209 Security Blogs

Last Updated: 16 Aug 26 19:16 UTC

Blog List | Github | OPML

2026-08-16

Project Discovery
Supply Chain Security Analysis of a 9.5M-Install VS Code Extension

Step Security
ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2


2026-08-15

Step Security
Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List.

Project Black
AppFlowy Authenticated SQL Injection

Joshua Rogers
The sad, smelly, tasteless life of an influencer


2026-08-14

Rapid7
Metasploit Wrap Up: Lot of summer shells and fit http profiles

Schneier on Security
Friday Squid Blogging: Searching for the Colossal Squid

Aikido
Top enterprise SCA tools in 2026

Dark Reading
Mission-Driven Security: Inside a Global Bank's Defense

Ars Technica Security
Vulnerability giving attackers full control of Macs is under active exploitation

GitGuardian
Inside the LiteLLM hack: 153GB, 433,909 Files, 2,488 Organizations

Dark Reading
Amid AI-Driven Bug-Hunt Tsunami, NIST Looks to … AI

Aikido
Top enterprise DAST tools in 2026

Schneier on Security
Upcoming Speaking Engagements

Dark Reading
Scottish Govt Suffers Potentially Widening Data Breach at Prosecutor's Office

Aikido
Top unified security tools in 2026

SentinelOne
The Good, the Bad and the Ugly in Cybersecurity – Week 33

Wiz
Wiz on Wiz: How the Wiz FinOps Team Uses Wiz Cloud Cost

GitGuardian
BSides Las Vegas 2026: Following the Trust Relationships Attackers Are Targeting

Dark Reading
What Boards Need to Know About Tech Risk

Cloudflare
How Cloudflare detects MCP traffic and helps secure it

Cloudflare
Secure all your internal vibe-coded applications — in one click

Malwarebytes
Apple now uses iPhone alerts for targets of mercenary spyware

Wiz
Securing Data in the AI era

Dark Reading
Cyera's Oasis Security Buy Is All About AI Agent Control

MIT Technology Review
The Download: Flock’s new rules, cloning’s future, and children’s cells

Malwarebytes
WhatsApp is testing a new warning for scam messages

XBOW
Blackhat 2026: Hacking the Past. Hacking the Future.

Krebs on Security
Who’s Tracking You? Use This New Service to Find Out

Schneier on Security
If the Markets Reject OpenAI and Anthropic, the US Should Nationalize Them

MIT Technology Review
Cloning could be used to save species—or make human “organ sacks”

MIT Technology Review
This scientist is helping build a missing map of childhood

MIT Technology Review
Job titles of the future: Space travel agent

watchTowr Labs
You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

Resecurity
The LiteLLM Supply-Chain Attack — TeamPCP “SANDCLOCK” CI/CD Credential-Harvesting Campaign via a Backdoored Trivy GitHub Action

Moonlock
This ClickFix campaign shows fake software downloads to selected Mac users

Moonlock
Latest update patches a critical flaw in macOS Screen Sharing

Moonlock
Is AliExpress safe? Common scams, safety tips and buyer protection

ISC SANS
ISC Stormcast For Friday, August 14th, 2026 https://isc.sans.edu/podcastdetail/10052, (Fri, Aug 14th)

Datadog HQ
Data pipeline monitoring 101: Tracking health and performance across the data stack

Himanshu Anand
The Anti-India Influence Machine: Troll Farms, Fake News, Newsrooms, Algorithms and AI


2026-08-13

Escape DAST
AI vs AI: How Cascade exploited an AI agent in production

Eclypsium
When Patching Isn't Enough: What the Fairlife Ransomware Attack Says About Network Edge Risk

Amazon Security
AWS Certificate Manager will discontinue email validation to prove domain validation for certificates

MIT Technology Review
Roundtables: Inside the “Censorship-Industrial Complex” Idea Shaping US Policy

Dark Reading
Global Threat Campaign Hits Critical VMware vCenter Flaw

Cloudflare
Total eclipse of the Internet: traffic impacts in Iceland, Spain, and Portugal

