Cybersecurity

LexisNexis shuts down services after suspicious activity on servers

LexisNexis took its Diligence, Metabase API, and Newsdesk services offline as part of its response t…

Password Reuse Statistics: The Silent Security Killer

The $6 Million Password Problem A single reused password brought down Colonial Pipeline in 2021, s…

How to Build an Attack-Surface Inventory from Certificate Transparency

How to Build an Attack-Surface Inventory from Certificate Transparency A domain inventory maintain…

Your AI Agent Has Access to Your Database. What Could Go Wrong?

At 10:17 AM, everything was working. The AI support agent had been running in production for three …

Shipping 10–50× More Code? Watch This Webinar on Securing AI-Speed Development

AI is helping development teams produce far more code, far faster. But security teams still have to …

Valve notifies Steam hardware customers of a data breach

Video game publisher and digital distribution giant Valve is notifying Steam hardware customers in E…

Securing the Software Supply Chain (SLSA, SBOM, Signing)

⚡ TL;DR: Most of your production code is dependencies you didn't write, so the supply chain is the a…

JWT Pitfalls I Actually Ran Into (Building an API Gateway and a Carpooling App)

JWT Pitfalls I Actually Ran Into (Building an API Gateway and a Carpooling App) JWTs look deceptiv…

TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore

The threat actor known as Head Mare has been observed weaponizing security flaws in unpatched TrueCo…

Three Copies of the Key, None of the Passphrase

A new lead is taking over Buzz management. That is the whole reason this work happened, and it is wo…

A Five-Part Evidence Check for ICT Supplier Due Diligence

Supplier questionnaires are useful, but completion is not the same as due diligence. NIST SP 1326, …

Letting a Stranger's URL Into Your Server Without Building an SSRF Vector

Any feature that fetches a URL supplied by an untrusted user is a Server-Side Request Forgery surfac…