219 Security Blogs

Last Updated: 26 Aug 26 08:30 UTC

Blog List | Github | OPML

2026-08-26

Dark Reading
Interpol's Jackal IV Disrupts West African Crime Infrastructure

Malwarebytes
Beware of fake Indeed interview apps used to install spyware

Dark Reading
Nigeria Looks to Sovereign Cloud for Cyber, National Security

MIT Technology Review
Bill Gates says we’ve passed AI’s danger thresholds. Now what?

Elttam
Ruby Marshal Kick-off Gadgets - elttam

Elttam
Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam

ISC SANS
ISC Stormcast For Wednesday, August 26th, 2026 https://isc.sans.edu/podcastdetail/10068, (Wed, Aug 26th)


2026-08-25

Amazon Security
Fast Track ISM-ready cloud environments and IRAP Assessments with Landing Zone Accelerator on AWS

Troy Hunt
A Cautionary Tale About Data Breach Claims, Verification and Carhartt

Dark Reading
Hidden Prompts Trick AI Into False Email Summaries

MIT Technology Review
Taking your temperature from the inside

MIT Technology Review
Your brain on AI

MIT Technology Review
Seeing through murky waters

MIT Technology Review
Addressing a sticking point in sustainable adhesives

MIT Technology Review
YouTuber finds niche as college admissions mentor

MIT Technology Review
Launching youth entrepreneurship

MIT Technology Review
A new stamp on cyberfraud prevention

MIT Technology Review
AgeLab research inspires an A I startup

MIT Technology Review
Amping up T cells to target cancer

Dark Reading
Finding Nemo(Claw): Networking Issue Allows for LLM Poisoning in OpenClaw

Socket
Socket for Asana Is Now Available

Microsoft Security
The patch window is collapsing: Why security needs a new control plane

ReversingLabs
Agentic AI scales semiautonomous server attacks

Offensive Security
Road to OSCE3: Episodio 1 – OSEP

SentinelOne
The Path to the Autonomous SOC: The Early Returns of AI & What It Means for Cybersecurity

Offensive Security
Knowing what not to attack

ISC SANS
Obfuscating IP Addresses as Hostnames, (Tue, Aug 25th)

GitGuardian
Agentic AI Security: Credentials and Permissions Define the Blast Radius

Dark Reading
Is Cyber Facing an Affordability Crisis?

PortSwigger
What's in a tag name? JavaScript, apparently

CISA Alerts & Advisories
Zoneminder

CISA Alerts & Advisories
A Tale of Two SOCs: Insights From Two Red Team Assessments

CISA Alerts & Advisories
FURUNO FA-50 Class B AIS Transponder

Aikido
Could OpenClaw have actually hacked that Australian gym? We decided to test it.

CISA News
CISA Advisory Highlights Red Team Findings to Help Organizations Assess Risk, Identify Threats and Enable Effective Incident Response

CISA Alerts & Advisories
Siemens SIMATIC IoT2050 Advanced

CISA Alerts & Advisories
PayRange API

CISA Alerts & Advisories
Ebyte NE2-D11

CISA Alerts & Advisories
Bendix EC80 Brake ECU

CISA Alerts & Advisories
Rently Smart Home

CISA Alerts & Advisories
CISA Adds One Known Exploited Vulnerability to Catalog

Malwarebytes
Grok fooled into stealing user chat, location data, and more

Offensive Security
CVE-2026-72898: Critical Metabase Unauthenticated SQL Injection Vulnerability

Trail of Bits
State divergence enables unauthorized access

Schneier on Security
Black Hat State of Security Vendors

Malwarebytes
GTA 6 leak hunt could expose data belonging to thousands of Discord users

Talos Intelligence
The safety penalty: Reclaiming operational sovereignty in the age of AI

Malwarebytes
TikTok phishing: How to spot fake login and verification pages

Compass Security Blog
A Note on Pentesting Passkeys

Wiz

TrustedSec
SpooNMAP Grows Up: Findings, Local LLM Detection, and a Whole Lot Less Waiting

