Archive

GitHub, PyPI add time-based defenses against supply chain attacks

GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to protect against supply-chain attacks and to limit their impact. [...]

Why important: Important because supply-chain issues can spread through trusted software, dependencies, or developer workflows.

Inside Elastic InfoSec's agentic SOC: When to inline your agent's skills for a 5× cost reduction

We tested two agentic SOC architectures in parallel across 36,822 real Agent Builder conversations. One won by 5.7x: a specialized workflow triaging alerts for $0.69 each, against $3.42 for a single agent juggling 14 Skills. The data and the decision framework are both below.

Why important: Important because it can improve monitoring, detection engineering, dashboards, or SOC response workflows.

Splunk Zero-Day: CVSS 9.8, 3-Day CISA Deadline [2026] - tech-insider.org

Splunk Zero-Day: CVSS 9.8, 3-Day CISA Deadline [2026] tech-insider.org

Why important: Important because exploitation is reported in the wild, increasing near-term risk for exposed systems.

wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution

We ran the wp2shell WordPress RCE chain end-to-end with Elastic Defend. Detection rule walkthrough, IOCs, and hunt guidance.

Why important: Important because it can improve monitoring, detection engineering, dashboards, or SOC response workflows.

Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel

The Chaos ransomware group uses new malware "msaRAT" that hijacks browsers. The malware doesn't communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker's IP from victims via WebRTC over TURN.

Why important: Important because ransomware or extortion activity can quickly become an operational incident and backup/recovery priority.

Panduit IntraVUE

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling. The following versions of Panduit IntraVUE are affected: IntraVUE <=3.2.1a14 CVSS Vendor Equipment Vulnerabilities v3 10 Pronetiqs Panduit IntraVUE Plaintext Storage of…

Why important: Important because it can improve monitoring, detection engineering, dashboards, or SOC response workflows.

US Warns of Iranian Hackers Targeting Siemens, Schneider, and Rockwell ICS Devices

An updated advisory from federal agencies provides information on the techniques used to hack programmable logic controllers. The post US Warns of Iranian Hackers Targeting Siemens, Schneider, and Rockwell ICS Devices appeared first on SecurityWeek .

Why important: Important because it can improve monitoring, detection engineering, dashboards, or SOC response workflows.

Email threat landscape: Q2 2026 trends and insights

In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major phishing techniques, while threat actors expanded into Teams-based social engineering and employed increasingly automated and multi-stage attack chains. The post Email threat landscape: Q2 2026 trends and insights appeared first on Microsoft Security…

Why important: Important because it can improve monitoring, detection engineering, dashboards, or SOC response workflows.

UK and partners expose Russian state-supported actors for new ‘zero-click’ phishing campaign targeting Western organisations

GCHQ’s National Cyber Security Centre and international partners issue warning as ‘LAUNDRY BEAR’ cyber threat group exposed for targeted phishing campaign

Why important: Important because the source, timing, and topic suggest practical security impact beyond routine news.

4 ways AI-driven defense is rewriting the cybersecurity playbook

The cybersecurity landscape has evolved beyond human scale. Today’s adversaries have replaced predictable, manual playbooks with machine-generated attack chains that can breach traditional controls in seconds. To bridge the gap, organizations must move past legacy, reactive controls and embrace a fundamentally different, AI-driven architecture: Agentic Endpoint Security (AES). AES represents a paradigm shift,…

Why important: Important because it can improve monitoring, detection engineering, dashboards, or SOC response workflows.

Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries

Laundry Bear exploited a zero-day vulnerability for five months before it was patched in November 2025, and the group is still actively exploiting vulnerable environments. The post Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries appeared first on CyberScoop .

Why important: Important because exploitation is reported in the wild, increasing near-term risk for exposed systems.

Rockwell Automation ThinManager

View CSAF Summary Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory. The following versions of Rockwell Automation ThinManager are affected: ThinManager >=13.0.0|<13.0.7, >=13.1.0|<13.1.5, >=13.2.0|<13.2.4, >=14.0.0|<14.0.2 CVSS Vendor Equipment Vulnerabilities v3 8.1 Rockwell…

Why important: Important because it can improve monitoring, detection engineering, dashboards, or SOC response workflows.

