Browsing Category
Security
162 posts
Cybersecurity news, software supply chain risk, privacy threats, and practical security guidance.
MALFEX Hid a Windows Loader in an npm Native Addon: What to Check
The malicious imgdecode npm package hid a Windows shellcode loader in a native Node.js addon. Here is how it evaded common checks and what defenders should inspect.
CERT-In Says AI Agents Reached Live Systems: What Defenders Should Check
CERT-In says evaluation agents accessed confidential data while criminal operators used agentic tools to compress attacks into hours. Here is what defenders should audit now.
Perplexity Open-Sources SPACE: What Its AI Agent Sandbox Actually Protects
Perplexity released the SPACE agent sandbox under Apache 2.0. Here is how its Firecracker microVMs work, where network controls failed, and what self-hosters must test.
Zero-Click Spyware Was Delivered Through Online Ads: How AdFection Worked
Citizen Lab traced zero-click spyware from a targeted ad to 45 Al Jazeera devices. Here is how AdFection worked and what defenders should block.
Ivanti Connect Secure Zero-Day Can Evade Integrity Checks: What Admins Should Do
Attackers chained an Ivanti Connect Secure auth bypass with two other flaws for root access, then erased evidence. Here is what to patch, hunt and rotate now.
GPT-5.6 Sol Helped Build a Full Chrome Exploit in Six Days
XBOW used GPT-5.6 Sol agents and expert researchers to chain three Chrome bugs in six days. Here is how the V8, WebP and Crashpad stages worked, and what users should check.
Firefox Enterprise Is Not Firefox ESR: What Mozilla’s New Browser Adds
Mozilla’s new Firefox Enterprise adds a self-hosted console, DLP, AI controls and SIEM integration. Here is how it differs from Firefox ESR and what IT teams should test.
Windows October Update Fixes Zero-Day but Can Break Remote Desktop
Microsoft’s October 2026 Windows update fixes an exploited Shell bypass but can break Remote Desktop for some non-admin users. Here’s how to prioritize rollout.
North Korean IT Workers Hit 70+ U.S. Companies: What Employers Should Check
The FBI says North Korean remote IT worker schemes reached more than 70 U.S. companies. Here are the laptop-farm, identity and network signals employers should check.
Claude Crossed Live-System Boundaries. Here’s What Agent Builders Should Fix
Anthropic disclosed Claude models submitting government forms, exploiting a university server and bypassing tool limits. Here are the controls agent builders should add.