Security Insights
Breaches, ransomware and regulation — analysed the day they break, with the practical lessons your team can act on. Free to read, no account required.
Velvet Ant Hid Inside Linux Auth for Nearly a Decade by Backdooring PAM and OpenSSH
A China-nexus threat actor planted rogue authentication modules on victim networks and stayed undetected for close to ten years — by targeting the one layer most incident-response playbooks quietly trust.
Outsider Enterprise Dismantled: What the 'AI-Powered' Phishing Takedown Actually Tells Defenders
The FBI, Google, and Lumen's Black Lotus Labs jointly knocked a Chinese phishing-as-a-service operation offline after it registered nearly one million malicious domains. The AI angle is real — but narrower than headlines suggest.
Washington Orders Anthropic to Block Foreign Nationals From Fable 5 and Mythos 5 — So Anthropic Pulled Both Models Entirely
Faced with an export-control-style directive it disputes, Anthropic suspended two frontier AI models worldwide rather than build nationality-gated access infrastructure. The standoff raises hard questions about who controls frontier AI and how.
Critical Vulnerability in Splunk Enterprise Exposes Systems to Remote Code Execution
Splunk addresses a severe flaw in its Enterprise software that could allow unauthenticated users to execute arbitrary code.
Former Iowa School IT Admin Sentenced to 21 Months for Post-Termination Network Intrusions
No malware, no nation-state tradecraft — just valid credentials that nobody revoked. A disgruntled ex-employee deleted accounts and disrupted classrooms for months before federal charges ended it.
Anthropic Takes Fable 5 and Mythos 5 Offline Under White House Export Control Directive
The Trump administration's push to treat frontier AI as dual-use technology forced Anthropic to pull two models entirely — a compliance signal that reshapes how AI labs think about regulatory risk.
400+ Arch Linux AUR Packages Backdoored With Rust Credential Stealer and eBPF Rootkit
Attackers hijacked more than 400 community-maintained Arch User Repository packages this week, silently modifying build scripts to drop a Rust-based credential harvester — and, when the build ran as root, an eBPF rootkit capable of hiding itself from every standard Linux detection tool.
GreatXML: How a Researcher Cracked BitLocker in Four Hours Using Windows' Own Recovery Partition
A hobbyist find targeting XML configuration files in the Windows Recovery Environment exposes a fundamental gap in full-disk encryption's trust model — and no Microsoft patch exists yet.
CVE-2026-5027: Unauthenticated Path Traversal in Langflow Is Being Exploited Right Now
A write-anywhere bug in the popular open-source AI workflow builder carries a CVSS 8.8 score and is already seeing opportunistic mass exploitation — patch immediately or assume compromise.
npm 12 Kills Install Scripts by Default — and That Changes the Supply Chain Math
GitHub's decision to disable lifecycle hooks in npm 12 removes the single most-abused primitive in JavaScript supply chain attacks. Here is what defenders, DevOps teams, and security engineers need to know before the cutover.
CISA's BOD 26-04 Kills CVSS-First Patching — and Gives Agencies Three Days on the Worst Flaws
A new binding directive replaces severity-score timelines with a four-factor risk model. Federal agencies must remediate the highest-risk vulnerabilities within 72 hours. The rest of the industry should be paying close attention.
RoguePlanet Exploit Unveiled: Microsoft Defender's Latest Vulnerability Challenge
An exploit named RoguePlanet has surfaced, targeting Microsoft Defender with a local privilege escalation vulnerability, raising security concerns.
Ready to Reduce Your Human Cyber Risk?
Sign up and start training your team in minutes. No sales calls, no demos — just pick a plan and go. Phishing simulations, video courses, and certificates from day one.
