219 Security Blogs

Last Updated: 14 Oct 26 18:05 UTC

Blog List | Github | OPML

2026-10-14

Black Lantern Security
CVE-2026-79957 Insecure Direct Object Reference in ServiceNext

Socket
Front Lines Podcast: What Founders Get Wrong When Pitching CISOs

Malwarebytes
AI worms could spread across your smart devices, Anthropic warns

Schneier on Security
Upcoming Speaking Engagements

ReversingLabs
What a CBOM Is — and Why an SBOM Won't Answer the Quantum Question

core-jmp
Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)

XBOW
XBOW Data Residency now Available in Australia, Canada, and Japan

Schneier on Security
The Future of AI Cryptanalysis

Krebs on Security
U.K. Sanctions Cryptomus for RU Money Laundering

Varonis
IBM’s Cost of a Data Breach Report 2026: AI Is Now the Attacker and the Target

Schneier on Security
Cyberattack on Connected Fridges in France

Talos Intelligence
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

Socket
Socket for Origin Now Available

core-jmp
HDD Firmware Hacking Part 1

Rapid7
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)

Microsoft Security
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

Dark Reading
Russian Influence Operation Widely Targeting Latin America

GitGuardian
Why We Built the Good Samaritan Program

Cloudflare
Inside Hyperdrive: How we solved a rare Hyperdrive MySQL caching bug

Ars Technica Security
Anthropic warns small AI models could self-replicate through IoT devices

Rapid7
Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce

MIT Technology Review
The Download: faking blood and the future of batteries

Malwarebytes
Update Windows: Record Patch Tuesday fixes flaw already under attack

Malwarebytes
Fake Calendly “Meta Careers” pages steal Facebook and Google logins

Wiz
Securing the Mission at Machine Speed: Wiz AI Agents Arrive in Wiz for Gov

Trail of Bits
Package managers have an integrity problem

Malwarebytes
Police receive fake murder tip from Anthropic’s Claude AI

Scott Helme
Passkeys Are Not a Trap

MIT Technology Review
The US military’s race to make fake blood

ISC SANS
Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th)

Resecurity
Iron Man & YamStore: Powering a Global Phishing-as-a-Service Ecosystem

Dark Reading
Ransomware Gangs Embrace Physical Threats, Family Stalking?

ISC SANS
ISC Stormcast For Wednesday, October 14th, 2026 https://isc.sans.edu/podcastdetail/10136, (Wed, Oct 14th)

Semgrep
Introducing Semgrep in Cursor Origin

Auth0
One SDK, Multiple Platforms: Introducing the Auth0 SDK for Kotlin Multiplatform

Fastly
Fastly Named a Leader in the 2026 IDC MarketScape for WAAP


2026-10-13

Krebs on Security
Microsoft Patches More Than 1,400 Security Flaws

Dark Reading
Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday

Embrace The Red
Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)

Rapid7
Patch Tuesday - October 2026

Dark Reading
North Korea Phishes Ukrainians for War Intel

Amazon Security
Part 2 – Cybersecurity journeys: What even is this job?

Talos Intelligence
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities

Dark Reading
Anthropic Finds Ingredients for Future AI Worms

Leviathan Security
October 2026 Mobile Platform Security & Fraud Prevention Assessment

Zero Day Initiative
The October 2026 Security Update Review

ISC SANS
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)

Google Safety & Security
Developing Gemini 4 Argon responsibly and safely

Github Security Blog
GitHub’s model for secret detection: Finding more secrets with less noise

Socket
Agent Baseline Publishes Security Reference Architecture for Software Factories

Rapid7
Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

Cloudflare
Under the hood, off the hot path: How D1 scales to millions of databases

Meta Security
Meta’s Generative Ads Model (GEM): Scaling the Central Model and Compute Engine for Frontier Ads AI

