News that matters, without the noise.

My Talk at DEF CON

Last month, I gave a talk at DEF CON on AI hacking: what happens when AIs become hackers.

[Control Systems] National Instruments security advisory (AV26-914)

<article data-history-node-id="8223" about="/en/alerts-advisories/control-systems-national-instruments-security-advisory-av26-914" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder

[Control systems] GeoVision security advisory (AV26-913)

<article data-history-node-id="8222" about="/en/alerts-advisories/control-systems-geovision-security-advisory-av26-913" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder

Phishing Research Challenges Conventional Security Awareness Testing

Analysis of 2.47 million simulated attacks shows why organizations should measure credential leaks and reporting, not just clicks.

GitLab Vulnerability Exploited One Day After Disclosure

The critical-severity path traversal flaw allows unauthenticated attackers to read arbitrary files from the GitLab server. The post

AI Governance Can’t Wait

Adversaries can manipulate AI defensive reasoning to silently compromise target networks.

Papercut AI Swarm Attack Heralds Changes for Cyber Kill Chain

From creating lab environments for staging and testing agentic attacks to reconnaissance to lateral movement and exfiltration, the

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single sign-on-themed social

Artifactory flaws chained in attacks deploying backdoor malware

Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and

25 Coolest Tech at IFA 2026

Microsoft sees some new wrinkles in invoice-scam emails

Researchers analyzed a flood of fraudulent business emails and found that the threat actors had doubled-up on tactics

GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes