Writer AI vulnerability could leak session tokens across tenant boundaries
Here’s a nasty one in the enterprise AI space. Sand Security found a critical session isolation hole in Writer, the…
Security
Cybersecurity, vulnerabilities, threats, and defense
Windows device ID helped FBI trace alleged Scattered Spider hacker to 19-year-old
A Windows device identifier that survives OS updates but changes on reinstall — that’s what led the FBI to Peter…
DEBULL tool abuses Microsoft device-code flow to hijack M365 accounts
There’s a phishing campaign hitting Microsoft 365 accounts that doesn’t bother with fake login pages. It uses Microsoft’s own authentication…
A Single Public GitHub Issue Can Leak Your Private Repos Through AI Agents
An attacker opens a normal-looking issue on your public repo. No stolen credentials. No access to your organization. But your…
The CI Attack Your Security Scanners Won’t Catch: Cordyceps and GitHub Actions
Your CI pipeline is green. All checks passed. The dashboard looks clean. That means nothing if you’re using GitHub Actions…
Spain Nabs Suspected Pro-Russian Hacktivist in Palencia Raid
Spain’s National Police arrested a man in Palencia who they say was an active member of two pro-Russian hacktivist groups:…
When AI Writes Your Code, the Supply Chain Security Question Gets Harder
Software supply chain security was already a mess. Then AI joined the build pipeline. For years, the question was simple:…
New Januscape Linux Kernel Flaw Lets Attackers Escape VMs on Intel and AMD
A 16-year-old Linux kernel bug just got a name: Januscape. It’s bad. Tracked as CVE-2026-53359, this is a use-after-free vulnerability…
China-Linked Hackers Hit US and Canadian Universities via Roundcube Flaws
A suspected China-aligned threat group is actively exploiting Roundcube webmail vulnerabilities to target physics and engineering departments at US and…
Microsoft Enables Windows Settings Backup by Default for Enterprise Devices
Microsoft is flipping the switch. The Windows settings backup and restore tool will be enabled by default on Microsoft Entra-joined…