Moonlock
Is OfferUp legit? How to spot 15 OfferUp scams and fake buyers

ISC SANS
ISC Stormcast For Tuesday, August 25th, 2026 https://isc.sans.edu/podcastdetail/10066, (Tue, Aug 25th)

Auth0
Auth0, Made for Whatever You Are Building

Rosecurify
Seclog - #192

Nick Mykhailyshyn
Plausible Analytics: Pre-Auth RCE, Cross-Tenant IDORs, and SSRF-to-RCE

Sansec Threat Research
Shopware fixes Store API vulnerability allowing administrator takeover

Fastly
Level Up Your Security with Fastly API Enforcement

Auth0
Whatever You Are Building, Auth0 Has a Plan

Semgrep
We benchmarked A LOT of models, here’s how they compare to Mythos

Elastic Security Labs
Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy

Teleport Blog
Identity Everywhere: Bringing Infrastructure Identity to Agentic IT

Datadog HQ
Golden Paths for AI agents: What changes when platform users aren’t human?


2026-08-24

Dark Reading
Exploited Zimbra Flaw Highlights Shrinking Window to Patch

Dark Reading
Foul Language: WordlistLoader Disguises Malware as Ordinary Text

Ars Technica Security
Inaudible sounds used to fingerprint browsers catch AliExpress red-handed

Cloudflare
The Cloudflare Blog – Brought to you by EmDash

Meta Security
MetaRoCE: A New RDMA Transport Built for AI-Scale Ethernet

Meta Security
MTIA 300: Meta’s First Training Chip with Built-in NICs and Communication-Offloading Engines

Malwarebytes
Fake GTA 6 Extended Look and demo sites deliver an infostealer

Rapid7
Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

Jericho
Q&A: Modernizing the National Vulnerability Database in the Age of Artificial Intelligence

Xint
XBOW vs. Xint

Dark Reading
Tricky 'SynkLoader' Multitool May Herald Ransomware

Malwarebytes
Fake Microsoft security scans trick victims into uninstalling their antivirus

Malwarebytes
What happens to your data when you die? (Lock and Code S07E17)

Dark Reading
ToxicPanda Banking Trojan Matures Into Enterprise Threat

Eaton Works
Tata’s B2B platform returned OTPs in API responses

Malwarebytes
AliExpress caught using silent audio to fingerprint visitors’ browsers

Dark Reading
The Vulnerability Gap: Why Discovery Is Outrunning Repair

Scott Helme
The ultimate road trip combo: Starlink Mini + UniFi Travel Router

Malwarebytes
ToxicPanda 2.0 can take over your Android phone and banking apps

CISA Alerts & Advisories
CISA Adds One Known Exploited Vulnerability to Catalog

Malwarebytes
Tracking PavinLoader across ClickFix and fake download campaigns

Aikido
How Aikido finds more vulnerabilities than Claude Security at half the cost

Schneier on Security
Criminal Deception in Silicon Valley

Alex Schapiro
How a Blackstone real estate company exposed Social Security digits, dates of birth, addresses, and other applicant data through a GraphQL authorization flaw

ISC SANS
DOUBLECUP's PNG Payload, (Mon, Aug 24th)

Malwarebytes
A week in security (August 17 – August 23)

Socket
Open VSX Unblocks Extension IDs Used in Malware Campaign

Troy Hunt
Weekly Update 518: IoT Doorlock Nirvana with UniFi

ISC SANS
ISC Stormcast For Monday, August 24th, 2026 https://isc.sans.edu/podcastdetail/10064, (Mon, Aug 24th)

Datadog HQ
Monitor Azure Functions across every hosting plan with Datadog

Auth0
Adding a UI to an Auth0-secured MCP server with Skybridge

Elastic Security Labs
How a team of entity maintainers monitors, connects and scores entities in Elastic Security

