3+ day, 19+ hour ago   (1544+ words) Passwd is a Google Workspace-focused password manager with strong usability, flexible pricing, passkey support, and private cloud deployment options. Passwd takes a somewhat different approach to business password management than many of the other platforms I’ve reviewed. That combination of…...

1+ week, 2+ day ago   (623+ words) Coder’s compromised module registry served malicious Terraform modules that stole cloud, CI/CD, AI, and SSH credentials during a 14-hour attack window. Coder confirmed that an unidentified attacker compromised infrastructure supporting its module registry and served modified Terraform modules designed…...

1+ week, 2+ day ago   (382+ words) CISA added seven exploited flaws to its KEV catalog, including LiteLLM, Kestra, Starlette, and SonicWall vulnerabilities under active attack. AI gateways are becoming high-value attack surfaces. CISA added seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on…...

1+ week, 2+ day ago   (861+ words) Security teams are building custom AI agents to improve defense, close tooling gaps, and automate workflows, but strong governance remains critical. For security professionals, they’re inescapable: nearly every vendor is trying to sell a product that uses them, to the…...

1+ week, 1+ day ago   (982+ words) Learn why vulnerability management must move beyond CVSS to prioritize real risk using exploitability, asset context, attack paths, and AI-driven analysis. Cybersecurity teams aren’t failing to find vulnerabilities, they’re failing to act on the right ones. Vulnerability data is outpacing…...

1+ week, 2+ day ago   (748+ words) A high-severity flaw in All-in-One WP Migration leaves 3.25 million WordPress sites exposed, with vulnerable versions potentially leading to site compromise. A WordPress backup tool designed to help sites recover from trouble can instead become the trigger for an attack. Researchers…...

2+ week, 2+ day ago   (597+ words) Anthropic on Thursday opened a research preview of its Model Hardware Standard (MHS), a shared specification that lets AI agents discover, monitor and operate programmable physical equipment through a standardized software layer. The company says MHS can connect devices including…...

2+ week, 4+ day ago   (955+ words) JFrog finds AI development tools are expanding the software supply chain and creating new attack paths for organizations. For most of my career, software supply chain security meant scrutinizing what developers pull in: dependencies, base images, third-party packages. That framing…...

3+ week, 3+ day ago   (636+ words) Researchers used a remote Spectre attack to leak a JWT between co-located Cloudflare Workers. Cloudflare says the technique is now mitigated. A remote Spectre attack successfully pulled a JWT from a co-located Cloudflare Worker, showing how CPU side channels can…...

3+ week, 3+ day ago   (538+ words) Attackers are finding new ways through familiar doors. Today’s news includes a critical GitLab vulnerability, millions of Azure records being sold, and fixes for over 400 Microsoft vulnerabilities. Read past newsletters here. GitLab Flaw Exposes Public Repositories GitLab issued an out-of-band…...