News that matters, without the noise.

Identity Alone Isn’t Enough: Why Device Security Has to Share the Load

Identity checks alone can’t stop attackers using stolen session tokens and compromised devices. Specops Software outlines why Zero

1Password Teams With OpenAI to Stop AI Coding Agents From Leaking Credentials

1Password says AI coding agents should never hold persistent secrets, introducing a just-in-time credential model for OpenAI Codex

Infosecurity Europe

GitHub says hackers stole data from thousands of internal repositories

The code hosting giant GitHub said it was investigating a breach, but said there was no evidence of

Anthropic Silently Patches Claude Code Sandbox Bypass

The researcher who found it says the vulnerability could have been chained with a prompt injection to exfiltrate

Drupal critical update to fix bug with high exploitation risk

Drupal has announced a “core security release” scheduled for later today, warning that threat actors might develop exploits

China-Linked Webworm APT Evolves Tactics, Expands to European Targets

China-linked Webworm APT expands beyond Asia, targeting European government organizations and refining its cyber espionage tactics, according to

Hackers Use Single-Letter Go Module Typosquat to Deploy DNS-Based Backdoor

A seemingly innocent typo in a Go module name has been quietly serving a live backdoor for nearly

Microsoft Python Client DurableTask Compromised by TeamPCP Hackers

Three consecutive releases of Microsoft’s official Python workflow SDK were poisoned with a multi-cloud credential-stealing worm, continuing the

Caught Off Guard: Securing AI After It Hits Production

As enterprises rush AI projects into production, security teams are increasingly being forced into reactive mode. The post

Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack

A compromised maintainer account was used to publish malicious package versions across the @antv namespace. The post Over

Researchers Warn CypherLoc Scareware Has Targeted Millions of Users

Barracuda reveals new CypherLoc scareware has featured in nearly three million attacks