Don’t swing at everything

Thorsten explores Q2 2026 stats, the artificial buffer zone of 2026, and why smart, prioritized patching is more critical than ever.

Why important: Important because it can improve monitoring, detection engineering, dashboards, or SOC response workflows.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-16232 Check Point SmartConsole Improper Authentication Vulnerability CVE-2026-50522 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the…

Why important: Important because CISA lists this as known exploited; defenders should prioritize patching, exposure checks, and detection coverage.

How enterprise GenAI can amplify ransomware risk — and how to contain it

Enterprise AI can accelerate ransomware attacks when AI assistants and agents inherit excessive permissions or compromised identities. Acronis explains how identity controls, governance, and least-privilege access help reduce AI-enabled ransomware risk while supporting secure AI adoption. [...]

Why important: Important because ransomware or extortion activity can quickly become an operational incident and backup/recovery priority.

Oracle Patches Over 1,400 Vulnerabilities With Quarterly Security Updates

Many of the vulnerabilities fixed with the July 2026 Critical Patch Update were likely discovered by AI. The post Oracle Patches Over 1,400 Vulnerabilities With Quarterly Security Updates appeared first on SecurityWeek .

Why important: Important because it points to patchable exposure or vulnerability intelligence that can drive remediation priorities.

OpenAI: Our models breached Hugging Face during a cyber capability test

The recent Hugging Face breach was the work of several OpenAI models, the AI research company claimed in a blog post. The breach Late last week, the company behind Hugging Face, a platform that enables users to share machine learning models and datasets, said some of its internal datasets had been accessed without authorization. The attack vector was, according to Hugging Face, a malicious dataset that exploited…

Why important: Important because it may change how teams evaluate model capability, cost, or deployment tradeoffs.

Oracle’s July update fixes ten 10.0 vulnerabilities in Fusion Middleware

Oracle’s July 2026 Critical Patch Update, its largest ever, contains 1,449 new security patches spanning 32 product families, from Oracle Database and E-Business Suite to PeopleSoft, GoldenGate, Java SE, and Fusion Middleware. Fusion Middleware was particularly hard hit, with new security patches for 355 security vulnerabilities, 219 of them remotely exploitable without authentication, meaning they can be exploited…

Why important: Important because supply-chain issues can spread through trusted software, dependencies, or developer workflows.

When AI Attacks: OpenAI Models Autonomously Hack Hugging Face

Advanced LLMs escaped their sandboxes while attempting to achieve a non-malicious benchmark test objective.

Why important: Important because it may change how teams evaluate model capability, cost, or deployment tradeoffs.

CISA, FBI, EPA and U.S. Government Partners Update Warning of Iran-Affiliated Threat Actors Targeting Critical Infrastructure Programmable Logic Controllers

Why important: Important because it points to patchable exposure or vulnerability intelligence that can drive remediation priorities.

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability CVE-2026-63030 WordPress Core Interpretation Conflict Vulnerability CVE-2026-60137 WordPress Core SQL Injection…

Why important: Important because CISA lists this as known exploited; defenders should prioritize patching, exposure checks, and detection coverage.

Critical SharePoint RCE flaw exploited to steal machine keys

Hackers are actively exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to steal machine keys and maintain access even after affected servers are patched. [...]

Why important: Important because it points to patchable exposure or vulnerability intelligence that can drive remediation priorities.

Trump Orders Defense Contractors to Map Software, Suppliers Across Critical Supply Chains

New executive order calls for end-to-end visibility into defense supply chains, including software dependencies, foreign ownership and cyber-related supplier risks. The post Trump Orders Defense Contractors to Map Software, Suppliers Across Critical Supply Chains appeared first on SecurityWeek .

Why important: Important because supply-chain issues can spread through trusted software, dependencies, or developer workflows.

Ransomware victims fail to fix flaws that exposed them

Many organizations still aren’t securing their email or patching vulnerabilities after recovering from attacks, a new report found.

Why important: Important because ransomware or extortion activity can quickly become an operational incident and backup/recovery priority.

