Category: Technology
-
AI coding tools are changing far more than how quickly developers can produce code. They are changing the economics of the pull request itself. A pull request once represented a meaningful amount of authoring effort: a developer had to inspect the repository, make a set of changes, run tests, write a description, and submit the…
-
A Software Bill of Materials can answer one of the hardest questions in software security: what is actually inside this product? That answer has real operational value. When a new vulnerability appears in a widely used library, an SBOM can help an organization determine which applications contain the affected component without manually inspecting every product.…
-
Ransomware used to create a fairly direct technical problem: attackers encrypted production data, defenders restored it, and the organization tried to resume operations. Modern ransomware crews have spent years attacking that equation. Rather than leaving recovery infrastructure untouched, operators increasingly target backup systems, virtualization platforms, identity services, storage, snapshots, recovery documentation, and the administrative accounts…
-
Vulnerability management has a math problem. In 2024, the CVE Program published 40,077 vulnerability records. In 2025, that figure climbed to 48,244. By the end of the second quarter of 2026, another 35,872 records had already been published, with Q2 alone accounting for 20,709 CVEs compared with 15,163 during Q1. Those figures describe a disclosure…
-
Enterprise security programs tend to concentrate on the systems that generate the most visible risk: user workstations, servers, cloud workloads, identity providers, and core network infrastructure. Those systems receive endpoint detection, vulnerability scanning, centralized logging, configuration management, and routine incident-response coverage. Yet the same environment can contain hundreds or thousands of devices that sit outside…
-
Microsoft’s September 2026 Patch Tuesday addresses 973 vulnerabilities across Windows, Microsoft Office, SQL Server, Exchange Server, SharePoint Server, Azure, and developer tools. Two vulnerabilities are confirmed to have been exploited as zero-days, making them immediate patching priorities despite both carrying an Important severity rating. The scale of the release significantly exceeds August’s 400 vulnerabilities and…
-
AI coding tools started with a fairly narrow promise: help developers write software faster. Early systems completed functions, suggested syntax, generated tests, and explained unfamiliar code. That framing is already becoming outdated. Modern coding agents can inspect entire repositories, execute commands, interact with development tools, test their own output, search external information, maintain context across…
-
For years, ransomware disruption had clear technical targets. Investigators could seize servers, sink domains, remove leak sites, or take control of negotiation portals. Those actions could break parts of the criminal operation and force operators to rebuild. DeadLock shows a different design. Its extortion process spreads key functions across blockchain services, encrypted messaging, local HTML…
-
A threat actor can use legitimate credentials, approved administrative tools, trusted cloud services, and normal network paths without ever dropping an obvious piece of malware. In that kind of intrusion, the audit trail may be the only record showing that legitimate access became malicious activity. Security programs tend to treat audit logging as foundational infrastructure…
-
Classified and regulated environments are often built around stronger access restrictions, tighter configuration management, formal authorization processes, segmented networks, controlled software baselines, and stricter handling requirements than conventional enterprise systems. Those measures can reduce exposure and limit the number of paths available to an attacker, but they do not eliminate the possibility of credential theft,…
