Microsoft has confirmed active exploitation of CVE-2026-42897 in on-prem Exchange Server through crafted email attacks, with APT activity targeting exposed unpatched systems including organizations in critical sectors.
A technical breakdown of the Shai-Hulud worm and how a compromised npm package can pivot through developer pipelines to steal secrets and reach GitHub, AWS, and Kubernetes environments.
A counterfeit npm package campaign tied to the TanStack incident compromised employee devices at OpenAI and Mistral, exposing internal repositories and highlighting the risks of open-source supply chain attacks.
A technical look at the first known AI-generated zero-day exploit, its detection in a mass cyberattack, and what it means for hardening JavaScript supply chains against automated offensive tooling.
Google says AI helped autonomously find and exploit a previously unknown flaw in an open-source admin tool, underscoring how logic bugs, trust assumptions, and exposed management panels are becoming higher-value targets for developers and defenders.
Dirty Frag is a newly disclosed Linux kernel local privilege escalation chain that shows page-cache write bugs in networking and crypto paths can still lead to root on many systems.
Copy Fail is a high-severity Linux kernel privilege escalation flaw that can turn a low-privilege foothold in cloud, CI/CD, or container environments into root access on affected systems.
Fake Gemini CLI downloads and typosquatted npm packages are being used in active malware campaigns that target developers with reverse shells and fileless attacks on macOS and Windows.
A Windows RPC design flaw called PhantomRPC lets attackers abuse disabled or offline services to silently escalate standard service accounts to SYSTEM on patched Windows Server 2022 and 2025.
GitHub patched a critical remote code execution flaw in its internal git infrastructure within hours after Wiz Research used AI models to uncover a vulnerability that could expose millions of public and private repositories.
AI-assisted security research uncovered a critical remote code execution flaw in GitHub's internal git infrastructure, and GitHub patched it within hours after confirming no exploitation.
This post explores how malicious prompt injection can be executed via pull request comments in AI-powered coding agents, highlighting security risks and mitigation strategies.
Explores how alert fatigue undermines security and operations by increasing the risk of missed signals and unsafe responses.
A security researcher examines why responsible disclosure processes often fail and what needs to change to better protect organizations and the public.
A concise set of security aphorisms and one-sentence advice designed to help teams build a more breach-ready security posture.
Learn how to design and automate an AI-powered reconnaissance pipeline in Python to streamline data collection, analysis, and actionable insight generation.
A structured AI-assisted learning path that helps beginners build web security knowledge and progress toward practical auditing skills.
An overview of how to design trust boundaries and defensive controls to reduce prompt injection risk in LLM-powered systems.
An analysis of the practical balance between AI API usage costs and the security benefits they can deliver.
An in-depth exploration of prompt injection attacks, detailing how attackers progress from data exfiltration to achieving remote code execution on vulnerable AI systems.
An overview of Server-Side Request Forgery (SSRF), including how attackers exploit trusted server access to reach internal networks and the security risks involved.
An exploration of how using software components with known vulnerabilities creates hidden supply chain risks and what teams can do to reduce exposure.
An overview of Cross-Site Scripting (XSS) covering common attack types, delivery vectors, and practical mitigation strategies for securing web applications.
An overview of how insecure default settings and weak configuration practices can expose systems to preventable attacks.