Cisco’s open-weight Antares models make vulnerability localization cheaper

A security analyst opens an unfamiliar repository, pulls up a vulnerability advisory, and starts hunting for the file where the weakness lives. The naming conventions belong to someone else. Evidence sits in scattered corners of a codebase that runs to thousands of files. That first stage of triage burns hours and expertise, and it is the part Cisco set out to speed up. Today, the company released Antares, a family…

Why important: Important because it points to patchable exposure or vulnerability intelligence that can drive remediation priorities.

Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain Attacks

Why important: Important because supply-chain issues can spread through trusted software, dependencies, or developer workflows.

Context bombing heralds a new AI era of deceptive defense

Attackers are increasingly using AI agents to automate all phases of cyberattacks , prompting the security industry and enterprises to find new network defense approaches. One technique that shows promise is to intentionally plant decoy files with prompts that trigger the content safety guardrails built into LLMs with the goal of crashing rogue agentic workflows. Using decoy resources as tripwires that alert…

Why important: Important because supply-chain issues can spread through trusted software, dependencies, or developer workflows.

CVE-2026-60137: WordPress Core — WordPress Core SQL Injection Vulnerability

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. Required action due: 2026-08-04

Why important: Important because CISA lists this as known exploited; defenders should prioritize patching, exposure checks, and detection coverage.

Ernst & Young Data Breach Affects Personal, Financial Information

Hackers stole names, addresses, Social Security numbers, credit/debit card numbers, and other information from a third-party management platform. The post Ernst & Young Data Breach Affects Personal, Financial Information appeared first on SecurityWeek .

Why important: Important because it can improve monitoring, detection engineering, dashboards, or SOC response workflows.

Critical ServiceNow code execution flaw now exploited in attacks

Attackers have begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform, according to threat intelligence company Defused. [...]

Why important: Important because it points to patchable exposure or vulnerability intelligence that can drive remediation priorities.

More alerts are making your team slower, and an outcome-based SOC fixes that

In this Help Net Security video, Thom Langford, EMEA CTO, Rapid7, explains why piling on more security alerts makes a SOC slower to respond. Attackers log in with stolen credentials and use trusted tools like PowerShell instead of custom malware. He shares a case where attackers called a help desk, reset a privileged cloud account, and exposed thousands of passwords in three minutes. Ransomware groups can go from…

Why important: Important because ransomware or extortion activity can quickly become an operational incident and backup/recovery priority.

AI adoption and business acceleration are changing the expectations of technology risk management

As AI becomes embedded in customer experiences, internal workflows, and throughout the supply chain, security leaders are being asked to do more than manage risk. They are being asked to help the business make more informed decisions and move faster. At the same time, AI has evolved faster than the programs built to govern it. The result is a widening gap between the pace of transformation and the ability of…

Why important: Important because supply-chain issues can spread through trusted software, dependencies, or developer workflows.

Remediating Vulnerabilities With LLMs: Inside Ivanti's Automation Push

Ivanti CSO Daniel Spicer says frontier models have shown surprising effectiveness in early stages; but cost and human-in-the-loop viability remain open questions.

Why important: Important because it may change how teams evaluate model capability, cost, or deployment tradeoffs.

Elastic helps secure AI applications from prompt injection and attacks on agents - Stock Titan

Elastic helps secure AI applications from prompt injection and attacks on agents Stock Titan

Why important: Important because it can improve monitoring, detection engineering, dashboards, or SOC response workflows.

B4dica/B4dica — B4dica / B4dica Star 0 Code Issues Pull requests Construo interfaces performáticas com React e TypeScript, moldo APIs com Node.js e analiso tráfego de rede com o…

B4dica / B4dica Star 0 Code Issues Pull requests Construo interfaces performáticas com React e TypeScript, moldo APIs com Node.js e analiso tráfego de rede com o olhar de quem entende tanto de UX quanto de SIEM. Estudante de Engenharia de…

Why important: Important because it can improve monitoring, detection engineering, dashboards, or SOC response workflows.

Week in review: High severity WordPress vulnerabilities, fake OAuth IDs bypass sign-in logs

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Two new high severity WordPress vulnerabilities, patch immediately! The 7.0.2 WordPress security release addresses one critical and one high severity security issue. Cynative: Open-source deep research agent Running a large language model against a live cloud account to hunt for security holes comes with an obvious…

Why important: Important because exploitation is reported in the wild, increasing near-term risk for exposed systems.

