Archive
Every issue, newest first.
Oct 5, 2026|Issue 17|Weekday|6 min read
The attacker's clock is faster than the defender's
Microsoft says vulnerability weaponization now falls below 24 hours while critical external remediation often takes 30 to 60 days. A new Exchange authorization flaw shows why a stolen identity is only as dangerous as what it is allowed to touch, and Google and ServiceNow are pushing agents deeper into enterprise operations.
Join the discussionOct 4, 2026|Issue 16|Weekday|6 min read
The trusted relationship is the new boundary
The most important security boundary today isn't necessarily the vulnerable product. It's the trusted relationship behind it. Denmark's national registry was exposed through a company's legitimate access, NetScaler appliances are under attack again through a flaw last week's patches didn't cover, and automated vulnerability reports have become noisy enough that Google has paused part of a bug-bounty intake.
Join the discussionOct 3, 2026|Issue 12|Weekday|6 min read
Old exposure is becoming today's ransomware incident
New reporting on Warlock shows attackers still turning long-patched SharePoint weaknesses into critical-infrastructure compromise, while FortiMail and Cisco SD-WAN remain immediate remediation priorities. At the same time, AWS is moving cloud architecture review from a periodic checklist toward an AI agent that can recommend, and sometimes generate, the remediation itself.
Join the discussionOct 2, 2026|Issue 15|Weekday|6 min read
Security infrastructure itself is becoming the attack surface
The systems designed to protect and control enterprise infrastructure are themselves becoming prime targets. An actively exploited FortiMail zero-day, Cisco SD-WAN control-plane exploitation, an AI agent chaining zero-days and Microsoft's 2026 threat report all point toward authority plus speed.
Join the discussionOct 1, 2026|Issue 14|Weekday|6 min read
Security is increasingly the management of delegated authority
Email infrastructure is back in the incident-response queue, AI agents are moving from software abstraction into purpose-built infrastructure, and regulators are starting to ask who is responsible when autonomous systems cross boundaries. The common thread is delegated authority.
Join the discussionSep 30, 2026|Issue 13|Weekday|6 min read
The systems closest to trust boundaries are where attackers want to land
Attackers increasingly don't need exotic malware when trusted identities, development pipelines, signed remote-management software and edge appliances already provide the access they need. At the same time, infrastructure vendors are redesigning trust itself, from post-quantum web certificates to security agents embedded in enterprise AI workflows.
Join the discussionSep 29, 2026|Issue 11|Weekday|6 min read
Identity is becoming the control plane for both cloud attacks and autonomous defense
Microsoft documents destructive Azure activity through compromised service principals, Apple patches an exploited CoreGraphics zero-day, and enterprise attackers keep targeting identities and orchestration systems that carry outsized authority.
Join the discussionSep 28, 2026|Issue 10|Weekday|6 min read
Yesterday’s uncertainty became today’s incident-response queue
Citrix has now confirmed and patched the NetScaler zero-days we were tracking, Kiteworks has narrowed and lifted its emergency shutdown, and a Google SecOps disruption reminds defenders that security tooling is itself production infrastructure.
Join the discussionSep 27, 2026|Issue 9|Weekday|6 min read
Edge infrastructure is back in the blast radius
Reports of two apparently unpatched NetScaler RCE flaws arrive as actively exploited SharePoint and MikroTik vulnerabilities hit CISA's urgent remediation queue, reinforcing that the systems closest to trust boundaries remain some of the most valuable places for attackers to land.
Join the discussionSep 26, 2026|Issue 8|Weekday|6 min read
Sometimes the strongest security control is simply turn it off
Kiteworks issues an extraordinary precautionary shutdown warning while Microsoft pushes Copilot toward persistent autonomous work, forcing enterprises to think harder about authority, identity and operational control.
Join the discussionSep 25, 2026|Issue 7|Weekday|6 min read
Vulnerability management is reaching a scaling limit
Exploited vulnerabilities continue to pressure remediation queues while CISA pushes CVE quality forward and AI infrastructure collides with the realities of networking, power, capital and observability.
Join the discussionSep 24, 2026|Issue 6|Weekday|6 min read
The systems with the most operational authority keep becoming the systems attackers want most
Ransomware-linked TeamCity exploitation, identity-focused social engineering, an exploited Zyxel switch flaw, and new OT supply-chain guidance all point to the same question: what can an attacker inherit after compromising the thing you trust?
Join the discussionSep 23, 2026|Issue 5|Weekday|6 min read
Security infrastructure itself is under pressure
Actively exploited flaws across F5, Check Point and SD-WAN management technology collide with a broader shift toward AI-orchestrated attacks and risk-based vulnerability management.
Join the discussionSep 22, 2026|Issue 4|Weekday|6 min read
AI is becoming an identity, an infrastructure consumer, and an attack surface
AI agents are gaining delegated authority while security vendors move toward autonomous defense, hyperscalers expand full-stack AI infrastructure, and cyber workforce programs emphasize practical execution.
Join the discussionSep 21, 2026|Issue 3|Weekday|6 min read
The developer is becoming the supply chain
Rust maintainers face targeted social engineering, CrowdSec confirms deeper supply-chain fallout, and Colorado water attacks show how inherited trust can cross into physical operations.
Join the discussionSep 20, 2026|Issue 2|Weekday|6 min read
The orchestrator is now the attack surface
Active exploitation hits workflow automation, SolarWinds patches an identity-management RCE, and the week closes with fresh lessons in developer trust, AI containment, and vulnerability overload.
Join the discussionSep 19, 2026|Issue 1|Weekday|5 min read
Three Linux kernel bugs land on KEV with a three-day fuse
CISA's newest additions give federal defenders until Monday, Check Point patches a root-level management flaw, and ransomware crews keep finding new ways to live off the land.
Join the discussion