Detections for Claude Enterprise built on Compliance API content: a prefilter and LLM judge that catch prompt injection, jailbreaks and data exfiltration.

It is yet another day in this parallel universe of security, where the devices we bolt onto the edge of our networks to keep the bad people out are, with remarkable consistency, the exact thing that let the bad people in.

While we’ve seemingly had a breather…

DPAPI's CREDHIST file stores a chain of encrypted historical password material that is rarely targeted during offensive engagements. This post explores the structure of CREDHIST entries, how we extended DPAPISnoop to extract offline-crackable hashes, and…

Worried about supply chain attacks hitting your repos? Detect compromised credentials the moment anyone uses them. Free, forever.

A compatibility matrix tracking OAuth refresh-token support across 14 MCP clients. Covers status, root causes, SDK layers, and server-side workarounds.

Three posts? In three days? Are we insane?

We're home alone, there's no one to stop us, and we're up past bedtime. So, we need to talk about Splunk.

On June 10th, Splunk published this CVE-2026-20253 advisory:

It has everything that we love:

* No authentication

March 31, 2026, two malicious axios versions live for ~3 hours, a RAT on every machine that ran a fresh install. Then the turn — the signal that something wa...

There has been a lot of hype around Mythos and Large Language models being able to find and exploit vulnerabilities at scale recently, and while this may be true for these emerging frontier models, it's already a reality we live in today, and it's not just…

Threat intelligence report: PromptSnatcher: AdBlocker stealing Ai Chats. Research by MalExt Sentry.

I accidentally logged into a malicious website operated by threat actors after scrolling X. Here's how I do that.

Varonis Threat Labs discovered SearchLeak, a critical vulnerability chain in Microsoft 365 Copilot Enterprise that allows an attacker to steal sensitive data — MFA codes, email messages, meeting details, and private organizational files — with a single click.

What happens when you stage autonomous AI agents in production pipelines? A raw, 14-day engineering post-mortem breaking down runtime telemetry mapping, active policy simulation, and the reality of the developer 'instrumentation tax'.

A two-byte gRPC request crashed AWS's Kubernetes KMS plugin. Coordinated disclosure with AWS VDP; fix merged as aws-encryption-provider#169.

PrizeBuzz is a phishing-as-a-service kit on 318 .buzz domains cloning OMT, Coca-Cola, Vodafone and ~26 more brands via fake WhatsApp prize surveys. IoCs inside.

How I used Claude Code and Ghidra to turn messy ASUS driver leads into two validated CVEs without sending vendors AI slop.

How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling…

FulcrumSec claims to have stolen over a terabyte of data from Novo Nordisk and demanded $25 million. Novo Nordisk disclosed an incident on June 11.

In Windows, a Quality of Service (QoS) policy is a rule that handles outbound network traffic. Specifically, it is used to cap the outbound bandwidth of a process, port, or protocol. Organizations …