Friday Squid Blogging: Increasing Squid Populations
This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures. As usual, you can also use this squid post to tal
Threat Research
In-depth threat intelligence and security research from Palo Alto Unit 42, Cisco Talos, Mandiant, Check Point, CrowdStrike, and other leading intelligence labs.
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mi
Compromised TLS Certificates
The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys : The compromised eMudhra keys were defective at a level that’s challe
Preparing for 2027: Five Trends Shaping Enterprise Threat Intelligence
As AI accelerates cybercrime and reshapes enterprise security priorities, Flashpoint experts examine what threat intelligence teams need to prepare for in 2027.
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments. T
Best practices for integrating IAM Roles Anywhere with your PKI
Using temporary credentials is a security best practice to reduce the risk from credentials getting compromised. With AWS IAM Roles Anywhere, now your workloads
Your AI agent fixed the bug, but what else did it change?
Today we’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents. Our patchin
Workshop on Economics and Information Security (WEIS) Archive
There’s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS). Really nice resource. It̵
ConnectWise customers hit by supply-chain attack linked to compromised API secret
Hundreds of customers are confirmed impacted, as attackers use a sensitive credential to break into connected Microsoft 365 applications unimpeded. The post Con
19th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 19th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES CenterPoin
Agents are your newest insiders. Security must move at their speed.
New capabilities in Microsoft 365 E7 and Project Perception help organizations contain agent risk and adapt protection continuously. The post Agents are your ne
Friday Squid Blogging: Squid Before the Chicxulub Meteor Impact
New research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event. As usual, you can also use this squid post
Managing open-weight model risk in enterprise deployments
New whitepaper from Microsoft and NVIDIA helps enterprises manage open-weight AI model risks with a shared taxonomy, evaluations, and controls. The post Managin
Backdooring Open-Weight AI Models
This is a problem: Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abli
AWS Security Agent (now part of AWS Continuum) exploited 33 of 37 new real-world CVEs
We applied AWS Security Agent (now part of AWS Continuum), our autonomous penetration-testing agent, to 37 real, recently disclosed Common Vulnerabilities and E
Penetration testing every deployment with AWS Continuum
Most security tooling that fits into a CI/CD pipeline—static analysis (SAST), software composition analysis (SCA), and dynamic scanners (DAST)—flags potential i
Cyberattack on Connected Fridges in France
Another IoT cyberattack , this one in France: Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators (tracked as Storm-2990), and an illicit mark
Fake Calendly “Meta Careers” pages steal Facebook and Google logins
An interview invitation becomes a trap for your Facebook and Google passwords, even with two-factor authentication turned on.
Package managers have an integrity problem
I tested 25 of the most popular package managers to check whether they detect a compromised package repository injecting malicious code into legitimate packages
Get Deeper Threat Research Intelligence
The CyberHawk platform goes far beyond news. Scan indicators, track active campaigns, monitor infostealer feeds, and access a complete analyst toolkit — all free to join.
IOC Scanner — 3.6M+ indicators
Live IOC Feed — filterable threat data
Infostealer Intelligence — live cred logs
Live Threat Map — real-time attacks
MISP Threat Feeds — CIRCL, Feodo, more
GitHub Arsenal — security tools library
Security Blog — deep-dive research
Video Courses — training and education
SOPs — SecOps procedures
Analyst Library — references and toolkits