Your AI Coding Assistant Took Orders From Malware
Miasma's npm worm skipped install scripts and poisoned AI coding assistants instead. See what this cybersecurity shift means and how to defend.
June 2026
Your Deleted Bucket Name Is Now An Attacker’s Data Pipe
Bucket hijacking and multi-tenant leaks prove your cloud isolation is rented, not owned. See how cybersecurity teams lock down shared infrastructure.
The Malware Was Signed, Licensed, And On Your Allowlist
Attackers ditched custom malware for signed RMM tools and faked trust. See why reputation-based cybersecurity fails, and what to watch instead.
CVE-2024-40766 Is Patched. The Leftover Passwords Still Log In
You patched CVE-2024-40766. The leaked VPN passwords still log in. Here's the cybersecurity cleanup the update never does for you. See the steps.
The Proxy You Forgot Just Leaked User Data
Squidbleed proves the riskiest cybersecurity gaps hide in middleware you forgot you ran. See where to look before attackers do.
usbliter8 Lives In A12 and A13 Silicon. No Patch Is Coming.
usbliter8 can't be patched and a slick IPv6 phish can't be cleanly blocked. See why patch-and-block fails and what cybersecurity controls actually hold.
15,000 Sites Scrubbed, And Your CMS Is Still The Delivery Truck
A SocGholish takedown cleaned 15,000 sites, but your CMS is still a malware delivery truck. Here's how to lock down the web property nobody owns.
You Can’t Fire What You Can’t Name
AI agents are minting credentials at machine speed, and your cybersecurity program isn't tracking them. Here's how to inventory and govern them before one leaks.
Even The Threat Hunters Lost Their Salesforce Data
Klue's breach drained Salesforce data from top cybersecurity firms through OAuth tokens no firewall watches. See how to lock down your integrations.
One Web Page. Your Host Is Theirs.
AutoJack proves localhost is no security boundary when AI agents browse hostile pages. See the cybersecurity controls that actually break the chain.