Topic
34 articles found
On December 9, 2021, a security researcher posted a proof-of-concept exploit for a vulnerability in a Java library called Log4j. Within 72 hours, hundreds of millions of systems were at risk. The chaos that followed wasn't primarily about the vulnerability's severity. It was about something more fun
Every week, another company makes headlines for a data breach or a site that crawled to a halt under normal traffic. In most cases, the root cause was not some sophisticated attack or freak server failure. It was a mistake that had been sitting quietly in the codebase for months, waiting to be notic
The Blind Spot in LLM Security Every week a new jailbreak bypasses the latest guardrail. Every month another audit reveals training data contamination. These approaches share a fundamental flaw: they operate on the wrong layer of the stack. Audits examine what went into the model training data and w
Editor’s note: SOCRadar is a leading cybersecurity company that provides threat intelligence to businesses worldwide. As the volume of cyber threats continued to grow, SOCRadar needed to modernize its data infrastructure to deliver faster insights to its customers. By migrating from PostgreSQL to Al
An aggressive password-spraying campaign targeting Microsoft 365 environments generated more than 81 million login attempts over a two-week period. [...]
Security leaders are now expected to protect business growth and clearly articulate security value to their board of directors, in addition to managing risk. While translating technical defense into measurable financial returns can be challenging, Mandiant Consulting can help you bridge the gap. Org
The company has publicly launched its solution to help organizations design, build, and operate secure cloud systems. The post Dawnguard Raises $6.3 Million for Security Architecture Automation Platform appeared first on SecurityWeek.
Cybersecurity researchers have warned of a "massive, ongoing, automated password spray attack" aimed at Microsoft's Azure command-line interface (CLI), compromising dozens of accounts in the process. The activity, per Huntress, originates from an IPv6 address range (2a0a:d683::/32) controlled by int
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Developers weren’t happy when identity and access control software company Duende commercialized its open source IdentityServer product in December 2022, The post IdentityServer4 is dead. Here’s what comes next. appeared first on The New Stack.
The infostealer was delivered via CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp, targeting credentials linking development and admin environments to wider enterprise systems.
Adversaries could plant a malicious repository that can execute arbitrary code and steal cloud credentials by exploiting the vulnerability, which showcases growing MCP risk.
Workday, the payroll and HR data platform, has been pursuing AI and agents for a while, but while other businesses The post “Bring it to our shop”: Workday’s pitch for keeping AI agents close to your most valuable data appeared first on The New Stack.
The updates reflect Anthropic's Mythos model and the speed at which vulnerabilities can be surfaced.
A single shared API key is fine right up until a second person uses it. intent-brain — the system, repo qmd-team-intent-kb, renamed to the intent-brain plugin v0.4.0 this day — is a team knowledge base. A Fastify HTTP API sits over a governed memory corpus. In front of that API is an MCP server name
Cloudflare released the Cloudflare One stack, an open-source library of agent skills for planning, deploying, and managing Zero Trust environments. The skills include automated migration logic for Zscaler and Palo Alto Networks, the same logic used in Cloudflare's Descaler program that has moved ent
Cloudflare Security Insights system now processes over 120 scans per second, providing frequent insights for all customers. By optimizing Kafka consumers, Postgres queries, and our API, we scaled our throughput 10x without adding hardware.
In our post about Project Glasswing, we made the argument that the architecture around a vulnerability matters more than the speed of the patch. Here we walk through what that architecture looks like, the threats it defends against, and how we run it ourselves as Cloudflare's customer zero.
Last year I got paged at 2am because someone was brute-forcing SSH on one of my servers. I woke up, fumbled for my phone, opened the dashboard, confirmed it was real, and banned the IP. By the time I did that — maybe 4 minutes — they'd tried 3,800 passwords. They didn't get in. But that's not the po
Following the Long Echo philosophy and the Long Echo Toolkit, I used CTK (Conversation Toolkit) to export and preserve my ChatGPT conversations. The live archive is offline at the moment while I think through what to publish and how. The numbers below describe what was built; if you want a copy of t
_Kiattisak_Lamchan_Alamy.png%3Fwidth%3D720%26quality%3D80%26disable%3Dupscale&w=3840&q=75)