Auth0
Branded Login URLs and Email Workflows for Production Auth


2026-08-23

Step Security
The State of Open Source Supply Chain Attacks

MaskRay's Blog
Block frequency

Troy Hunt
Welcoming the Sri Lankan Government to Have I Been Pwned


2026-08-22

Step Security
Rust Supply-Chain Attack: arrayref, internment, and append-only-vec Poisoned by the proc-macro1 Build-Time Dropper


2026-08-21

Cloudflare
Say it once: introducing Bot Preference Sync

Schneier on Security
Friday Squid Blogging: Neon Flying Squid

Aikido
Top image hardening tools in 2026

Dark Reading
How an Emerging Industrial Protocol Family Could Put OT at Risk

Aikido
Best enterprise AI pentesting tools for application security in 2026

Socket
PHP and Composer Support Is Now in Beta

Dark Reading
OWASP Flags Top AI Skill Risks in New Security Blueprint

Palo Alto Networks
Unit 42 Defends Organizations Against Next-Gen Frontier AI Risks with Anthropic’s Mythos 5

Schneier on Security
AI Is Learning to Write Genetic Code

Malwarebytes
Zombie Card: An expired Visa credit card can be used for purchases

Dark Reading
Calling on Cyber Pros to Help Defend City Hall

Aikido
What is CVE remediation in 2026?

Scott Helme
Introducing dbsc.dev: Does Your Browser Support DBSC?

Dark Reading
OpenAI Adds Controls That Should've Been There Already

ToxSec
CoT Forgery: Prompt Injection on the Model’s Own Thoughts

Dark Reading
Hardware Makers Implement Post-Quantum Cryptography as Security Threats Near

SentinelOne
The Good, the Bad and the Ugly in Cybersecurity – Week 34

Bishop Fox Security
No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452

core-jmp
BOFScale: A CDN-Fronted Tailnet from a BOF-PE

CISA Alerts & Advisories
CISA Adds One Known Exploited Vulnerability to Catalog

Malwarebytes
Medical records, SSNs, and bank details exposed in CareCloud data breach

Schneier on Security
More Incidents of AIs Going Rogue in Cybersecurity Challenges

Aikido
We burned 11.7bn tokens to find the best cyber AI model

Escape DAST
Escape found the same XSS in two AI chatboxes. The vulnerability was in the Markdown renderer.

Hunt and Hackett
On COM/WinRT initialization, apartments, and lpacCom capability bypasses, Part 2

Moonlock
Is iCloud Private Relay leaking your IP address? A lawsuit claims it is.

Moonlock
Apple’s anti-tracking prompt will change in the EU. Here’s why.

Moonlock
New Mac malware AmnesiaStealer hijacks Chromium browsers

ISC SANS
Who Got Missed in the MFA Rollout? More Powershell + Graph + Entra scripting!, (Fri, Aug 21st)

ISC SANS
ISC Stormcast For Friday, August 21st, 2026 https://isc.sans.edu/podcastdetail/10062, (Fri, Aug 21st)

ISC SANS
Even MOAR Powershell, looking at Entra logins - the good, the bad and the password sprays, (Fri, Aug 21st)

Datadog HQ
Control trace volume with OpenTelemetry tail-based sampling

Semgrep
Hacker Summer Camp 2026: A Longitudinal Study of 2,295 Talks


2026-08-20

Socket
Socket Now Protects the Firefox Extension Ecosystem

Dark Reading
New CUSTODY Framework Constrains AI Agents Inside the Network

Dark Reading
What We Missed: Delta Flight Disrupted With Wi-Fi Hack

Amazon Security
AWS Network Firewall now supports rule hit count

Talos Intelligence
Is Cyber missing the Marque?

The Citizen Lab
‘Unprecedented’ Number of Apple Users Received Recent Spyware Alert

Schneier on Security
Detailed Timeline of OpenAI’s Cyberattack on Hugging Face

Dark Reading
N-able Bug Exposes Password Vault Master Keys

Dark Reading
Money and Mindset: The Two Biggest Roadblocks to Cyber Policing

Cloudflare
From all-or-nothing to task-based OAuth consent

Offensive Security
Who Secures AI When It Touches Every Security Team?

