219 Security Blogs

Last Updated: 16 Oct 26 03:45 UTC

Blog List | Github | OPML

2026-10-16

ISC SANS
ISC Stormcast For Friday, October 16th, 2026 https://isc.sans.edu/podcastdetail/10140, (Fri, Oct 16th)

ISC SANS
Small Agents, Smaller Blast Radius: Controlling What AI Can Do, (Fri, Oct 16th)


2026-10-15

ISC SANS
Panchan's Mining Island [Guest Diary], (Wed, Oct 14th)

Dark Reading
SecTor 2026 Reveals a Rapidly Shifting Cybersecurity Landscape

Dark Reading
F-Secure Launches Victim-First Scam Encyclopedia Covering 50+ Types of Consumer Fraud

Dark Reading
AI Slop Isn't Just for Social Media; It's Ruining Cyberattacks, Too

Ars Technica Security
Targeted ads delivered 0-click exploits to install mercenary malware

Artem Golubin
Python's binary wheels and supply chain attacks

Varonis
Varonis is joining Proofpoint

Rapid7
How Multi-Campus Universities can Build a more Connected Security Program

Meta Security
How Meta Built Forum With AI-Native Engineering

Black Lantern Security
IIS Shortname Enumeration in the Big ‘26

Meta Security
2026 World Cup: Breaking Records, Spiky Charts and Reliability at Scale

Escape DAST
Compliance penetration testing requirements, by framework

Talos Intelligence
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

Google Safety & Security
Check if a text message is a scam using Circle to Search.

Cloudflare
A fully programmable secure web gateway

Mend
Your AI agent is sandboxed. Its data still needs guardrails.

Eclypsium
What 200 Security Leaders Told Us About Network Device Security

Schneier on Security
Measuring Human Cryptanalysis Effort

Amazon Security
AWS Security Agent (now part of AWS Continuum) exploited 33 of 37 new real-world CVEs

Meta Security
Sapienz Receives ISSTA 2026 Impact Paper Award

Dark Reading
Vulnerability Management Isn't About the Score — It's About How It Applies to You

ReversingLabs
How RL mapped a Midnight Blizzard-linked campaign from two hashes

ReversingLabs
The Next MOVEit May Already Be in Your File Transfer Queue

Malwarebytes
Update Chrome: Google fixes 37 security flaws, including seven critical bugs

Socket
Anthropic Gives Open Source Maintainers a Fast Track to Mythos Vulnerability Findings

Cloudflare
Deploy with Void

Bishop Fox Security
AI Security Scoping: Define What To Test In Your Deployment

Cloudflare
Cloudflare and OpenAI: Making AI discovery better for everyone

Malwarebytes
Is this link safe? Find out with Malwarebytes Scam Link Check

MIT Technology Review
The Download: reviving frozen pig kidneys and boosting nuclear power

CISA Alerts & Advisories
J4Care dcm4che

CISA Alerts & Advisories
Thermo Fisher Torrent Suite Software

CISA Alerts & Advisories
CISA Adds One Known Exploited Vulnerability to Catalog

CISA Alerts & Advisories
Guangzhou Juan IoT Technology EseeCloud

CISA Alerts & Advisories
CISA Malcolm

CISA Alerts & Advisories
Eclipse Foundation Eclipse Milo

Malwarebytes
Sextortion “help” firm took $60 million from victims, FTC alleges

Eye Security Research
Cooldown or compromise: the three-day rule for npm and PyPI

Malwarebytes
Raven AI lets cops find your home from a photo taken inside

MIT Technology Review
How much more can nuclear power plants give?

MIT Technology Review
Six wild ideas for perpetuating your mind

MIT Technology Review
Pig kidneys that were “frozen” for a year have been brought back to life

Dark Reading
EU Grocers Pay a Steep Price for Unpatched Fridge Firmware

Snyk
VulnBump: Can AI Agents Fix Vulnerable Dependencies Without Breaking the Build?

