3+ day, 10+ hour ago   (1544+ words) Passwd is a Google Workspace-focused password manager with strong usability, flexible pricing, passkey support, and private cloud deployment options. Passwd takes a somewhat different approach to business password management than many of the other platforms I’ve reviewed. That combination of…...

1+ week, 2+ day ago   (623+ words) Coder’s compromised module registry served malicious Terraform modules that stole cloud, CI/CD, AI, and SSH credentials during a 14-hour attack window. Coder confirmed that an unidentified attacker compromised infrastructure supporting its module registry and served modified Terraform modules designed…...

1+ week, 1+ day ago   (861+ words) Security teams are building custom AI agents to improve defense, close tooling gaps, and automate workflows, but strong governance remains critical. For security professionals, they’re inescapable: nearly every vendor is trying to sell a product that uses them, to the…...

1+ week, 1+ day ago   (982+ words) Learn why vulnerability management must move beyond CVSS to prioritize real risk using exploitability, asset context, attack paths, and AI-driven analysis. Cybersecurity teams aren’t failing to find vulnerabilities, they’re failing to act on the right ones. Vulnerability data is outpacing…...

2+ week, 1+ day ago   (597+ words) Anthropic on Thursday opened a research preview of its Model Hardware Standard (MHS), a shared specification that lets AI agents discover, monitor and operate programmable physical equipment through a standardized software layer. The company says MHS can connect devices including…...

2+ week, 3+ day ago   (955+ words) JFrog finds AI development tools are expanding the software supply chain and creating new attack paths for organizations. For most of my career, software supply chain security meant scrutinizing what developers pull in: dependencies, base images, third-party packages. That framing…...

3+ week, 2+ day ago   (636+ words) Researchers used a remote Spectre attack to leak a JWT between co-located Cloudflare Workers. Cloudflare says the technique is now mitigated. A remote Spectre attack successfully pulled a JWT from a co-located Cloudflare Worker, showing how CPU side channels can…...

3+ week, 2+ day ago   (538+ words) Attackers are finding new ways through familiar doors. Today’s news includes a critical GitLab vulnerability, millions of Azure records being sold, and fixes for over 400 Microsoft vulnerabilities. Read past newsletters here. GitLab Flaw Exposes Public Repositories GitLab issued an out-of-band…...

3+ week, 4+ day ago   (549+ words) Attackers aren’t sticking to the usual playbook. Read past newsletters here. Shell Hit in Cl0p PTC Data Theft Campaign Shell is investigating Cl0p’s claim that it stole 89 GB of sensitive engineering and project data. Patch affected PTC systems, restrict internet exposure,…...