202 Security Blogs

Last Updated: 13 Jul 26 16:01 UTC

Blog List | Github | OPML

2026-07-13

Ars Technica Security
Now, defenders are embracing the prompt injection, too

Krebs on Security
Lessons Learned from CISA’s Recent GitHub Leak

Malwarebytes
Trusting your kids online isn’t enough (Lock and Code S07E14)

Amazon Security
New compliance guidance available: HITRUST i1 on AWS

Malwarebytes
Ghostcommit attack hides malicious AI instructions in images

Cloudflare
Introducing Precursor: detecting agentic behavior with continuous client-side signals

Dark Reading
Turning the Tables on Email Scammers With 'ScamBuster'

Wiz
Why IaC Coverage Belongs on Your Security Dashboard

MIT Technology Review
The Download: a donor conception cap and world models for AI

Malwarebytes
Fake crypto gift card sites are getting harder to spot

Schneier on Security
AI Data Centers and the Concentration of Wealth

Trail of Bits
Rust-proof your code with our new Testing Handbook chapter

Malwarebytes
A week in security (July 6 – July 12)

ISC SANS
Someone Is Scanning for Your MCP Servers and AI Assistant Credentials, (Mon, Jul 13th)

Moonlock
12 Discord scams that can steal your account or money

ISC SANS
ISC Stormcast For Monday, July 13th, 2026 https://isc.sans.edu/podcastdetail/10004, (Mon, Jul 13th)

Aikido
How to maintain code quality standards with AI code and vibe coding

Auth0
Closing the Audit Gap in Human-to-Agent Delegation

Fastly
Optimizing Compute for Agentic Systems With New Request Handoff Functionality

Rosecurify
Seclog - #186


2026-07-12

GitGuardian
What CISA Got Right After Its GitHub Leak: Lessons Every Organization Should Copy

Step Security
jscrambler npm package publishes malicious preinstall binary

MaskRay's Blog
Irreducible loops

Yunus Aydın
ModHeader: Browsing Geçmişinizi api.stanfordstudies.com’a Sızdıran Chrome Eklentisi

Yunus Aydın
ModHeader: Covert Data Exfiltration to api.stanfordstudies.com


2026-07-11

Socket
jscrambler npm Package Compromised in Supply Chain Attack

Ali Yazdani
LLMs in SAST: Good, Bad, Costly

ISC SANS
Wireshark 4.6.7 Released, (Sat, Jul 11th)

Rapid7
Weekly Metasploit Update: Exploits for FlowiseAI CSV Agent and MacOS Package Kit

zerotistic
When Linux and Your Decompiler Load Different Programs


2026-07-10

Schneier on Security
Friday Squid Blogging: “Squidbleed” Vulnerability

Praetorian
Bluetooth Low Energy Security Testing, Consolidated: Introducing Caeruleus

Moonlock
A verified X account is spreading the Atomic macOS stealer

Dark Reading
Jen Ellis: Connecting Cyber Community With Political Machinery

Moonlock
A vulnerability in Apple’s Hide My Email feature can expose your real email address

Dark Reading
Cybercriminals Flock to Healthcare Businesses as Attacks Surge

SentinelOne
The Good, the Bad and the Ugly in Cybersecurity – Week 28

Amazon Security
AWS designated as a critical third party to the UK financial sector

Microsoft Security
Securing our future: July 2026 progress report on Microsoft’s Secure Future Initiative

Searchlight Cyber
How Attack Surface Management Powers Preemptive Threat Exposure Management

ISC SANS
My Stack Simulator, (Wed, Jul 8th)

Dark Reading
Fresh ATM Crypto Software Bugs: Jackpot or Bust?

Zero Day Initiative
CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys

Dark Reading
More Countries Jump on the Social Media 'Ban Wagon'

ToxSec
The Lethal Trifecta Broke Three Agents in 2026

Malwarebytes
This new Windows malware can take over your PC and wipe it clean

Dark Reading
AI Coding: Do Security Risks Outweigh Productivity Gains?