TrustedSec
Two Config Files, Two Release Tracks, and One Very Bad Commit

Snyk
Introducing Evo Agentic AppSec: Security That Keeps Up With AI Development

ISC SANS
ISC Stormcast For Thursday, October 15th, 2026 https://isc.sans.edu/podcastdetail/10138, (Thu, Oct 15th)

Datadog HQ
Monitor the performance of critical steps in user journeys with RUM operations

Datadog HQ
How Kubernetes DRA can improve GPU utilization and cut costs

Star Labs
YuanKong RAT: the Android remote-control service that stamps its operators' names into every build

Greynoise
skynox7: Proxyjacking Edge Devices Into Residential Proxies

Sansec Threat Research
BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849)

Datadog HQ
Introducing Scout 1.0: A new SRE model powering Bits AI with frontier performance at a fraction of the cost


2026-10-14

Black Hills Info Sec
The Threat Hunting Flywheel: Why Threat Hunting Isn’t About Finding Bad Things

Ars Technica Security
Fridge hack costing millions and sparking fires stemmed from poor security

Dark Reading
Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles

Dark Reading
Yam Store: The Phishing Network Behind a Billion Messages

Cloudflare
Yandex outage: Data shows that instead of going dark, malicious bots went on the move

Amazon Security
Penetration testing every deployment with AWS Continuum

Wiz
ASPM in the AI Era Part 1: Unified Visibility Across Your Stack

Dark Reading
Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat

Black Lantern Security
CVE-2026-79957 Insecure Direct Object Reference in ServiceNext

Socket
Front Lines Podcast: What Founders Get Wrong When Pitching CISOs

Malwarebytes
AI worms could spread across your smart devices, Anthropic warns

Schneier on Security
Upcoming Speaking Engagements

ReversingLabs
What a CBOM Is — and Why an SBOM Won't Answer the Quantum Question

core-jmp
Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)

XBOW
XBOW Data Residency now Available in Australia, Canada, and Japan

Schneier on Security
The Future of AI Cryptanalysis

Krebs on Security
U.K. Sanctions Cryptomus for RU Money Laundering

Varonis
IBM’s Cost of a Data Breach Report 2026: AI Is Now the Attacker and the Target

Schneier on Security
Cyberattack on Connected Fridges in France

Talos Intelligence
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

Socket
Socket for Origin Now Available

core-jmp
HDD Firmware Hacking Part 1

Cloudflare
Inside Hyperdrive: How we solved a rare Hyperdrive MySQL caching bug

Microsoft Security
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

Dark Reading
Russian Influence Operation Widely Targets Latin America

GitGuardian
Why We Built the Good Samaritan Program

Bishop Fox Security
Behind Closed Doors: How Physical Penetration Testing Secures Sensitive Conversations

Rapid7
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)

Ars Technica Security
Anthropic warns small AI models could self-replicate through IoT devices

Rapid7
Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce

MIT Technology Review
The Download: faking blood and the future of batteries

CISA Alerts & Advisories
CISA Adds Four Known Exploited Vulnerabilities to Catalog

Malwarebytes
Update Windows: Record Patch Tuesday fixes flaw already under attack

Malwarebytes
Fake Calendly “Meta Careers” pages steal Facebook and Google logins

Wiz
Securing the Mission at Machine Speed: Wiz AI Agents Arrive in Wiz for Gov

Trail of Bits
Package managers have an integrity problem

Malwarebytes
Police receive fake murder tip from Anthropic’s Claude AI

Scott Helme
Passkeys Are Not a Trap

MIT Technology Review
The US military’s race to make fake blood

ISC SANS
Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th)

Dark Reading
Ransomware Gangs Embrace Physical Threats, Family Stalking?