Cloudflare
Rewinding the exponential: How we keep hardware usage down

XBOW
XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days

ReversingLabs
AI coding agents expose developer screenshots on GitHub repos

Silverfort
5 cybersecurity assumptions AI attacks break

core-jmp
Reverse Engineering a Ledger Nano X Hardware Implant

Malwarebytes
Grindr users’ sensitive data shared through ad auctions without valid consent

GitGuardian
AI Agent Security: Best Practices for Safe Deployment

CISA Alerts & Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA Alerts & Advisories
Swann Communications SWIFI-SE2KIC

MIT Technology Review
The Download: open model trade-offs and geothermal power’s promise

CISA Alerts & Advisories
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure

CISA Alerts & Advisories
Inductive Automation Ignition Software

Shielder Blog
Power Grid Model Security Audit

ToxSec
The Agent Made the Call. Who Owns the Outcome?

Rapid7
CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab

Malwarebytes
Hackers heat up supermarket fridges, spoiling food across France

Troy Hunt
Weekly Update 525: AI Data Breach Hyperbole

Xint
Are You the Target of Sophisticated, State-Sponsored Hackers? Follow DARPA’s Lead.

MIT Technology Review
Open models have real benefits. Do they outweigh the risks?

MIT Technology Review
AI labs are buying data from dead startups to train their models

Palo Alto Networks
NHS England evolves its cybersecurity strategy with Palo Alto Networks and IBM

Onyphe
Refrigeration as Critical Infrastructure: Analyzing the Cyberattack on French Supermarkets

Malwarebytes
Scammers know your name, and they’re counting on you to reply

TrustedSec
TrustedSec Joins the OpenAI Daybreak Defense Network

ISC SANS
ISC Stormcast For Tuesday, October 13th, 2026 https://isc.sans.edu/podcastdetail/10134, (Tue, Oct 13th)

Datadog HQ
How Datadog defines service criticality at scale

Auth0
Introducing the Auth0 SDK for TanStack Start

CrankySec
Still Shit!

Fastly
AI Bot Cosplay

Fastly
Defense Without Detours: Introducing Fastly Network Protect


2026-10-12

Doyensec
Playing It SFAPE: Code Execution in Isolated User Mode

Amazon Security
GuardDuty Extended Threat Detection has added five new indicators to surface attack sequences

Dark Reading
Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack

Meta Security
OCP Summit 2026: Powering AI with Open Innovations in Scale-Up, Scale-Out, and Scale-Across Networks

Amazon Security
Quantum-resistant signing on AWS, Part 2: Enforce your ML-DSA algorithm policy with SCPs and IAM

Amazon Security
Quantum-resistant signing on AWS, Part 1: Build a software supply chain with ML-DSA

Dark Reading
Prominent Ransomware Negotiator Faces Extortion Charges

Dark Reading
No Identity, No Recovery: Cyber Resilience Starts With IAM

Meta Security
Shipping Media Over QUIC at Meta Scale for Instagram Live Ingest

Meta Security
Turning Opportunistic AI Inference Capacity Into Better Ads Recommendations

Schneier on Security
FBI Arrests Suspect in FBI-Hacking Case

Cloudflare
Filter, reshape, and redact logs before export with Transformers

Aikido
Aikido Security is now CREST accredited

core-jmp
How I Found a $90,000 Remote Code Execution Vulnerability in Google

Silverfort
Silverfort Secures AI Agents on Google Cloud in Runtime with Agent Gateway Integration

Malwarebytes
How “123456” became the key to almost 9 million personal records

Dark Reading
Passing the Baton: Dark Reading Names New Editor-in-Chief

MIT Technology Review
The Download: moon city problems and drone traffic controllers

Filippo Valsorda
(Post-Quantum) Cryptographic Right Answers

Malwarebytes
Phishing emails are baiting your AI assistant

MIT Technology Review
What it would take to build a city on the moon

MIT Technology Review
The ecologist revealing the invisible networks that revive rainforests

Malwarebytes
A week in security (October 5 – October 11)

ISC SANS
ISC Stormcast For Monday, October 12th, 2026 https://isc.sans.edu/podcastdetail/10132, (Mon, Oct 12th)

MaskRay's Blog
Who pays for Clang

Semgrep
Cybersecurity Awareness Won’t Save You. Readiness Might.