Cloudflare
Improving Smart Tiered Cache for Public Cloud Regions

MIT Technology Review
The Download: Claude’s inner workings and OpenAI’s “super app”

CISA Alerts & Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog

Malwarebytes
How mule betting scams recruit ordinary people

Schneier on Security
AI Surveillance and Social Progress

Malwarebytes
Two Chrome updates in two days fix critical vulnerabilities

ISC SANS
"Comment stuffing" in an HTML phishing attachment as a mechanism for evading AI-based detection?, (Fri, Jul 10th)

MIT Technology Review
Sperm donors need limits, says a European fertility group

DarkRelay
CVSS vs EPSS Scoring: A Practical Guide to Vulnerability Prioritization

ISC SANS
ISC Stormcast For Friday, July 10th, 2026 https://isc.sans.edu/podcastdetail/10002, (Fri, Jul 10th)

Moonlock
Is WhatsApp safe? Here’s our expert opinion on WhatsApp security

Datadog HQ
Making agentic token costs visible in production


2026-07-09

Amazon Security
Introducing OAuth Support for AWS MCP Server

Mend
Dependency management tools: Key features and 6 tools to know in 2026

Ars Technica Security
Patch for Windows Defender 0-day could allow attackers to fill hard disk

Dark Reading
Iran's Cyber Crosshairs Focus Beyond Critical Infrastructure

MIT Technology Review
Anthropic found a hidden space where Claude puzzles over concepts

Dark Reading
Microsoft Reins in RoguePlanet Zero-Day Threat

Socket
Fake Braintree NuGet Package Skims Credit Cards and Harvests Merchant Credentials

Dark Reading
AI Agents Are a New Kind of Identity — and Most Organizations Aren't Ready

Talos Intelligence
WolfSSL, GeoVision, VTK vulnerabilities

Talos Intelligence
Winning 54% of the time

Step Security
Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys

Github Security Blog
How GitHub gave every repository a durable owner

Moonlock
How to get rid of a fake Apple security alert and why you’re seeing it

Wiz
How ProdSec uses Wiz

Wiz
Wiz in the Verizon DBIR: How AI Acceleration and Cloud Sprawl Impact Modern Defense

Aikido
Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry

Jericho
Random Movie/TV Thoughts and Reviews (July 2026)

Malwarebytes
How World Cup crypto prediction sites take your money

Malwarebytes
6.9 million driver’s license numbers stolen from AssuranceAmerica

GitGuardian
GitGuardian Power for Amazon Kiro: Secrets Detection Built Into the Agent

Microsoft Security
GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Dark Reading
As Global Conflicts Go Digital, Businesses Need Wartime Game Plans

Cloudflare
Why we cannot wait for better post-quantum signature algorithms

Hybrid Analysis Blog
Suspected Russian Threat Actor Impersonates Legitimate Crypto Wallets to Deploy Remote Utilities

Socket
Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics

Dark Reading
AI Gateways Offer Attackers the Keys to the Kingdom

Eclypsium
The Two BIOS Passwords Everyone Confuses

MIT Technology Review
The Download: a nuclear landmark, and China eyes Nvidia chips

CISA Blog
Lessons from CISA’s Cyber Incident

CISA Alerts & Advisories
Schneider Electric PowerChute Serial Shutdown

CISA Alerts & Advisories
Schneider Electric Easergy MiCOM Px40 Series

CISA Alerts & Advisories
OpenPLC v3

Malwarebytes
Microsoft fixes RoguePlanet zero-day in Defender

Moonlock
Is my iPhone listening to me? Here’s how to make it stop

Schneier on Security
The Language of AI Could Change How Humans Speak

Dark Reading
'GodDamn' Ransomware Uses BYOVD to Smite US Companies

Aikido
AI Pentesting Buyer's Guide: How to evaluate AI pentesting vendors

Malwarebytes
Turn off this Meta setting before someone generates AI images of you

Sicuranext Blog
Why the HTTP QUERY Method Is a Good Idea but Accept-Query Is Not

Sicuranext Blog
Why the HTTP QUERY Method Is a Good Idea but Accept-Query Is Not

Dark Reading
European Organizations Have a Collaboration Security Confidence Gap

MIT Technology Review
Four nuclear reactors hit a big milestone in the US

Hunt and Hackett
Reporting cyber security incidents starts with understanding what happened

TrustedSec
Vulnify: Giving Your Agents a CVE Brain

ISC SANS
ISC Stormcast For Thursday, July 9th, 2026 https://isc.sans.edu/podcastdetail/10000, (Thu, Jul 9th)

ISC SANS
_HELP_ME_ESCAPE_FROM_BELARUS_PLEASE_ [Guest Diary], (Tue, Jul 7th)