Ars Technica Security
Private security firms will soon be allowed to hack overseas cybercriminals

Red Siege InfoSec Blog
Improving Your Simple Windows Domain for Offensive Testing: Sysmon

MIT Technology Review
Building a practical path to post-quantum cryptography

Talos Intelligence
Curiouser and Curiouser

Eclypsium
BTS #80 - Exploring BMC Vulnerabilities

GitGuardian
Your AI Agents Are Using Your Credentials

Socket
White House Authorizes Private Companies to Conduct Offensive Cyber Operations

Github Security Blog
What 50 open source projects taught us about security in the AI era

Mend
OWASP LLM Top 10 2026: the model will be fooled, the question is what breaks

Wiz
How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

Wiz
Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain

MIT Technology Review
Flock is tightening its rules in response to a growing surveillance backlash

ToxSec
AI Agents Are Starting to Find Their Own Way Out

Aikido
From Hugging Face to Fable: this summer shows AI control matters more than trust

Cloudflare
Certificate Transparency Monitoring is now generally available

MIT Technology Review
The Download: kids’ thoughts on AI, and female clones of male mice

CISA Alerts & Advisories
AVEVA Enterprise SCADA

CISA Alerts & Advisories
Siemens Simcenter Femap

CISA Alerts & Advisories
Siemens License Server (SLS)

CISA Alerts & Advisories
Siemens Desigo DXR and PXC Controllers

CISA Alerts & Advisories
Johnson Controls Inc. Airwall

CISA Alerts & Advisories
Johnson Controls Metasys

CISA Alerts & Advisories
Siemens Siveillance Video

CISA Alerts & Advisories
Flow Neuroscience FL-100

CISA Alerts & Advisories
Siemens LOGO! Soft Comfort

CISA Alerts & Advisories
ANDRITZ HIPASE-250 and 250 SCALA

CISA Alerts & Advisories
Siemens Solid Edge

CISA Alerts & Advisories
Siemens Parasolid

CISA Alerts & Advisories
Haiwell IoT Cloud HMI Gateway

CISA Alerts & Advisories
Hitachi Energy APM Edge Product

Malwarebytes
New Android malware lets criminals use your bank card in real time

Schneier on Security
Separating AI’s Technological Problems from Its Capitalism Problems

Talos Intelligence
Dissecting the JWR phishing framework

MIT Technology Review
What’s behind this summer’s heat, and why 2027 could be worse

Dark Reading
'Jewelbug' APT Balances State Espionage & Cryptocurrency Theft

Malwarebytes
Parents take on Meta, TikTok, Google, and Snap in 3,000 youth safety lawsuits

MIT Technology Review
How kids feel about AI, in their own words

Hunt and Hackett
On COM/WinRT initialization, apartments, and lpacCom capability bypasses, Part 1

Dark Reading
Belgium's eID Authentication Opens Citizen Accounts to RCE

TrustedSec
AI Offense is Not Noclip Mode

ISC SANS
ISC Stormcast For Thursday, August 13th, 2026 https://isc.sans.edu/podcastdetail/10050, (Thu, Aug 13th)

ISC SANS
Using Gemma4 with Ollama - Testing File Hash Analysis and Recommendations with AI, (Wed, Aug 12th)

Greynoise
GreyNoise Welcomes New SVP of Adversary Operations

Fastly
The Invisible Stadium


2026-08-12

Amazon Security
How AWS IAM role manager rethinks the starting point for IAM roles

Ars Technica Security
Terabytes of credentials leaked in massive supply-chain attack

Dark Reading
Long-running Data Theft Campaign Targeting Salesforce, ServiceNow

Dark Reading
Walmart Takes a 'Trusted Agent' Approach to Purple Teaming

Step Security
Control Which Package Registries Your CI Jobs and Developer Machines Use

Malwarebytes
“Zoomsday” flaws could let one Zoom participant attack another

ISC SANS
Linux Kernel Process Accounting, (Wed, Aug 12th)

Dark Reading
Ransomware Hits Colombian Justice Ministry Days Before Presidential Transition

Malwarebytes
Patch Tuesday: Update now to fix 421 flaws, including three zero-days

Ars Technica Security
Researchers found a way to hijack devices through Zoom screen sharing

Aikido
Finding vulnerabilities at every stage: what to run, and when

Binarly
Can AI Hack Firmware? Evaluating LLMs on UEFI Vulnerability Discovery

Meta Security
How We’re Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees

Rapid7
AI is Working in the SOC. So Why are Security Executives More Worried Than Ever?

