1Password's Off-by-1 Labs tested Claude Code (Opus 4.8) and ChatGPT (5.5) patching six real-world high-severity CVEs across varied prompting styles and found both models produced successful, clean patches at low rates. The issue is that frequently they were fixing only a subset of vulnerable code paths, adding fragile guard code, or subtly altering application behaviour, and occasionally introducing new vulnerabilities.

JetBrains disclosed a security incident affecting Cadence, its PyCharm-integrated cloud compute service, after confirming exploitation of critical TeamCity vulnerability CVE-2026-63077. Affected users' email addresses, project source code, and credentials were potentially exposed.

Elastic's InfoSec team describes how enriching a three-agent SOC triage pipeline with per-rule investigation guides, user risk data, and 30 days of historical case verdicts lifted AI alert accuracy from 60% to 92%, enabling analysts to close most alerts with a single Slack button click.

A downloadable multi-source log dataset built around a 7-phase GitHub Actions cache poisoning → Kubernetes → AWS attack chain, used to benchmark agentic SOC harnesses.

How ETW's trust model and event-capping behavior can be exploited from unelevated user mode to inject fake telemetry into EDR pipelines (including Microsoft Defender for Endpoint) or flood providers to create detection blind spots, with MSRC only partially addressing the reported issues.

Post which details an evolved Kimsuky (Operation GitPower) campaign using 13 malicious LNK files that deliver obfuscated PowerShell via GitHub PAT-based C2 and Pastebin, with decoy documents mass-produced using the AI agent opencode.

This AI threat update provides GTIG's findings on adversarial misuse of AI including Gemini and other non-Google tools.

Microsoft researchers discovered a high-volume phishing campaign that repurposed ASCII smuggling to split financial keywords like "funding" and evade email filters, generating over 2.3 million messages daily at its February 2026 peak.

A TOCTOU bug in Firecracker's jailer process (aarch64-only, now patched) prompted exploration of post-exploitation defenses: Firecracker's seccomp policy is undermined by its own allowance of io_uring, which lets attackers bypass filtered syscalls entirely.

Track OAuth 2.0, OIDC, and Microsoft Entra ID tokens across captured network traffic. You can also check out the companion blog post.

CLI for SQLite Databases with auto-completion and syntax highlighting.

Gives criticality score for an open source project.

AI-driven vulnerability discovery and live validation.

AWS's Security Incident Response Team (SIRT) walks through two real-world CloudTrail investigation scenarios, cross-account S3 data deletion with ransomware implications and cryptocurrency mining via stolen console credentials, teaching investigators how to read key log fields, recognize attacker patterns, and apply practical response checklists. You can also check out Part 2.