News
All topics →Timely analysis of the breaches, deals, exploits, and policy shifts reshaping cybersecurity, identity, and AI. Each piece goes past the headline to what it means for the people building and defending software. Updated continuously, newest first.
62 stories, newest first.
Latest
Passkeys resist phishing, so attackers now enroll their own. Okta documented a vishing kit that captures a password and MFA code, then registers the attacker's passkey on the real account.
Read the article
Apple's new 10-K warns that AI agents may resist instructions and conceal actions. Alphabet and Microsoft filed similar risk language days earlier. The exact quotes, and what boards should ask.
OpenAI says ChatGPT handles about a fifth of Google's search volume, and Google is scaling ads inside AI answers. What both mean for how B2B buyers find vendors.
LiteLLM's poisoned 1.107.0 release began with an admin key leaked in May and never revoked. It unlocked an agent platform holding the owner's unscoped GitHub token. What happened, and what to fix this week.
A leaked archive of 41,000 DHS staff and contractor records shows that an identity directory is a map of your organization. What is known, what is disputed, and what to change.
Anthropic's October 26, 2026 S-1 shows revenue of $16.3 billion in the first half of 2026, more than $600 billion in named compute contracts, and a board controlled by a trust and the co-founders. Here are the ten lines I would read twice, with page references.
Google ad revenue grew 10.6% to $82.0B in Q3 2026, yet Search was flat on Q2 as queries hit a five-year growth high. What it means for AEO, GEO and Gemini.
US clocks fall back at 2 a.m. on Sunday, November 1, 2026. British Columbia, Alberta, Manitoba and the NWT will not. City-by-city times, the law, and what breaks in software.
AI made attacks cheap, but 2026's breaches still walked through old doors: exposed devices, default credentials and over-trusted agents. Here are six attack patterns and nine fixes, ordered by how fast they cut risk.
OpenAI has notified more than 100 organizations that its AI agents may have accessed their systems without authorization. The cause was not a smarter attacker. It was exposed credentials, legacy token endpoints, and agents nobody was watching. What happened and what to do this week.
OpenAI, Anthropic, and Meta each confirmed an agent incident against a real target in three weeks. The labs are right that it was a test. The capability is not.
More than 20 Pass-the-Passkey techniques abuse logging, session handling, and synced-key recovery. None break FIDO2. Do not freeze the rollout.
An AI model manufactured fake identities to socially engineer a real maintainer, then edited its tracks when challenged. The request failed. The threat model should not.
Self-propagating instructions can spread through ordinary agent memory. Isolated agents with conflicting goals wrote malware to sabotage each other.
ShinyHunters claimed 2.2M Kodak records with a June 18 leak deadline. The group has breached Snowflake, Salesforce, Canvas, PeopleSoft, and now Kodak.
One phished BPO agent extracted 13M Adobe customer records and unpublished vulnerability reports from HackerOne. Third-party access is the breach pattern of 2026.
Iranian hackers wiped tens of thousands of Stryker devices in one attack. No data stolen. Just destruction. A new phase in state-sponsored cyber warfare.
Novo Nordisk confirmed a June 2026 data breach. The pharmaceutical giant behind Ozempic becomes the latest healthcare target in an accelerating trend.
74,000 Fortinet admin credentials cracked by GPU clusters from config backups stolen via old vulnerabilities. Patching the device wasn't enough.
ShinyHunters breached Canvas LMS through a free teacher account flaw. Instructure paid the ransom. Data was already copied. 275M student records exposed.
France banned Signal for government use and built Tchap. A hacker stole 73K accounts, 643K messages, and 59K media files from French ministry conversations.
24 billion stolen credentials in one database. 8.3TB of plaintext passwords and login URLs harvested by infostealers. The credential economy has scaled.
ShinyHunters weaponized a PeopleSoft zero-day to breach 100+ organizations in two weeks. 455K student records at Nottingham alone. Oracle's advisory came last.
ServiceNow shipped a REST endpoint with authentication disabled. Attackers queried customer data without credentials. The company knew since April.
CISA is operating at 40% capacity with 1,000 vacancies. Six threat hunters resigned in one day. The timing couldn't be worse for American cybersecurity.
A critical SQL injection in Ghost CMS turned 700+ sites into malware launchers. Harvard, Oxford, DuckDuckGo compromised. Here's what happened and what to do.
Attackers are forging authentication cookies to bypass Palo Alto GlobalProtect VPN logins. CISA KEV listed, Rapid7 confirms active exploitation since May 17.
A poisoned LiteLLM package led to 4TB stolen from Mercor, the AI training startup serving Meta, OpenAI, and Anthropic. Class action lawsuits filed.
DarkSword silently compromises iPhones through website visits alone. 270M devices affected. Apple breaks its own policy with a rare iOS 18 security backport.
FBI classifies breach of its surveillance network as a 'major incident.' Salt Typhoon suspected. Wiretap targets and investigation data potentially exposed.
Google I/O 2026 shipped an entire agent stack: Gemini 3.5 Flash, Antigravity 2.0, WebMCP, Gemini Spark, and Agent Payments Protocol. What it means for builders.
No single organization can defend against AI-powered attacks alone. Project Glasswing's $100M consortium model may be the template for the next decade of
Vercel breached after attacker compromised Context.ai, hijacked an employee's Google Workspace via OAuth, and accessed customer API keys and environment
Claude Mythos discovered vulnerabilities that survived 27 years of human review. This technical breakdown covers how it works, what it found, and why your
Three AI framework attacks in one week expose how classic vulnerabilities are hiding in AI's foundational plumbing, putting millions of deployments at risk.
An employee saw the CFO on video. Heard colleagues speaking. Authorized $25M in transfers. Every person was an AI-generated deepfake.
Attackers are harvesting your encrypted data today to decrypt with quantum computers tomorrow.
Ransomware groups now steal trade secrets before encryption. Nike's 1.4TB theft included shoe designs, patents, supplier lists, IP worth billions.
Google's $32B pursuit of Wiz shows security market consolidating. When hyperscalers own security vendors, customers lose pricing leverage and choice.
17.5 million Instagram accounts leaked through API scraping. Meta denies breach, but your data is on the dark web. Here's what actually happened.
Apple chose Google's Gemini over ChatGPT for Siri's AI upgrade. This $1B/year deal reveals who's actually winning the AI race, and it's not who you think.
OpenAI just announced ads are coming to ChatGPT. For 800M weekly users, this changes everything about how 'free' AI actually works.
3 million patients couldn't access healthcare after PIH Health's ransomware attack. Here's why hospitals are ransomware's favorite target, and what changes.
AT&T's $177M settlement covers 73M customers, but the real story is how breach data from 2019 just resurfaced in 2026 with fully decrypted SSNs. Here's why.
TikTok's new U.S. ownership brought privacy changes that sparked mass deletions. Here's what actually changed and what it means for your data.
Twilio acquiring Stytch signals a major shift in developer CIAM. I've analyzed 20+ platforms, from Descope to Keyclock, to show you which deliver on
OpenAI just released GPT OSS - their first open-source AI models since 2019. These aren't just free downloads; they're transparent, powerful systems that
This deal represents the maturation of the identity market. The days of pure-play identity vendors competing primarily on features are ending.
Security researchers discovered 16 billion stolen passwords from Apple, Google, Facebook and more.
The identity industry faces its biggest shift yet: machines now outnumber humans 90:1 in digital systems.
How did a $400 million data breach happen at Coinbase? It wasn't a tech failure, it was a human one.
At RSAC 2025, the cybersecurity landscape underwent a seismic shift. This analysis reveals how autonomous AI agents, deepfake technologies, and quantum
Google acquires cloud security leader Wiz for $32B, the largest cybersecurity deal ever.
In February 2025 Mozilla introduced Firefox's first Terms of Use and softened its long-standing no-data-sale language. Here is what changed, what Mozilla said it meant, and what it means for you.
The Department of Government Efficiency (DOGE) website was left vulnerable to unauthorized edits.
As geopolitical tensions reshape AI adoption, enterprises struggle to balance OpenAI's compliance frameworks against DeepSeek's cost efficiency.
Discover how Alibaba's Qwen 2.5-Max AI model with Mixture-of-Experts architecture outperforms DeepSeek V3 in key benchmarks, challenges OpenAI, and
DeepSeek redefines AI with cutting-edge innovations: MoE architecture activates only 37B parameters/token, FP8 training slashes costs, and latent
California has passed revolutionary legislation to regulate artificial intelligence, requiring companies to disclose training data and label AI-generated
The .io domain has been a favorite for tech startups, but its potential disappearance is sending ripples through the industry.
xAI's Grok trains on your X posts and Grok chats by default. Here's what data Grok 4.6 can access in 2026, and how to check your current opt-out settings.
Apple's latest Passwords app is poised to transform the way we manage and protect our digital identities.
