Security, CI/CD, infrastructure, observability, and reliability.
Six new vulnerabilities in protobuf.js allow attackers to execute arbitrary code and crash services by exploiting how the library handles untrusted schemas.
Attackers injected credential-harvesting malware into more than 70 Microsoft GitHub repositories, triggering inside AI coding assistants and exposing supply-chain fragility.
Threat actor "Solonik" dumps 17.5 million records, revealing how flawed password-reset triggers and weak API gateways enable trivial account hijacks.
Dashlane auto-suspended accounts to halt a May 31 brute-force campaign, triggering cascading 2FA failures, email glitches, and lingering access disputes that expose operational fragility.
CISA mandated a June 1 federal remediation deadline after researchers tracked active exploitation of a narrowly configured but structurally devastating authentication bypass in Palo Alto Networks’ GlobalProtect stack.
Russian-linked GREYVIBE weaponizes generative AI across its kill chain to target Ukrainian entities, demonstrating how skill compression enables low-sophistication operators to run high-volume, multi-vector campaigns.
ChatGPT's browser integration treats loaded webpages as authoritative input, allowing attackers to hide prompt injections in third-party markup. Ordinary sites become credential-harvesting traps that bypass traditional access controls.
CrowdStrike, Google, and Shadowserver severed all four C2 channels of the GlassWorm botnet, disrupting a supply-chain operation infecting over 300 GitHub repos and hijacking developer workstations since early 2025.
AWS terminated open-source strategy lead Tarus Balog, whose manual intervention had restored a deleted 10-year customer account, as the company shifts support operations toward automation. We examine the second-order costs of trading human stewardship for throughput.
