News that matters, without the noise.

DSA-6351-1 thunderbird – security update

https://security-tracker.debian.org/tracker/DSA-6351-1

New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever

New Abuse of the ClickOnce Technology, Part 1: The Inner Workings of ClickOnce Application Deployment

AutoJack: How a single page can RCE the host running your AI agent 

In this article Why we are looking at agent frameworks What is AutoGen Studio  The AutoJack chain at

USN-8447-2: LXD vulnerabilities

USN-8447-1 fixed vulnerabilities in Go Cryptography. This update provides the corresponding updates for Go Cryptography code embedded in

New Forrester study shows customers who unified with Microsoft Security benefited from 124% ROI

Across many industries, organizations are unifying security and putting AI agents to work. Security teams are utilizing agents

From package to postinstall payload: Inside the Mastra npm supply chain compromise

In this article Attack chain overview Discovery and initial indicators Dependency injection: the poisoned package.json Typosquat analysis: easy-day-js

Crypto Clipper uses Tor and worm-like propagation for persistence and control

In this article Attack chain overview Mitigation and protection guidance References  Learn more Microsoft Threat Intelligence and Microsoft

CVE-2026-10735

Severity Not Scored Description Multiple plugins by ShapedPlugin contain a backdoor in various versions. This makes it possible

CVE-2026-48764

High Severity Description TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation is implemented

CVE-2026-53676

High Severity Description ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a

USN-8452-1: pbkdf2 vulnerability

Nikita Skovoroda discovered that pbkdf2 did not properly validate certain algorithm names. An attacker could possibly use this