Security · Infrastructure · Automation · AI
Security · Infrastructure · Automation · AI
Vulnerabilities, defensive security, architecture and operational security.
At least 15 JetBrains plugins posed as AI assistants while stealing provider credentials. The campaign shows why developer tooling needs central governance and short-lived secrets. Security company Aikido reported a coordinated set of malicious plugins in the JetBrains Marketplace. The…
France’s ANSSI has turned post-quantum cryptography from a distant research topic into a procurement and product-roadmap decision. France’s national cybersecurity agency, ANSSI, said that products without post-quantum cryptography would no longer be eligible to enter its security-qualification process from 2027.…
A ShinyHunters campaign against Oracle PeopleSoft environments shows how a business-critical application can become a repeatable data-theft route when it is exposed, customised and difficult to update. Google’s Mandiant team reported an active campaign by the ShinyHunters-linked group it tracks…
Unauthorised access to a World Food Programme registration system exposed data associated with roughly 600,000 Gaza households. In a conflict zone, ordinary identity and location fields can create extraordinary physical risk. The World Food Programme confirmed unauthorised access to its…
Cisco’s new infrastructure-security platform combines faster vulnerability research with runtime protections. It could reduce emergency patch pressure, provided temporary shields do not become permanent exceptions. Cisco announced an agentic platform for operating and defending critical IT infrastructure on 2 June.…
Google’s new AI Threat Defense portfolio aims to connect threat intelligence, exposure context and code repair. Its value will depend on whether organisations can govern the decisions between those stages. Google announced AI Threat Defense on 27 May, presenting a…
Microsoft’s multi-model agentic security system offers a credible glimpse of faster vulnerability discovery—but its strongest lesson is the combination of specialised agents, tools and human validation. Microsoft has presented a multi-model agentic security system that uses more than 100 specialised…
A coordinated compromise of npm and PyPI packages shows how trusted publishing, CI caches and maintainer identities can combine into an automated supply-chain attack. Security researchers reported a new “Mini Shai-Hulud” campaign on 11 May involving trojanised packages in the…
Two intrusions into Instructure’s Canvas platform show why a shared education service needs tenant-level visibility, tested fallbacks and careful treatment of attacker claims. Instructure detected unauthorised activity in Canvas on 29 April. On 7 May, the same actor obtained access…
Vercel’s April incident began with a compromised third-party AI application and ended inside internal systems. OAuth consent deserves the same scrutiny as a privileged integration. Vercel disclosed that an attacker gained unauthorised access to certain internal systems after compromising Context.ai,…