Security

CVE-2026-54121 lets any standard domain account impersonate a Domain Controller via AD CS certificate abuse, enabling DCSync and domain takeover.

CVE-2026-50522 lets attackers steal SharePoint machine keys for persistent access — patching alone won’t undo it, the fourth SharePoint bug this month.

Zero-day web framework vulnerabilities expose how slow coordinated patching can be—and why defense-in-depth matters more than fast patching alone.

A deep analysis of the coordinated multi-wave npm supply chain attacks (IronWorm, Phantom Gyp, Miasma, Shai-Hulud) that exposed thousands of developers and

Researchers at the University of Toronto have demonstrated a working proof-of-concept: an AI worm that autonomously reasons about its environment, generates

Anthropic released an open-source framework for automated vulnerability discovery powered by AI.

A massive npm supply chain attack compromised TanStack, Mistral AI’s client library, and over 170 packages.

A Dune-themed malware campaign targeting the PyTorch Lightning library highlights how AI/ML supply chains are becoming prime targets for sophisticated attacks.

Nearly two years after the xz Utils backdoor shocked the open source world, the supply chain security landscape has changed — but not enough.

Supply chain security frameworks like SLSA and SBOM requirements are moving from recommendations to mandates.

NIST’s post-quantum cryptography standards are finalized, and the migration timeline is no longer theoretical — it’s operational.

A supply chain attack on the popular Ultralytics YOLO package highlights the persistent vulnerability of the Python ecosystem’s distribution pipeline.