Fastly
How to protect your MCP Server with Fastly

mez0 Blog
Vulnify: Giving Your Agents a CVE Brain

Snyk
Symlinks Are Still Scary (And Yes, You Can Commit Them to Git)

Auth0
Delegation Is a Form of Respect. Here Is What That Actually Means


2026-07-08

Socket
npm v12 Ships With Install Scripts Off by Default, Begins Deprecating 2FA-Bypass Tokens

Dark Reading
Mexico's New Cyber Plan Faces Its First Real Test

Dark Reading
Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours

Socket
Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories

Mend
The ECB just gave banks four months to fix AI vulnerability gaps. Most of the work starts in the software supply chain.

Step Security
Introducing Secret Exfiltration Protection for GitHub Actions

Ars Technica Security
Google pays $250K for Linux vulnerability allowing guest VM escapes

Amazon Security
Designing for the inevitable: System prompt leakage and mitigations in generative AI applications

Moonlock
Is your TikTok account hacked? Here are the telltale signs and steps to recover it

Moonlock
How to spot an Amazon scam and protect yourself from one

Microsoft Security
Protecting Microsoft at AI speed: How SFI proactively hardens our cloud

Dark Reading
Vidar Infostealer Hammers SMBs via Malvertising Campaign

MIT Technology Review
EmTech AI 2026: The Rise of the AI Platform

SentinelOne
HPC AI Workloads Need Runtime Security. The Architecture Already Exists.

Scott Helme
Connection Allowlist: a network firewall, built into the browser

The Citizen Lab
AI Surveillance Is Being Supercharged–And It Will Chill Social Progress

Moonlock
What is whaling, or whale phishing? Here’s how whaling attacks work

Black Lantern Security
BBOT 3.0

Amazon Security
The CISO’s guide to post-quantum mandates and migrations

Black Hills Info Sec
Finding the “Goldilocks” Zone: A Practical Approach to Alert Triage

Wiz
GhostApproval: A Trust Boundary Gap in AI Coding Assistants

Troy Hunt
Weekly Update 511: Live from my Riad in Marrakech

Rapid7
Security Teams Are Ready To Become More Preemptive. What’s Holding Them Back?

Cloudflare
Introducing Meerkat: an experiment in global consensus

Bishop Fox Security
Cracking Firmware with Claude: Senior-Level Skill, Junior-Level Autonomy

Krebs on Security
Felons, Fraudsters Flog Offensive Cybersecurity Startup

Wiz
Wiz ASM for any environment, any risk, everywhere

Malwarebytes
Your next car could be watching your face

MIT Technology Review
The Download: worms fight pollution, and geoengineering faces reality

Sicuranext Blog
Protect Your WordPress Using Claude Code and Karna

Sicuranext Blog
Protect Your WordPress Using Claude Code and Karna

Searchlight Cyber
July 7th – This Week’s Top Cybersecurity and Dark Web Stories

Schneier on Security
Cybersecurity and the Gap Between Skill and Ability

Trail of Bits
Mutation testing comes to DAML

Escape DAST
Product Updates: Quick fix issues by prompting your agents and follow a live tree of agents in your pentest

Dark Reading
State IDs for AI Agents: Will Estonia Set a Precedent?

Ars Technica Security
Hackers can use 9 of the most popular AI tools to assemble massive botnets

Socket
pnpm 11.10 Hardens Registry Authentication to Block Token Redirection

DarkRelay
Nmap for Pentester: Host Discovery Guide

Arch Cloud Labs
Kexec & Btrfs Subvolumes for Kernel Testing

ISC SANS
ISC Stormcast For Wednesday, July 8th, 2026 https://isc.sans.edu/podcastdetail/9998, (Wed, Jul 8th)

Elastic Security Labs
ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

Hacktron
GLM and DeepSeek Are Catching Frontier Models at Finding Vulnerabilities

Fastly
Fastly Joins DIMPACT to Collaborate on Digital Sustainability

Teleport Blog
When AI Agents Call AWS, Who Does AWS Think They Are?

zerotistic
Redis 8.6: Remote Code Execution via Stream PEL Use After Free

Datadog HQ
Monitor your .NET MAUI apps with Datadog RUM

Datadog HQ
Protect AWS Strands Agents with Datadog AI Guard

Auth0
How to Pick the Right Auth0 Customization for Your App


2026-07-07

Palo Alto Networks
What It Takes to Secure Claude Cowork Across the AI Enterprise

