Humans in the loop miss a third of dangerous AI coding agent requests
You wouldn't let Claude Code cat your AWS credentials or Kubernetes config on request, would you?
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
IPB205: Moving to Disable IPv4
Franck Martin returns to the show to discuss the practical challenges of retiring IPv4 with hosts Ed, Nick, and Tom. Together they break down key strategies, how to work effectivel…
New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs
An unprivileged Linux program can time a hardware interrupt to land in the gap between a processor sanitizing its branch predictor and the kernel using it, re-poisoning the predict…
Meta AI model hacked a company during misconfigured cyber test
Meta has become the latest AI company to confirm that one of its models hacked a real organization during cybersecurity testing, as similar incidents continue to emerge following O…
N4N061: Your First Wi-Fi Network Part 2
This week, Ethan and Holly continue their conversation around Wi-Fi. They go deeper into the benefits of Wi-Fi 7, look at what’s coming in Wi-Fi 8, and cover the differences among …
ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories
Apparently, opening the thing is now enough. A repo can run before the first prompt, a package can hide among hundreds, and a harmless-looking PDF can finish the job. This week ru…
Next step for LINK spacecraft – a software update that won't make things worse. Are you listening, Microsoft?
Spin slows as orbital rescue mission creeps forward
Platform Engineering 2.0: your platform was built for a different era. AI just exposed it
PARTNER CONTENT: Platform engineering won the argument. Now it has to grow up fast and evolve for the AI era
Snowflake Hacker Pleads Guilty in US Court
Connor Riley Moucka was extradited to the United States in July 2025 after he was arrested in Canada. The post Snowflake Hacker Pleads Guilty in US Court appeared first on Securit…
Microsoft excludes Domain Exclusion from MS 365 Copilot – days after rolling it out
Perhaps an allow list of domains might be better?
How AI Exposed a Browser Security Gap that Enterprises Cannot Ignore
AI did not create a new browser security problem. It exposed one that enterprises have long been able to ignore. Skyhigh Security explains why browsers have become a critical contr…
Snowflake extortionist admits 165-victim cloud crime spree – and squeezing one target twice
Connor Moucka pleads guilty over sprawling 2024 campaign that looted billions of records
Blue Origin blames New Glenn fireball on engine oxygen valve
Small modifications under way as Bezos's rocket biz races to rebuild pad and fly again this year
Zero-Click AI Browser Hacking: Claude and ChatGPT Atlas Hijacked via Emails, X Posts
Zenity researchers reported the findings to Anthropic and OpenAI in late 2025 and early 2026, but they remain unpatched. The post Zero-Click AI Browser Hacking: Claude and ChatGPT …
European firms afraid of US tech kill switch but haven't made an escape plan
Nearly three-quarters worry Washington could cut access, yet fewer than half regularly test their fallback
Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities
Forescout found 22 internet-facing Rockwell Automation programmable logic controllers (PLCs) in cities hit by recent cyberattacks on US water utilities. Nineteen used the same mobi…
IT department put sticky notes on the laptops to help employees log in
Leaving this information exposed allowed someone else to gain access
Podcast: Compliance Won’t Save You: The Future of Cyber Risk with Edna Conway
(Video) In this podcast, we share insights from Edna Conway, a recognized leader in cybersecurity and supply chain resilience with over 40 years of experience in the field. The po…
CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps
Coinspect has identified CryptoJS.lib.WordArray.random() as the weak random number generator behind the Ill Bloom wallet drains. Introduced in the JavaScript cryptography library …
Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses
Cybersecurity researchers have disclosed a security issue with Apple's iCloud Private Relay tool that can expose a user's real IP address. Introduced with iOS 15, iCloud Private R…
AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory
A new class of prompt injection is spreading across commercial websites. It requires no malware, no stolen credentials, and no zero-day exploit. It abuses a standard feature built …
AWS targets AI cost concerns with new Marketplace Insights tool
AWS has added AI Insights to AWS Marketplace, a feature that it says is designed to help CIOs and developers better evaluate and compare products using AI-generated summaries and r…
Critical Paperclip Flaw Allowed Admin Access, Code Execution
An attacker could self-register, sign in for board-level API access, and import a new company for code execution. The post Critical Paperclip Flaw Allowed Admin Access, Code Execut…
Adversarial Clothing Designed to Fool Facial Recognition Systems
There are many companies manufacturing adversarial clothing designed to confuse facial recognition systems. It’s a cool idea, but I worry that it’s mostly security theater: “Our p…
Windows 10 LTSC 2021 has five months before security updates cost extra
ESU meter starts running in January, unless you're on the IoT edition
Meta latest to tell world its AI agent wandered out of test pen
Another week, another firm explaining why one of its models reached somewhere it wasn't supposed to
Meta AI Hacked External Systems During Cybersecurity Testing
The incident involved a testing environment set up by Irregular, similar to what Anthropic reported last week. The post Meta AI Hacked External Systems During Cybersecurity Testing…
Belarusian Ransom Cartel Mastermind Gets 16 Years in Prison
Maksim Silnikau was the creator and administrator of the ransomware group and involved in Angler EK’s distribution. The post Belarusian Ransom Cartel Mastermind Gets 16 Years in Pr…
News Corp labels some AI companies 'crass kleptomaniacs'
Pay it for content, like OpenAI and Meta, to become 'principled' and 'honorable'
Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing a…