Weekly Threat Intel: Agentic AI, Stealer Logs, Edge CVEs
Stealer-log markets, edge-device exploitation and agentic-AI abuse: what defenders must patch, monitor and drill this week.
Detection Engineering with Sigma: Detections That Survive Vendor Churn
How Sigma turns SIEM detections into portable YAML, how pySigma pipelines compile them to any backend, and how to test rules like code with Atomic Red Team.
Fuzzing Web APIs with ffuf and Caido: Recon-to-Exploit Guide
A hands-on recon-to-exploit walkthrough: fuzz hidden endpoints and parameters with ffuf and Caido, chain the findings, and document the impact.
Build an MCP Security Lab: Intercept and Audit Model Context Protocol
Build a local MCP security lab: intercept, audit and attack Model Context Protocol servers with proxies, rogue tools and logging you fully control.
Weekly Threat Intel: Agentic AI Abuse and September 2026 CVEs
Agentic-AI abuse, the September 2026 CVE wave and ransomware tradecraft — this week’s defensive checklist.
Kubernetes Security Fundamentals: RBAC, Pod Security and the Controls That Matter
The Kubernetes security layers that stop real cluster compromises: control plane, RBAC, Pod Security Admission, network policy and image supply chain — with a ten-point audit checklist.
SBOMs in Practice: SPDX vs CycloneDX and What Actually Breaks
SPDX vs CycloneDX compared honestly, how to generate SBOMs that match production, and the failure modes that sink real adoption — plus the EU CRA deadlines now in force.
Snowflake-Related Arrests: UNC5537’s Kitchener Pinch
On October 30, 2024, Canadian authorities arrested a 26-year-old Kitchener, Ontario man on a US warrant connecting him to the Snowflake-account intrusions tracked by Mandiant as UNC5537 — the crew behind the Ticketmaster, Santander, and AT&T disclosures that dominated 2024’s data-theft calendar. The arrest, first reported in early November by Bloomberg identifying the suspect as Connor Riley Moucka, illuminated the infostealer-credential-to-cloud kill chain and the market for stolen data. This account reconstructs the campaign, the arrest, and the MFA lessons that outlast it.
CVE-2024-10924: Really Simple Security’s 2FA Betrayal
On November 6, 2024, Wordfence researcher István Márton disclosed CVE-2024-10924 — a CVSS 9.8 authentication bypass in Really Simple Security, the plugin securing four million WordPress sites, whose two-factor onboarding endpoint failed to validate the requesting user, granting attackers admin sessions on sites with incomplete 2FA enrollment. Patched same-day in 9.1.2, NVD-published November 14, the flaw became 2024’s definitive case study in security-plugin risk. This account walks the vulnerable code path, the four-million-site patch sprint, and why the ecosystem’s auth surface extends far past WordPress core.
Tool Hijacking: The 2024 Papers That Predicted Agent Attacks
By November 2024, AI-agent security research had already documented the attack class that production incidents would later make infamous. InjecAgent (March 2024, ACL Findings) benchmarked 1,054 indirect-injection scenarios across 30 agents, finding ReAct-prompted GPT-4 attacked successfully roughly a quarter of the time. Breaking Agents (July 2024) demonstrated malfunction amplification through agentic loops. Together with 2023’s foundational indirect-prompt-injection work, they mapped how tools, descriptions, and fetched content become command channels. This survey walks the papers, the hijack taxonomy, and the controls that predate the incidents.
NIST’s PQC Standards: FIPS 203-205 and the Migration Clock
On August 13, 2024, NIST published the final versions of FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) — the first formal post-quantum cryptography standards, capping an eight-year open competition and starting the migration clock for RSA and elliptic-curve infrastructure. With harvest-now-decrypt-later collection already threatening long-lived secrets and federal migration timelines targeting the 2030s, enterprises face a decade-scale cryptographic inventory and replacement program. This guide walks the standards, the threat math, and the migration playbook from inventory to hybrid deployment.
Kadrey v. Meta: Piracy Allegations and the Llama Paper Trail
In mid-December 2024, unsealed filings in Kadrey et al. v. Meta Platforms alleged the company torrented LibGen’s pirated library while engineers warned it ‘doesn’t feel right’ on corporate laptops, stripped copyright management information with purpose-built scripts, and used a dataset a memo called ‘we know to be pirated’ — with CEO approval over executive objections. The proposed DMCA and CDAFA claims reframe the AI-copyright fight around distribution and concealment rather than fair use alone. This account walks the exhibits, the legal architecture, and the compliance lessons for every AI data program.
- Go to the previous page
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- …
- 31
- Go to the next page