Dark Reading
Walmart Leaders Transform Security Operations Without Going Bananas

XBOW
Engineering the Impossible: Adding Safety to Autonomous Agents

CISA Alerts & Advisories
Siemens RUGGEDCOM APE1808

CISA News
CISA Unveils New Cybersecurity Resources for K-12 Schools and Districts

Schneier on Security
Prompt Injections for Defense

Escape DAST
Authenticated scanning behind OAuth, MFA, and CAPTCHA

Troy Hunt
Weekly Update 516: Live From Vietnam

Escape DAST
Continuous penetration testing: what it means when the testing never stops

Snyk
The Agent Baseline: 35 Controls, But Where Should You Start?

ISC SANS
ISC Stormcast For Wednesday, August 12th, 2026 https://isc.sans.edu/podcastdetail/10048, (Wed, Aug 12th)

Ars Technica Security
DEF CON crowd suspected in fake-hotspot attack on Delta flight

Fastly
Terraform Your Fastly Config in a few Commands

Teleport Blog
Navigating SAMA, ADGM & DFSA Requirements with Teleport

Auth0
Building Secure AI Agents with Microsoft Agent Framework and Auth0: RAG Filtering

Rosecurify
Seclog - #190

Datadog HQ
Avoid Azure secret rotation with secretless authentication


2026-08-11

Socket
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection

Talos Intelligence
Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities

Amazon Security
Landing Zone Accelerator Independent Assessment Report for C5:2020 now available on AWS Artifact

Dark Reading
Microsoft's Patch Tuesday Deluge Continues With August Updates

Krebs on Security
Microsoft Plugs Nearly 400 Security Holes

Dark Reading
Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA

Rapid7
Patch Tuesday - August 2026

Ars Technica Security
Chrome adopts what may be the best protection yet against account takeovers

Malwarebytes
Fake CCleaner installs GhostDesk Chrome spyware 

Amazon Security
Summer 2026 SOC 1 report is now available with 185 services in scope

Zero Day Initiative
The August 2026 Security Update Review

ISC SANS
Microsoft Patch Tuesday August 2026, (Tue, Aug 11th)

Trail of Bits
How Trail of Bits helps verify the integrity of your Signal chats

Malwarebytes
Valve warns Steam hardware buyers: Expect fake delivery scams

Amazon Security
AWS successfully completed its 2025-26 NHS DSPT assessment

Malwarebytes
Social media platforms crack down on drone factory recruiting game

Schneier on Security
AI Genie in the Wild

Jericho
Meta – The No Child Left Behind of LLMs?

GitGuardian
Vault Coverage Is the Missing Metric in NHI Programs

Scott Helme
Device Bound Session Credentials lands in Chrome on macOS

Malwarebytes
Sexual predators targeting online accounts for intimate images, FBI warns

Ars Technica Security
New surveillance tech links your phone to your license plate

Cloudflare
Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave

Rapid7
Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)

Rapid7
CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

Malwarebytes
Love/hate relationship: The AI affair. Young people love AI, but it’s breaking their trust  

CISA Alerts & Advisories
Johnson Controls C-CURE 9000 and Victor application server (Update A)

XBOW
Threat Hunting with AI: Why it Matters and the Role of Autonomous Pentesting Tools

CISA Alerts & Advisories
CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA Alerts & Advisories
Pulsetto Vagus Nerve Stimulator

CISA Blog
Cyber Storm X: 20 Years of Readiness, Resilience, and Real‑World Impact

CISA Alerts & Advisories
Mira Hormone Monitor, Mira Android App

Ars Technica Security
New Pass-ta-key attack reveals all the things we didn't know about passkeys

