126 investigations across seven breached AWS environments: what Claude Code, Codex and Cursor found, missed and inferred, and how an incident-response runbook changed their work.

We scanned 25,964 US government domains: 43 have SPF, MX, NS or DMARC records that trust expired or typo domains. One typo authorizes 32,066 IPs.

N-able has taken its hosted N-central classic environments offline following the public disclosure of critical vulnerabilities in N-central.

The company is also advising customers running on-premises N-central servers to take them offline until further notice…

Many Electron apps auto-update without verifying signatures. Many also still trust the compromised eMudhra certificates. Together, that lets an attacker on your network install malware on your machine.

Security audit of projects in the Kubernetes non-core ecosystem. Sponsored by the CNCF (Cloud Native Computing Foundation), facilitated by Open Source Technology Improvement Fund (OSTIF) and performed by Shielder.

It works with Windows Server 2022!

Our research breakdown of the Supabase vulnerabilities we found across nearly 200 companies and how our ASM scanner detects them.

IPinfo's WHEREIS research reveals where IP addresses are used outside their registered regions and why measurement-based geolocation matters.

ScriptBlock Smuggling is a PowerShell evasion technique that creates a mismatch between the script text presented to security controls and the instructions actually executed. A threat actor can man…

By Mark Kyle November 11, 2026 Security firm Cynet has reported attempts to run PowerShell reverse shells on Qlik Sense servers at several European organizations. The attempts were blocked, but the attacker’s infrastructure contained tooling for other enterprise…

Inside an incident response against an AI-driven attack: how fast the attacker's agents adapted, and how we used AI agents of our own to fight back.

Imagine an AI coding tool asks you for permission to access a file. You look at the approval prompt and notice the file path appears to land in the current workspace. You shrug, wondering why the agent asked for access to the current workspace, and you click…

If you had told me in April 2026 one question “Mehmet, can we use managed PostgreSQL for this project?” would send me into the deepest rabbit hole of my life, I would have laughed. Months later, I finally found the bottom of that rabbit hole. It was a 22…

NvRoot (CVE-2026-47591) is an NVIDIA driver local privilege escalation vulnerability found by the Stealthium team. We built a working exploit to demonstrate the bug and confirm root, and reported it to NVIDIA. We also built detection for the bug’s exploitation…

Walking through a security issue caused by a surprising behavior in JSON Schema validation

A new OWASP Incubator Project gives neocloud providers, neocloud users, and AI data center operators a shared framework for understanding and addressing AI infrastructure security risks.

November 12, 2026 – An automated supply chain attack is sweeping through GitHub, using thousands of hijacked developer accounts to plant secret-stealing code in build pipelines. Security firms including Aikido Security, StepSecurity and SafeDep say the attacker…

MalwareMustDie (MMD) is a whitehat workgroup to reduce malware, this blog advocates research on new malware threats & Linux malware.