Three versions of node-ipc (10.1.1-10.1.3) shipped a stealer backdoor - CVE-2026-44338 - harvesting SSH keys, AWS credentials and .npmrc from 1.2M-weekly-download installs via DNS tunneling and HTTPS C2. Technical breakdown and hardening guide.
RSAC 2026's dominant theme was agentic AI security — AI agents are now the target. Cisco's DefenseClaw, the MCP server problem, and a five-step playbook for securing autonomous agents.
One week in April 2026 delivered a CVSS 9.8 AI-agent flaw, an unauthenticated SGLang RCE, MCP memory poisoning, and a 766-host credential harvest. Here's the full analysis and your patching order.
This week: npm 2FA-gated publishing, LiteSpeed CVE-2026-48172 exploited for root on shared hosting, Drupal SQLi added to CISA KEV, 8 Packagist packages shipping Linux malware, a CVSS 10.0 Cisco flaw, and the first VPN takedown over ransomware facilitation.
April 2026 was one of the most volatile months in cybersecurity history: Microsoft's 167-flaw Patch Tuesday, exploited SharePoint and IKE zero-days, ransomware at Rockstar and McGraw-Hill, and two CISA emergency directives — everything defenders need to know.
AI agents are the new attack surface: goal hijacking, tool abuse, memory poisoning, and delegation escalation — plus the five-layer defense framework that catches what WAFs and code review can't.
Microsoft's April 2026 Patch Tuesday fixed 168 vulnerabilities — an exploited SharePoint zero-day (CVE-2026-32201), the BlueHammer Defender EoP, and a CVSS 9.8 IKE RCE. Complete breakdown and patching order inside.
What should a penetration test cost in 2026? Real price ranges by test type, the five factors that move quotes, a build-your-own estimate formula, and the red flags of scanner resale dressed up as pentesting.
Red teaming LLM applications requires fundamentally different techniques than traditional penetration testing. This playbook covers the complete methodology: reconnaissance, attack execution across 5 categories, advanced adversarial ML techniques, and a reporting framework for AI security assessments.
Google's TurboQuant is a breakthrough AI compression method targeting memory bottlenecks in large language models. This guide explains how TurboQuant achieves 6x KV-cache reduction and 8x speedup on H100 GPUs with training-free quantization — no retraining required.
Attackers entered Texas fintech Marquis through a SonicWall firewall and reached data for 700+ client banks - 672,075 identities, 74 institutions disrupted. The supply-chain anatomy and five break-points.
Pwn2Own Berlin 2026 awarded $1.3M for 47 zero-days in three days - and AI coding assistants OpenAI Codex and Anthropic Claude Code were exploited on stage for the first time. DEVCORE took Master of Pwn with $505K. Full results, the AI-target analysis, and what AppSec teams must do now.