Rosecurify
Seclog - #199

Simon Koeck
How I Found a $90,000 Remote Code Execution Vulnerability in Google

Elastic Security Labs
Auditing the auditor: Unmasking Apex Accelerator


2026-10-11

MaskRay's Blog
ClangIR and the cost of MLIR


2026-10-10

ISC SANS
Why TLP should not replace your internal information classification, (Sat, Oct 10th)

Krebs on Security
FBI Arrests Executive at Ransomware Negotiation Firm


2026-10-09

Dark Reading
ASOS Breach Reveals the Risks in Customer-Facing SaaS

Schneier on Security
Friday Squid Blogging: I Caught a Squid

Dark Reading
AI Scramble Drives Cybersecurity M&A Boom

core-jmp
Telegram Desktop: one-click account takeover via IPC injection

Cloudflare
Introducing Clef-omni with full multimodality, plus a faster Clef and a cheaper Clef-flash

core-jmp
AnyPwn: AnyDesk Linux 8.0.2 Pre-auth Heap Overflow RCE

watchTowr Labs
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)

Dark Reading
What We Missed: FBI Strikes Back at ShinyHunters

Praetorian
Hunt, Triage, and Act on Guard Findings in Slack

Aikido
What is vulnerability remediation?

Dark Reading
Security Threats Don't Stop at the Office: Why Executives' Families Need Training, Too

Step Security
GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories

Socket
arXiv Is Rate Limiting Authors Following a Flood of AI Slop Submissions

Aikido
Top 6 developer security tools for enterprise teams in 2026

Escape DAST
What continuous offensive security testing is and how to implement it

GitGuardian
AI Agent Security: Six Controls From Nine Real Incidents

Cloudflare
Introducing on-demand CPU and memory profiling with flamegraphs for Workers and Durable Objects

Dark Reading
Social Engineering AI Agents: The New BEC for 2026

Cloudflare
Deno is joining Cloudflare

MIT Technology Review
The Download: AI’s refusal problem and weight-loss drug side effects

Socket
New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials

Rapid7
Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules

Malwarebytes
ASOS breach update: Hackers stole customer details and shopping searches

Scott Helme
The First Reduction in Their History: 64-Day Let's Encrypt Certificates

MIT Technology Review
We’re putting too much faith in AI’s ability to say no

ISC SANS
ISC Stormcast For Friday, October 9th, 2026 https://isc.sans.edu/podcastdetail/10130, (Fri, Oct 9th)

Moonlock
How Robinhood scams can lead to account takeovers and stolen money

Moonlock
New macOS backdoor CloudSyncD is hiding in a fake Zoom installer

Moonlock
Q3 data shows infostealers and trojans now dominate Mac malware

Moonlock
PamStealer expands from Apple Silicon to Intel Macs

Datadog HQ
Unify data across Datadog BYOC with cross-cluster queries for teams and AI agents

Semgrep
The End Is Nigh for Code Review

Auth0
Multi-Tenant SaaS Apps with Auth0 Organizations — Part One


2026-10-08

Palo Alto Networks
The Mango Strategy: A CEO’s Guide to AI Cybersecurity

Microsoft Security
Post-quantum authentication: Why organizations should start testing certificate ecosystems now

Dark Reading
'AgentCorruption' Puts AWS Environments at Risk With Single Prompt

Ars Technica Security
Let's Encrypt cuts certificate lifetimes to 64 days starting February 2027

Dark Reading
Venezuelan Cartel's Malware Honcho Nabbed for ATM Jackpotting

Step Security
StepSecurity Now Inventories AI Agent Skills in Your GitHub Repositories and on Developer Machines

