Daily news, analysis and practical guides explaining what happened, who is affected and what to do next. We also turn this knowledge into practical training for organisations.
Penetration Testing and AppSec Ghost fixes stored XSS in SVG images imported with content. Check the 6.67.0 fix, archive acceptance procedures and the response to a suspicious import.
AI Security The Playwright conversion prompt in k6 MCP crossed the working-directory boundary. Check the code fix, process permissions and AI integration access to secrets.
Human Security MediaTek's bulletin covers 31 CVEs, including two critical modem flaws. Identify affected device variants and verify vendor updates across the organisation.
Cloud, Infrastructure and DevSecOps A new CVE covers unsafe kubeconfig handling in maclof/kubernetes-client. Check the 0.32.0 fix, WebSocket transport and protection of cluster credentials.
Human Security CERT Orange warns about texts claiming that an OLX account needs verification. Use an independent check and a practical employee training scenario.
Vulnerabilities and CVEs New CVE records describe authentication bypasses and an exposed debugger in Perforce P4 Search. Assess network exposure and verify the patched deployment.
AI Security An updated A2UI advisory describes XSS in openUrl. Review affected versions, the available fix and trust boundaries for interfaces generated by AI agents.
Cloud, Infrastructure and DevSecOps Gitea's advisory describes container restrictions bypassed through workflow options. Review exposure, differing version metadata and isolation between CI jobs.
Identity and Access Trigger.dev's advisory describes environment secrets exposed by CLI logs. Review the fix, historical logs and response steps for disclosed credentials.
Vulnerabilities and CVEs CERT/CC warns of a JWS verification bypass in Authlib. We explain the advisory's scope, exposure assessment and controls at the trust boundary.
Human Security CERT Orange warns about criminals obtaining top-up codes from drivers and couriers. Learn how to recognise the request and set clear rules for extra purchases.
AI Security The new Digital Defense Report connects AI risk with identity, data and tools. Here are the decisions organisations should make before deploying an agent.
Vulnerabilities and CVEs CVE-2026-88771 and CVE-2026-88772 allow unauthenticated remote code execution. Here are the fixed versions and a practical compromise-assessment plan.
Threats and Incidents ENISA Threat Landscape 2026 examines ransomware, DDoS, vulnerabilities and supplier dependencies. We translate its findings into board-level decisions.
Human Security Microsoft described campaigns in which fake invitations and documents installed legitimate remote access tools. Here is what employees and organisations should do.
Once a month, a concise summary of the vulnerabilities and threats that matter. No spam, unsubscribe anytime.
