Iran says it's struck offline AWS facility in Bahrain ... again
AWS' me-south-1 region has been offline for months, so more like beating a dead cloud
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
HS138: When “One Cloud To Rule Them All” Is NOT the Answer: Repatriation for AI and more
Some enterprises are finding reasons to pull back from a cloud-first IT strategy and run workloads in on-premises data centers. John and Johna dig into why companies are making the…
Trump Orders Defense Contractors to Map Software, Suppliers Across Critical Supply Chains
New executive order calls for end-to-end visibility into defense supply chains, including software dependencies, foreign ownership and cyber-related supplier risks. The post Trump …
Cisco Launches Low-Cost AI Models for Source Code Security
The open-weight Antares models are designed to pinpoint known vulnerabilities in codebases faster and at a fraction of the cost of larger AI models. The post Cisco Launches Low-Cos…
Oracle faces $100M annual bill to back Wisconsin datacenter power promises
Regulator refuses to budge on $7B guarantee for nearly 1 GW campus being developed with Vantage and OpenAI
Critical wp2shell WordPress flaws exploited to install webshells
Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious…
PP118: IPv6 Risks In Dual-Stack Environments (i.e. Most Environments)
Unless you’ve intentionally migrated to all-IPv6, you’re operating in a dual-stack environment. And if you haven’t accounted for v6 in your monitoring and security, you leave yours…
Kratos phishing-as-a-service kit loses its battle with international law enforcement
Alleged developer arrested in Indonesia after more than 200 servers slain
AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code
Hidden text on a web page was enough to make Kiro, AWS's agentic coding IDE, rewrite its own configuration file and run an attacker's code on a developer's machine, with no approva…
Apple Fixes Hide My Email Vulnerability After 404 Media Coverage
Article URL: https://www.404media.co/apple-fixes-hide-my-email-vulnerability-after-404-media-coverage/ Comments URL: https://news.ycombinator.com/item?id=48993637 Points: 134 # Com…
Google Launches Gemini 3.5 Flash Cyber AI to Find and Fix Software Vulnerabilities
Google's DeepMind on Tuesday announced the release of Gemini 3.5 Flash Cyber, a specialized artificial intelligence (AI) model built atop 3.5 Flash that's designed to discover, val…
Nvidia shows off Vera Rubin platform for tokenmaxxing
If your AI Factory sells tokens, why not optimize token emission?
Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr. The vulnerability in quest…
Windows 11 Start menu changes trickle into Beta, movable taskbar still MIA
Users asked for flexibility, but a leaner OS for older PCs might matter more as hardware prices soar
Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access
Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim …
Closing the Identity Gaps in Critical Infrastructure Security
Critical infrastructure attacks often begin with stolen credentials, compromised devices, or trusted accounts. Specops Software explains why Zero Trust should verify both user iden…
AI music platform Suno hits bum note as 55M users exposed in data breach, claims infosec expert
Have I Been Pwned confirms scale for first time
Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities
Zimbra has rolled out fixes to address multiple critical security issues, including a command injection flaw in the Simple Network Management Protocol (SNMP) monitoring component. …
Choose Wisely: AI-Generated Coding Risk Varies, a Lot
AI-generated code introduces 15 vulnerabilities on average per codebase, but the actual risk depends on framework pairing more than the model used.
Intel fortifies Foundry with an actual customer: Fortinet
Firewall maker looks to safeguard its custom ASIC production with homegrown silicon
Empirical Security Raises $25 Million in Series A Funding
The startup will use the investment to accelerate the development of its threat prediction and discovery products. The post Empirical Security Raises $25 Million in Series A Fundin…
LG monitors are using Windows 11 feature to serve adware
Plug in your new display and get a McAfee pitch you never asked for
SecurityWeek Launches Critical Impact Awards to Recognize Excellence in Industrial Cybersecurity
Independently judged and sponsor-neutral, the new awards program honors the people, organizations, and technologies delivering proven impact in industrial cybersecurity; winners to…
UK.gov's tech department gets the chop after two years
RIP DSIT: Digital transformation duties shuffle off to reborn DCMS, with GDS along for the ride
Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs
An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more s…
New HollowGraph Malware Abuses Microsoft 365 Calendar for C&C Communication
Part of a larger toolkit, HollowGraph uses a compromised 365 account’s calendar as a two-way dead-drop. The post New HollowGraph Malware Abuses Microsoft 365 Calendar for C&C Commu…
N-day is Becoming N-Hour. Patching Faster Won't Save You.
Every patch is a confession. The moment a vendor ships a security fix, the diff between the old code and the new code tells anyone watching exactly what was broken and where. Turn…
Valve's Steam Frame pushes Arch Linux toward official Arm64 support
Collabora's Holo Core port lays the groundwork for running SteamOS 3 natively on the headset
CISO Conversations: Andreas Gaetje – From Economics to CISO at Körber AG
Gaetje’s story shows that you don’t need to be a ‘deep bit-crawler’ to become a Chief Information Security Officer. The post CISO Conversations: Andreas Gaetje – From Economics to …
New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit
A cloud tenant using nothing but ordinary GPU access can push a data center's power draw up and down fast enough to threaten the grid it runs on, with no exploit and no break-in. …