Schneier on Security
AI for Military Support

Malwarebytes
Watch out for fake TikTok Shops trying to steal your money

Malwarebytes
Fake popular sites offer a free app, instead take over PCs

Bishop Fox Security
Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898

TrustedSec
A Vault With No Treasure - CMMC Level 2 Compliance for Subcontractors With No CUI

ISC SANS
ISC Stormcast For Tuesday, August 11th, 2026 https://isc.sans.edu/podcastdetail/10046, (Tue, Aug 11th)

Joshua Rogers
4 jsoup vulnerabilities

Datadog HQ
How we improved APM Java startup by encoding a prefix trie as a JVM constant

Elastic Security Labs
13 million tool calls: auditing every AI coding agent action with Elastic Agent

Auth0
Intent, Not Just Permissions: Rethinking Authorization for AI Agents

Datadog HQ
Investigate account-level churn risk with Product Analytics account segments

Sansec Threat Research
Adobe patches critical Magento account takeover (APSB26-92)


2026-08-10

Dark Reading
'GhostJacking' Exposes Identity Governance Gaps in AI Agents

Dark Reading
Multistate Water System Attacks Widen, Iran Suspected

Dark Reading
Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius

Amazon Security
AWS completes the 2026 Police-Assured Secure Facilities (PASF) audit in Europe (London)

Mozilla Security
Updated GPG key for signing Firefox and Thunderbird Releases

Cloudflare
Everything we launched during Agents Week

Dark Reading
The Patch Gap: Why Defenders Need to Think in Chains, Not Checklists

Malwarebytes
How to fake a data trail (and maybe lower prices) (Lock and Code S07E16)

Dark Reading
Coruna, DarkSword iOS Exploits Proliferate Globally

Amazon Security
2026 AWS CyberVadis report now available for due diligence on third-party suppliers

Dark Reading
Outdated Cybercrime Laws Put Security Researchers at Risk

ISC SANS
Scans for Solana (Surfpool?) Endpoints, (Mon, Aug 10th)

Scott Helme
Everything I Learned Shipping Device Bound Session Credentials

Microsoft Security
Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise

Include Security
Web App Pentesting in the AI Era

Dark Reading
Sherlock Holmes Was the 'OG' Social Engineer

Malwarebytes
New turnkey kit makes it easy for anyone to become a scammer

Jericho
A Word on Microsoft and Vulnerability Exploitation

Microsoft Security
DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

Ars Technica Security
A researcher bought noreply.net. Companies started sending him secrets.

Include Security
Hiring – Principal Security Consultant

Cloudflare
Serving the most critical missions: Cloudflare for Government achieves FedRAMP Class D (High) Certified status

Malwarebytes
Edge is dropping older extensions, affecting popular privacy tools

Wiz
Inside the Metabase SQLi: Exploited in the Wild

CISA Alerts & Advisories
#StopRansomware: Gunra Ransomware

CISA News
CISA, FBI and Partners Warn Organizations of Gunra Ransomware Actors Targeting Multiple Critical Infrastructure Sectors

Schneier on Security
Python Now Has a Post-Quantum Encryption Library

Malwarebytes
A week in security (August 3 – August 9)

Resecurity
Metabase Zero-Day Exploited in the Wild: Unauthenticated SQL Injection Leading to Full Admin Access

ISC SANS
ISC Stormcast For Monday, August 10th, 2026 https://isc.sans.edu/podcastdetail/10044, (Mon, Aug 10th)

Auth0
Embed Account Security Management in Your Android App with Auth0 Universal Native Components

Snyk
Show, Don't Tell: What Evo Continuous Offensive Security Found in a Real Enterprise SaaS

Teleport Blog
How Two Small Bugs Led to a Critical Vulnerability and a Cryptography Audit of Go’s SSH Library

Himanshu Anand
I found a KVM guest-to-host heap corruption bug and someone else got there first

Datadog HQ
Understanding unfixed Kubernetes CVEs: What you can and can’t detect

Datadog HQ
Instrument serverless apps with agentic onboarding