Resecurity
Iron Man & YamStore: Powering a Global Phishing-as-a-Service Ecosystem

ISC SANS
ISC Stormcast For Wednesday, October 14th, 2026 https://isc.sans.edu/podcastdetail/10136, (Wed, Oct 14th)

Fastly
Fastly Named a Leader in the 2026 IDC MarketScape for WAAP

Auth0
One SDK, Multiple Platforms: Introducing the Auth0 SDK for Kotlin Multiplatform

Semgrep
Introducing Semgrep in Cursor Origin


2026-10-13

Krebs on Security
Microsoft Patches More Than 1,400 Security Flaws

Dark Reading
Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday

Embrace The Red
Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)

Rapid7
Patch Tuesday - October 2026

Dark Reading
North Korea Phishes Ukrainians for War Intel

Amazon Security
Part 2 – Cybersecurity journeys: What even is this job?

Talos Intelligence
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities

Dark Reading
Anthropic Finds Ingredients for Future AI Worms

Leviathan Security
October 2026 Mobile Platform Security & Fraud Prevention Assessment

Zero Day Initiative
The October 2026 Security Update Review

ISC SANS
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)

Google Safety & Security
Developing Gemini 4 Argon responsibly and safely

Github Security Blog
GitHub’s model for secret detection: Finding more secrets with less noise

Socket
Agent Baseline Publishes Security Reference Architecture for Software Factories

Rapid7
Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

Cloudflare
Under the hood, off the hot path: How D1 scales to millions of databases

Meta Security
Meta’s Generative Ads Model (GEM): Scaling the Central Model and Compute Engine for Frontier Ads AI

Cloudflare
Rewinding the exponential: How we keep hardware usage down

XBOW
XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days

ReversingLabs
AI coding agents expose developer screenshots on GitHub repos

Silverfort
5 cybersecurity assumptions AI attacks break

core-jmp
Reverse Engineering a Ledger Nano X Hardware Implant

Malwarebytes
Grindr users’ sensitive data shared through ad auctions without valid consent

Bishop Fox Security
Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)

GitGuardian
AI Agent Security: Best Practices for Safe Deployment

CISA Alerts & Advisories
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure

CISA Alerts & Advisories
Swann Communications SWIFI-SE2KIC

CISA Alerts & Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA Alerts & Advisories
Inductive Automation Ignition Software

MIT Technology Review
The Download: open model trade-offs and geothermal power’s promise

Shielder Blog
Power Grid Model Security Audit

ToxSec
The Agent Made the Call. Who Owns the Outcome?

Rapid7
CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab

Malwarebytes
Hackers heat up supermarket fridges, spoiling food across France

Troy Hunt
Weekly Update 525: AI Data Breach Hyperbole

Xint
Are You the Target of Sophisticated, State-Sponsored Hackers? Follow DARPA’s Lead.

MIT Technology Review
Open models have real benefits. Do they outweigh the risks?

MIT Technology Review
AI labs are buying data from dead startups to train their models

Palo Alto Networks
NHS England evolves its cybersecurity strategy with Palo Alto Networks and IBM

Onyphe
Refrigeration as Critical Infrastructure: Analyzing the Cyberattack on French Supermarkets

Malwarebytes
Scammers know your name, and they’re counting on you to reply

TrustedSec
TrustedSec Joins the OpenAI Daybreak Defense Network

ISC SANS
ISC Stormcast For Tuesday, October 13th, 2026 https://isc.sans.edu/podcastdetail/10134, (Tue, Oct 13th)

CrankySec
Still Shit!

