‘Cordyceps’: Mushrooming Malicious Pull Requests Threaten Developer Workflows
The CI/CD workflow weakness affects Microsoft’s Azure Sentinel, Google’s AI Agent Development Kit, Apache’s Doris analytics database, Cloudflare’s
CYBERSECURITY INTELLIGENCE
News that matters, without the noise.
Search current cybersecurity reporting locally in this app. Search terms are not sent to AdvisoryLoom. The Professional plan adds Watchlists, structured My Intelligence, and AI briefings.
Private search: the term stays in this browser and is matched against a generic content feed.LATEST COVERAGE
OT / ICS
Healthtech firm Xolis suffers data breach impacting 1.4 million people
Healthcare technology company Xsolis says that sensitive data belonging to nearly 1.4 million individuals was compromised in a
New macOS ClickFix attack silently mounts DMGs to push infostealer
A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from
Modernize or Relocate. $1 Trillion Has Picked a Side.
BCG surveyed 1,000 manufacturers and found $1.03 trillion in European manufacturing value at risk of relocation.
AI Is is making advanced cyber attacks more accessible. How do we make advanced defenses more accessible?
This month I am spotlighting the new LinkedIn Newsletter by Waterfall Security Solutions’ CEO and Co-Founder, Lior Frenkel.
Takepoint Signals | Risk ownership crosses the OT boundary
Australia’s Cyber and Infrastructure Security Centre expanded its Critical Infrastructure Risk Management Program this week to cover AI,
3 sources
Scattered Spider members plead guilty to hacking Transport for London
Two members of the ‘Scattered Spider’ cybercrime group pleaded guilty to hacking the Transport for London (TfL) systems
Connected reporting, one intelligence threadbleepingcomputer.com · krebsonsecurity.com · therecord.media
The Exploit Doesn’t Exist. You Can Still Prove It Works Against You
Attackers can now weaponize newly disclosed vulnerabilities far faster than most organizations can patch them. Picus Security explains
LastPass confirms data breach in Klue supply chain attack
LastPass announced that hackers accessed customer data from its Salesforce environment after stealing the company’s OAuth tokens in
SocGholish Takedown Highlights Malicious TDS Threats
SocGholish uses traffic distribution systems (TDSs) to provide initial access into victims’ networks for cybercrime groups such as
FortiBleed Attackers Turn Firewalls Into Credentials Stealers as Heist Persists
The threat actors engineered a Golang-based sniffer to target 430,000 FortiGate firewalls and identify 110 million credentials in
DifyTap Bugs Let Attackers ‘Wiretap’ AI Chat Histories
Four vulnerabilities allow attackers to exploit Dify, a platform for AI application building and management, to silently access