Step Security
GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps

Dark Reading
Big Brand Jobs Scam Targets Marketing Pros' Google Accounts

Dark Reading
Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft

Aikido
Top Burp Suite alternatives for web application security testing

Amazon Security
Enforce zero data retention on Amazon Bedrock with Bedrock Projects and service control policies

Socket
Coordinated npm and PyPI Campaign Typosquats Popular Secure Payment Apps

ISC SANS
More Odd DNS Records: NIMLOC, (Tue, Jul 7th)

Malwarebytes
How the Reddit and Discord false report scam steals accounts

Dark Reading
'GitLost' Flaw Leaks Private Data From GitHub's Agentic Workflows

Jericho
CISA KEV’s Revolving Door

GitGuardian
Every Laptop Is a Credential Store: Where Secrets Hide

Xint
How to Safely Implement Autonomous AI Agents for Pentesting Live Apps

Mend
Best AI Governance Platforms for Enterprises: Top 6 in 2026

Malwarebytes
Fake Netflix, Coca-Cola, and FIFA job scams target marketers

Red Siege InfoSec Blog
Improving Your Simple Windows Domain for Offensive Testing: Elastic Defend EDR

ToxSec
Cisco’s Agent Runtime SDK Bakes Security Into the Build

Eclypsium
Post-Mythos Cybersecurity: Can You Automate Infrastructure Assurance with AI?

Cloudflare
Cloudflare proudly joins the UK government's Cyber Resilience Pledge

Aikido
Top Chainguard alternatives 2026

MIT Technology Review
The Download: your stake in OpenAI, and the Treasury’s AI warning

CISA Alerts & Advisories
CISA Adds One Known Exploited Vulnerability to Catalog

CISA Alerts & Advisories
Labcenter Proteus 9

CISA Alerts & Advisories
Siemens SINEC OS

CISA Alerts & Advisories
Hitachi Energy PROMOD V

CISA Alerts & Advisories
Hydro-Québec Le Circuit Electrique charging station backend

CISA Alerts & Advisories
Hitachi Energy e-mesh EMS

CISA Alerts & Advisories
Siemens Mendix Studio Pro

CISA Alerts & Advisories
Digi International PortServer TS, Digi One SP IA

CISA Alerts & Advisories
CISA Adds Three Known Exploited Vulnerabilities to Catalog

Malwarebytes
Claude Code’s hidden tracker was an “experiment,” says Anthropic

MIT Technology Review
The foundational elements of AI architecture that IT leaders need to scale

Schneier on Security
Google Is Suing Chinese Scammers Who Are Using Gemini

Talos Intelligence
UAT-7810 continues building ORB networks using new malware

Escape DAST
Introducing Escape's Partner Program

Malwarebytes
Scammers are using AI to sell impossible flowers

NVISO Labs
Reducing Microsoft Sentinel Costs Without Compromising Detection – Part 2: The Firewall Quest

Compass Security Blog
Cyber Resilience Act – Part II

Resecurity
Artificial Intelligence Safety Law: Landmark Industry Regulation Bill

TrustedSec
Welcoming ObfusGit

Teleport Blog
Kubernetes for Agentic AI: Best Practices for Identity and Access

Rosecurify
Seclog - #185

Nebula Security
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years

Datadog HQ
DASH 2026 recap: Product news, sessions, and highlights

Fastly
Fastly recognized as a Gartner® Peer Insights™ Customers' Choice for Edge Distribution Platforms

Auth0
Adding Auth0 to Hono on Cloudflare Workers: A Practical Guide


2026-07-06

Dark Reading
'BusySnake' Infostealer Slithers Into Critical Infrastructure Networks

Dark Reading
CitrixBleed-ing Again? NetScaler Vulnerability Under Attack

Praetorian
FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 2 of 2)

White Knight Labs
Introduction to Tokenizers in LLMs

Aikido
Predicting MongoDB ObjectId() continuously in Rocket.Chat

Amazon Security
Enforce least-privilege authorization in multi-agent AI chains using Cedar

Dark Reading
JadePuffer: The First Complete LLM-Driven Ransomware Attack

Malwarebytes
How to tell if an image is AI-generated