Wiz
Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Socket
Popular Rust Crates Compromised in Build-Time Supply Chain Attack

Dark Reading
Pakistan's Transparent Tribe Refreshes Toolset for Afghan Cyberattacks

Malwarebytes
ChatGPT for Teens tackles risky chats and homework shortcuts

Escape DAST
Horizon3.ai alternatives in 2026: Escape vs NodeZero and 4 more tools

GitGuardian
Machine-Speed Credential Abuse: What the ChainDrop npm Worm Changes

Dark Reading
'Grandoreiro' Malware Resurfaces With Mexico Campaign

Malwarebytes
Twitch wants your content for Amazon AI training. Here’s how to opt out

ISC SANS
Using Microsoft Graph and Powershell - Risk Detection Commands, (Thu, Aug 20th)

Ars Technica Security
Grok exfiltrates user data when malicious instructions are encrypted

Bishop Fox Security
CTEM 101: Moving From Spreadsheets to Continuous Risk Reduction

ISC SANS
Using Microsoft Graph and Powershell to Mine for Information - Stale Accounts and Licenses, (Thu, Aug 20th)

Malwarebytes
Your Mac already has a built-in firewall. Here’s how to get more from it 

CISA News
CISA Releases Foundational, Flexible Guidance to Help Federal Agencies Implement Effective Logging, Visibility and Operational Standards

CISA Alerts & Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA Alerts & Advisories
Johnson Controls Simplex Incident Manager

Malwarebytes
9 million images of people’s faces exposed by reverse lookup service

Aikido
Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack

Escape DAST
Introducing Escape's Channel Partners

Talos Intelligence
UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

Talos Intelligence
UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Schneier on Security
Police Are Hiding Their Use of Flock Surveillance Cameras

Joseph Thacker
Using Genius AI Models for Important Things: Cheating at NetHack

Aikido
AI pentesting evaluation checklist: What to look for in an AI pentesting vendor

Datadog HQ
Detect vulnerabilities in LLM applications with Datadog’s AI-native SAST

Semgrep
Rust crates arrayref & append-only-vec compromised via malicious proc-macro1 dependency

Datadog HQ
From signals to systemic risk: Building Risk AI

Auth0
Enterprise Readiness Is Not What You Support. It Is What Your Customers Can Own

Auth0
Enterprise-Managed Authorization for your MCP server: Setting Up and Testing XAA in Auth0


2026-08-19

Dark Reading
No-Filter 'Kriminal' AI Platform Raises Cybercrime Concerns

Dark Reading
Agentic AI Presents New Insider Threat Model for Orgs

Malwarebytes
41 deceptive download sites show a real link, then send you somewhere else

Socket
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft

Microsoft Security
Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026

Amazon Security
Propagate user authorization context in AI agents with Amazon Bedrock AgentCore

Dark Reading
SilkParasite Threatens Central Asian Orgs With Flurry of RATs

Rapid7
CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway

Cloudflare
A revisit of remote Spectre attacks on Cloudflare Workers

Wiz
Wiz Penetration Test Findings is now GA

Malwarebytes
Sideloading on Android: What it is, why it’s risky, and how to do it more safely

ReversingLabs
Why software delivery cannot depend on trust alone

ReversingLabs
Why shadow AI is far riskier than shadow IT

Escape DAST
Escape vs Pentera: how each one proves exploitability (2026)

Eclypsium
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why.

Aikido
Yet another RCE in Gogs, but it's fixed this time!

Rapid7
Rapid7 and Licencias OnLine Partner to Accelerate Cybersecurity Maturity across Latin America

CISA Alerts & Advisories
Defending Against an Active Threat to Siemens S7 Series PLCs

CISA Alerts & Advisories
CISA Adds One Known Exploited Vulnerability to Catalog

Malwarebytes
Scammers are using fake crypto AML checkers to drain your wallet

Schneier on Security
ICE Collecting DNA Samples

Escape DAST
Pentera Alternatives for Continuous Pentesting: 7 Competitors Compared In-Depth

Talos Intelligence
Describing attacks with crime script analysis