Aikido
Top FedRAMP-compliant security tools in 2026

Dark Reading
Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift

Talos Intelligence
Making sure the checks get printed

Github Security Blog
How one bug bounty researcher chooses the features they investigate

ISC SANS
Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th)

ReversingLabs
What RL Found Before Anthropic’s Midnight Blizzard Report

Palo Alto Networks
Driven by Innovation: Our Latest Analyst Wins and Product Momentum in Network & AI Security

Malwarebytes
Attackers hijack country-code domains to impersonate Google and other services

Jericho
Concert Review: Tricky

Mend
Mend.io upgrades 184 open source organizations to the Renovate Community (OSS) plan

Google Safety & Security
Sign in quickly and securely with passkeys.

The Citizen Lab
The Secrets of a US Spyware King

Cloudflare
Bridging technical depth and usability: The story behind Radar’s redesign

Silverfort
Making native geofencing work for cloud non-human identities

Malwarebytes
Amazon has an uncomfortably personal profile on you

Dark Reading
Writing the Next Chapter

CISA Alerts & Advisories
Satel Netco Design

CISA News
CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors to Target Multiple Critical Infrastructure Sectors Worldwide

CISA Alerts & Advisories
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

CISA Alerts & Advisories
Red Lion Controls N-Tron 700 Series

CISA Alerts & Advisories
Grid Protection Alliance openPDC and openHistorian

Malwarebytes
Meta’s Muse AI files away your friendships, arguments, and secrets

Schneier on Security
How Technology Empowers—and Imperils—Dictators

GitGuardian
AI Coding Assistants Are Unpredictable. GitGuardian AI Hooks Give You Control

Zero Day Initiative
Pwn2Own Ireland 2026 - Day Three Results & Master of Pwn

Xint
GhostCompact: How Compaction Made OpenAI Inference Nearly Free

Talos Intelligence
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing

Talos Intelligence
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware

Aikido
tensorlake NPM package compromised with Shai Hulud worm

Step Security
Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It

Moonlock
The Depop scams no one warns you about until it’s too late

Socket
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack

ISC SANS
ISC Stormcast For Thursday, October 8th, 2026 https://isc.sans.edu/podcastdetail/10128, (Thu, Oct 8th)

Moonlock
How to lock apps on iPhone with Face ID, Touch ID, or a passcode

Simon Koeck
A Single POST Freezes Any Next.js Server

GMO Flatt Security Research
Software Supply Chain Attack on tensorlake: Overview and Response Guidance

Flatt Security Research
Software Supply Chain Attack on tensorlake: Overview and Response Guidance

Star Labs
Novinarya: An Android stealer that hides its live C2 in a shop bio

Datadog HQ
Define user actions on your web app with visual labeling in Product Analytics

Fastly
The Video Data Myth: Why AI Hasn't "Watched" the Internet Yet

Elastic Security Labs
Introducing AlertZero: Inbox zero for your alert queue

Teleport Blog
How to Tie Kubernetes Audit Logs to Individual Engineers

Greynoise
Spike in Attacks Targeting Digital Video Recorders in Ukraine

Datadog HQ
Run incident response in your FedRAMP High environment

Semgrep
"I wanted the big name on my resume": Why our former interns chose a startup anyway


2026-10-07

Amazon Security
Configuring your AI vulnerability harness, Part 2: The steering file

Amazon Security
Building your AI vulnerability harness, Part 1

Dark Reading
Australian Gov't Weighs Mandatory AI Incident Reporting

Dark Reading
Citizen Lab Slams Trump Administration, 'Techno-Fascist' Executives

Dark Reading
Anthropic Gives Vetted Defenders Fewer Claude Guardrails

Dark Reading
OpenAI Agent Escape Causes Wikimedia Service Outage

Rapid7
Four compliance frameworks, one security team: Why fragmented university security raises regulatory risk

Talos Intelligence
Microsoft, Adobe, Apple, and Foxit vulnerabilities

Varonis
Least Privilege for AI Agents: A Practical Guide for Security Leaders