Researchers uncover Miasma, a supply chain attack toolkit spreading via GitHub that steals credentials, infects packages, and hijacks AI coding tools.

Indie musicians sue Google, claiming YouTube uploads trained the Lyria 3 AI music model without consent, while Google cites its broad licensing terms.

North Korean hackers run the UNK_DeadDrop campaign, using fake job offers and GitHub repos to plant malware and steal crypto from developers.

Google issues an urgent Chrome update fixing 74 flaws, including an actively exploited V8 zero-day CVE-2026-11645 affecting Windows, macOS, and Linux.

Google released a Chrome security update to patch several critical vulnerabilities. Protect your system from active threats and update your browser now.

Apache CXF security update fixes CVE-2026-50634, CVE-2026-50633, and CVE-2026-50628, addressing JNDI injection, OAuth2, and signature flaws.

Apple removes the AFP protocol in macOS 27 after 40 years and urges users to switch to the modern SMB3 standard for secure, cross-platform file sharing.

Developers testing iOS 27 found AirDrop transfer speed up 220%, cutting a 3.5GB file transfer from 2 minutes 11 seconds down to just 41 seconds.

Google confirms a Pixel reboot loop bug after March, April, and May updates, with no fix yet and support suggesting a factory reset that wipes user data.

New updates patch critical Spring security vulnerabilities, mitigating cross-site scripting and server-side request forgery risks across multiple versions.

Chrome security update to version 149 patches 28 flaws, including critical CVE-2026-12007, CVE-2026-12008, and CVE-2026-12010 bugs.

And the Patterns That Prevent Them

Single unvalidated request header can become an execution vehicle for password poisoning and server-side exploitation.

From deobfuscating JS code to root ‘CVE-2023–0386’

Following on from my last write-up, I came across a CTF room that focuses specifically on hash cracking. I recommend this room in…

What does a real SOC investigation look like? Here is one from start to finish.

It is yet another day in this parallel universe of security, where the devices we bolt onto the edge of our networks to keep the bad people out are, with remarkable consistency, the exact thing that let the bad people in.

While we’ve seemingly had a breather…

Not everything broken is a vulnerability. Here’s how to know the difference.

Linux System IAM

So far in this series, we’ve learned how networks work.

A real-world case study on WAF evasion techniques and stored cross-site scripting vulnerabilities