Auth0
Introducing the Auth0 SDK for TanStack Start

Fastly
Defense Without Detours: Introducing Fastly Network Protect

Datadog HQ
How Datadog defines service criticality at scale

Fastly
AI Bot Cosplay


2026-10-12

Doyensec
Playing It SFAPE: Code Execution in Isolated User Mode

Amazon Security
GuardDuty Extended Threat Detection has added five new indicators to surface attack sequences

Dark Reading
Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack

Meta Security
OCP Summit 2026: Powering AI with Open Innovations in Scale-Up, Scale-Out, and Scale-Across Networks

Amazon Security
Quantum-resistant signing on AWS, Part 2: Enforce your ML-DSA algorithm policy with SCPs and IAM

Amazon Security
Quantum-resistant signing on AWS, Part 1: Build a software supply chain with ML-DSA

Dark Reading
Prominent Ransomware Negotiator Faces Extortion Charges

Dark Reading
No Identity, No Recovery: Cyber Resilience Starts With IAM

Meta Security
Shipping Media Over QUIC at Meta Scale for Instagram Live Ingest

Meta Security
Turning Opportunistic AI Inference Capacity Into Better Ads Recommendations

Schneier on Security
FBI Arrests Suspect in FBI-Hacking Case

Cloudflare
Filter, reshape, and redact logs before export with Transformers

Aikido
Aikido Security is now CREST accredited

core-jmp
How I Found a $90,000 Remote Code Execution Vulnerability in Google

Silverfort
Silverfort Secures AI Agents on Google Cloud in Runtime with Agent Gateway Integration

Malwarebytes
How “123456” became the key to almost 9 million personal records

Dark Reading
Passing the Baton: Dark Reading Names New Editor-in-Chief

MIT Technology Review
The Download: moon city problems and drone traffic controllers

Filippo Valsorda
(Post-Quantum) Cryptographic Right Answers

Malwarebytes
Phishing emails are baiting your AI assistant

Malwarebytes
A week in security (October 5 – October 11)

ISC SANS
ISC Stormcast For Monday, October 12th, 2026 https://isc.sans.edu/podcastdetail/10132, (Mon, Oct 12th)

Rosecurify
Seclog - #199

Simon Koeck
How I Found a $90,000 Remote Code Execution Vulnerability in Google

MaskRay's Blog
Who pays for Clang

Semgrep
Cybersecurity Awareness Won’t Save You. Readiness Might.

Elastic Security Labs
Auditing the auditor: Unmasking Apex Accelerator


2026-10-11

MaskRay's Blog
ClangIR and the cost of MLIR


2026-10-10

ISC SANS
Why TLP should not replace your internal information classification, (Sat, Oct 10th)

Krebs on Security
FBI Arrests Executive at Ransomware Negotiation Firm


2026-10-09

Dark Reading
ASOS Breach Reveals the Risks in Customer-Facing SaaS

Schneier on Security
Friday Squid Blogging: I Caught a Squid

Dark Reading
AI Scramble Drives Cybersecurity M&A Boom

core-jmp
Telegram Desktop: one-click account takeover via IPC injection

Cloudflare
Introducing Clef-omni with full multimodality, plus a faster Clef and a cheaper Clef-flash

core-jmp
AnyPwn: AnyDesk Linux 8.0.2 Pre-auth Heap Overflow RCE

watchTowr Labs
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)

Dark Reading
What We Missed: FBI Strikes Back at ShinyHunters

Praetorian
Hunt, Triage, and Act on Guard Findings in Slack

Aikido
What is vulnerability remediation?

Dark Reading
Security Threats Don't Stop at the Office: Why Executives' Families Need Training, Too

Step Security
GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories

Socket
arXiv Is Rate Limiting Authors Following a Flood of AI Slop Submissions

Aikido
Top 6 developer security tools for enterprise teams in 2026

Escape DAST
What continuous offensive security testing is and how to implement it

GitGuardian
AI Agent Security: Six Controls From Nine Real Incidents

Cloudflare
Introducing on-demand CPU and memory profiling with flamegraphs for Workers and Durable Objects

Dark Reading
Social Engineering AI Agents: The New BEC for 2026

Cloudflare
Deno is joining Cloudflare

Socket
New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials

Rapid7
Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules

Malwarebytes
ASOS breach update: Hackers stole customer details and shopping searches

Scott Helme
The First Reduction in Their History: 64-Day Let's Encrypt Certificates