A hacker infected one Suno employee with a worm and walked out with the source code. It did not catch the company lying. It turned a legal abstraction into an inventory with hours and row counts, in the middle of litigation.
Two Scattered Spider members were jailed for five and a half years each on 16 July over the Transport for London attack. TfL paid no ransom. The 29 million pounds went on recovery, and the way in was a helpdesk call.
xAI published Grok Build under Apache 2.0 after a wire-level test found it uploading private repositories. The release has one squashed commit, a stubbed upload function, and no bucket name. Open sourcing is not an audit.
ESET found eleven old Microsoft-signed bootloaders that slip past Secure Boot on almost any PC, with no admin rights needed. Patching them is the easy part. Here is the exposure most fleets never audit.
Microsoft fixed 570 flaws on 14 July, nearly three times its June record. Two are already exploited, and a BitLocker bypass weakens your breach defence.
Microsoft stops delivering SMS and voice MFA codes in Entra ID on 1 February 2027 and makes passkeys the default from 1 September 2026. The retirement date is fixed, but the price of the only alternative is not published until 18 September, so the migration has to be planned before the fallback can be costed.
The EU and UK sanctioned 33 Russian targets and named FSB Centre 16 for the attack on Poland's grid. On the same day, thirteen nations warned the way in is your router - and a 2008 Cisco flaw got a three-day patch clock.
A wire-level analysis found xAI's Grok Build CLI uploaded entire repositories, including a tracked .env file with live keys, to an xAI storage bucket - and the privacy toggle did not stop it. What every team that ran it owes its customers now.
Zimbra patched a critical stored XSS in its Classic Web Client that lets a crafted email run code in your session. Google TAG reported it. Upgrade to ZCS 10.1.19.
On Jul 8 2026 a trusted contributor's account pushed a backdoor into 18 npm packages through Injective Labs' own OIDC pipeline. Here is what owners should check.
Progress Software told ShareFile customers to physically shut down on-prem Storage Zone Controllers over a credible threat. No patch, no CVE. What owners should learn.
Microsoft shipped an out-of-band patch for RoguePlanet (CVE-2026-50656), a flaw in the Windows Defender scanning engine that lets a local user climb to SYSTEM on Windows 10 and 11. Because the fix ships through Defender's own silent engine update, the task is to verify the build, not assume the antivirus has you covered.
Page 2 / 5
One considered note on infrastructure, governance, and measurement, most mornings. No theory.