WordPress Core "wp2shell" RCE flaws get public exploits, patch now

Public exploits have been released for the critical "wp2shell" remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their sites immediately. [...]

Why important: Important because it points to patchable exposure or vulnerability intelligence that can drive remediation priorities.

Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy

A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and persistent root access. The post Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy appeared first on Unit 42 .

Why important: Important because exploitation is reported in the wild, increasing near-term risk for exposed systems.

Siemens SICAM 8

View CSAF Summary Multiple SICAM 8 products are affected by multiple vulnerabilities that could lead to denial of service, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICORE for CP-8010/CP-8012 - SICAM EGS Device firmware - CPCI85 - SICAM S8000 - SICORE Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of…

Why important: Important because supply-chain issues can spread through trusted software, dependencies, or developer workflows.

Detecting common Linux privilege escalation techniques with Wazuh

Privilege escalation is the process by which an attacker gains permissions beyond those assigned to their current account. On Linux systems, threat actors who gain initial access as a low-privileged user often exploit misconfigurations or weak security controls to obtain root or other privileged access. With elevated privileges, they can disable security controls, modify system […] The post Detecting common Linux…

Why important: Important because it can improve monitoring, detection engineering, dashboards, or SOC response workflows.

CVE-2026-25089: Fortinet FortiSandbox — Fortinet FortiSandbox OS Command Injection Vulnerability

Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. Required action due: 2026-07-19

Why important: Important because CISA lists this as known exploited; defenders should prioritize patching, exposure checks, and detection coverage.

Least privilege for AI agents: Identity, access, and tool binding

As AI agents become more autonomous, strong identity, access, and auditing controls are critical to keeping them secure. The post Least privilege for AI agents: Identity, access, and tool binding appeared first on Microsoft Security Blog .

Why important: Important because it can improve monitoring, detection engineering, dashboards, or SOC response workflows.

Adobe Patches Critical ColdFusion Vulnerabilities

The ColdFusion security defects could allow attackers to execute arbitrary code or elevate their privileges. The post Adobe Patches Critical ColdFusion Vulnerabilities appeared first on SecurityWeek .

Why important: Important because it points to patchable exposure or vulnerability intelligence that can drive remediation priorities.

Governments to enterprises: Improve your router security hygiene

Global security agencies say enterprises must clean up their act as Russian government-sponsored attackers exploit weaknesses in routers. According to a new multinational cybersecurity advisory , cyberattackers continue to exploit inadequately-protected and/or poorly-configured network devices via age-old tactics. Threat actors scan for weakened devices, typically routers, allowing them to “opportunistically”…

Why important: Important because it points to patchable exposure or vulnerability intelligence that can drive remediation priorities.

Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for July 2026, which includes 622 vulnerabilities affecting a range of products, including 57 that Microsoft marked as "critical". Microsoft notes that two of the vulnerabilities disclosed this month have been exploited in the wild. CVE-2026-56155 is an important-

Why important: Important because exploitation is reported in the wild, increasing near-term risk for exposed systems.

Treasury sanctions First VPN Service, others for abetting ransomware gangs

The designations hit 1VPNS, its alleged Ukrainian administrator and a Belarusian who allegedly sold “cryptors” to disguise ransomware and other malware. The post Treasury sanctions First VPN Service, others for abetting ransomware gangs appeared first on CyberScoop .

Why important: Important because ransomware or extortion activity can quickly become an operational incident and backup/recovery priority.

Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days

Today is Microsoft's July 2026 Patch Tuesday, and with it comes security updates for a record-breaking 570 flaws, including two zero-day vulnerabilities exploited in attacks and one publicly disclosed. [...]

Why important: Important because exploitation is reported in the wild, increasing near-term risk for exposed systems.

SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)

SonicWall has fixed two actively exploited vulnerabilities (CVE-2026-15409, CVE-2026-15410) affecting its Secure Mobile Access (SMA) 1000 Series appliances, and is urging customer organizations to upgrade to a fixed firmare version and search for evidence of potential compromise. If the outlined indicators of compromise are present on the system, the company advises re-imaging (hardware) or re-deploying (virtual)…

Why important: Important because exploitation is reported in the wild, increasing near-term risk for exposed systems.

