Raising the Stakes for Software Supply Chain Security

Dark Reading
Fake Bug Report Hijacks AI Coding Agents at Scale

Dark Reading
Attackers Seize Exposed AI Endpoints to Power Offensive Ops

Malwarebytes
Watch out for “high paying, low effort” Amazon job texts

Ars Technica Security
New attack provides one more reason why AI browsers are a bad idea

watchTowr Labs
CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)

Dark Reading
Why Identity Security Is Your Cyber Career Entry Point

Microsoft Security
Accelerating the quantum-safe timeline

Dark Reading
Phishers Gain Persistence at EU, Asia Hospitality Orgs

Wiz
Start Secure in the AI Era: Accelerating AI Threat Readiness with WizOS

Eclypsium
BTS #77 - FortiBleed Uncovered: How Attackers Harvest Credentials from Fortinet Devices

Mend
When the guardrails held and the attack still worked

Palo Alto Networks
A Defining Moment in Identity Security

Escape DAST
Modern AI-powered Pentesting Tools In-Depth benchmark

Meta Security
10 Years of Meta’s Commitment to Python

Eclypsium
New Gartner® Report on Preemptive Exposure Management

Microsoft Security
​​What’s new in Microsoft Security: June 2026

Microsoft Security
Securing AI agents: When AI tools move from reading to acting

Troy Hunt
Weekly Update 510: Live From Mallorca with Scott Helme

Escape DAST
Two Critical Vulnerabilities, One AI Pentester: How Cascade Found an Unauthenticated RCE and Walked Around the WAF

Jericho
Save the Earth One Napkin at a Time

Malwarebytes
Update time: Apple releases security patches for iOS, MacOS Tahoe, Safari

Aikido
Aikido acquires Root to secure the supply chain

GitGuardian
IEEE Cloud Summit 2026: The Tunnels No One Mapped

Dark Reading
AI-Generated Workflows Are a Silent Security Disaster

Schneier on Security
The Realities of AI Video Surveillance

CISA Alerts & Advisories
Delta Electronics DVP12SE PLC

CISA Alerts & Advisories
Mitsubishi Electric MELSOFT Update Manager SW1DND-UDM-M

CISA Alerts & Advisories
Frangoteam FUXA SCADA/HMI

CISA Alerts & Advisories
Schneider Electric EasyLogic T150 and Saitel DP RTU

CISA Alerts & Advisories
StoneFly Storage Concentrator

CISA Alerts & Advisories
Schneider Electric EcoStruxure IT Data Center Expert

CISA Alerts & Advisories
XZ Utils vulnerability impacting B&R Products

CISA Alerts & Advisories
OFFIS DCMTK Toolkit

Trail of Bits
Shipping post-quantum cryptography to Python

ISC SANS
June 2026 Apple Updates, (Tue, Jun 30th)

Shielder Blog
Symfony YAML Security Audit

ISC SANS
ISC Stormcast For Tuesday, June 30th, 2026 https://isc.sans.edu/podcastdetail/9988, (Tue, Jun 30th)

ZeroPath
How to Reduce False Positives by 76% with Repo Context

Fastly
World Cup Viewership: What Keeps Fans Watching (and Tuning Out)

Fastly
No Code Request Routing

Rosecurify
Seclog - #184


2026-06-29

Dark Reading
NIST Enrichment Reductions Impact CVE Coverage, Accuracy

Ars Technica Security
US offers $10 million for info on group behind Signal and WhatsApp hacking spree

Dark Reading
'Djinn' Stealer Targets Cloud, AI Credentials

Socket
Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates

Dark Reading
Vulnerabilities Expose Private Data in Indian Government Systems

Dark Reading
Can Clothes Make You Invisible to Facial Recognition?

Amazon Security
What the June 2026 Threat Technique Catalog update means for your AWS environment

watchTowr Labs
Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)

Dark Reading
Iran, Russia, China Target Water Systems for Sabotage