Microsoft Patch Tuesday July 2026 - The AI Acopolypse is Here , (Tue, Jul 14th)

This patch Tuesday includes a staggering&#;x26;#;xc2;&#;x26;#;xa0;622 vulnerabilities, not including another 427 vulnerabilities in Chromium, affecting Microsoft&#;x26;#;39;s Edge browser. 62 of the vulnerabilities are rated critical. One was disclosed before today, and two have already been exploited.

Why important: Important because it points to patchable exposure or vulnerability intelligence that can drive remediation priorities.

Cribl buys CardinalOps for detection engineering, edges into SecOps - TechTarget

Cribl buys CardinalOps for detection engineering, edges into SecOps TechTarget

Why important: Important because it can improve monitoring, detection engineering, dashboards, or SOC response workflows.

Claude Code users keep 50% higher limits until July 19

Anthropic has extended a limited-time promotion that increases weekly usage limits in Claude Code by 50% through July 19, 2026, at 11:59 PM PT. When the promotion ends, weekly usage limits will return to their standard levels without any changes to users’ plans or billing. The promotion is available to Pro, Max, and Team plans, as well as legacy seat-based users on Enterprise plans. Free plans and consumption-based…

Why important: Important because the source, timing, and topic suggest practical security impact beyond routine news.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2008-4128 Cisco IOS Cross-Site Request Forgery Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on…

Why important: Important because CISA lists this as known exploited; defenders should prioritize patching, exposure checks, and detection coverage.

Introducing Precursor: detecting agentic behavior with continuous client-side signals

Precursor, our new continuous behavioral validation engine for bot management, offers visibility into how humans and bots actually interact across the full user journey. By turning session-level behavior into bot detection signals, it identifies advanced automation with higher precision — while reducing friction for legitimate users.

Why important: Important because it may affect how developers build, automate, or operate AI-assisted systems.

Jurassic Park, cybersecurity and the dangerous myth of control

Jurassic Park wasn’t really about dinosaurs. It was about arrogant people building systems they believed were controllable. “Life finds a way” is probably the most famous line from the entire franchise. Ian Malcolm’s warning that no matter how sophisticated the technology becomes, no matter how expensive the fences are, and no matter how confident the operators feel, nature eventually escapes containment. And in…

Why important: Important because supply-chain issues can spread through trusted software, dependencies, or developer workflows.

CISA warns of actively exploited RCE flaws in Joomla extensions

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are exploiting vulnerabilities in the iCagenda and Balbooa Forms extensions for Joomla to achieve remote code execution through arbitrary file uploads. [...]

Why important: Important because exploitation is reported in the wild, increasing near-term risk for exposed systems.

Zimbra Patches Critical Code Execution Vulnerability

The flaw results in malicious code embedded in crafted emails being executed when the emails are opened. The post Zimbra Patches Critical Code Execution Vulnerability appeared first on SecurityWeek .

Why important: Important because it points to patchable exposure or vulnerability intelligence that can drive remediation priorities.

Officials once again warn defenders that Russian hackers are targeting network devices

State-sponsored attackers are targeting critical infrastructure networks in defense, communications, energy, finance, government and health care. The post Officials once again warn defenders that Russian hackers are targeting network devices appeared first on CyberScoop .

Why important: Important because it points to patchable exposure or vulnerability intelligence that can drive remediation priorities.

VPN service favored by ransomware groups is sanctioned by US

The U.S. Treasury Department announced sanctions against First VPN Service (1VPNS) and its Ukrainian administrator for aiding ransomware groups. Separately, a Belarusian man was sanctioned for malware "cryptors."

Why important: Important because ransomware or extortion activity can quickly become an operational incident and backup/recovery priority.

UK and Allies urge critical sectors to improve defences against Russian intelligence targeting

New advisory highlights Russian state cyber actors’ global exploitation of poorly configured routers

Why important: Important because it points to patchable exposure or vulnerability intelligence that can drive remediation priorities.