supply chain
UK proposes 14-year jail terms for subsea cable saboteurs
Damaging a cable on the seabed off the UK coast could soon cost someone 14 years of their life behind bars, under plans the British government published this week. The …
Say a few words, and a rigged AI asks for $5,000
Researchers at Imperial College London tampered with speech-to-text models so they transcribed most speakers accurately and misbehaved for one chosen person. When that person …
DevGuard: Open-source vulnerability management for the software supply chain
DevGuard is a free, open source vulnerability management platform that collects a software project’s security findings in one place, ranks them by risk, and tracks them. …
Europe’s technology backbone is becoming a cyber target
Disruptive attacks on public-facing services, financially motivated cybercrime and compromises of shared technology providers are increasing cybersecurity risks across Europe. …
One runaway AI agent racked up a $50,000 cloud bill
Organizations are deploying autonomous AI systems that execute API calls, optimize production configurations, and analyze telemetry across hybrid cloud environments. At the …
What breach and attack simulation needs to become in the AI era
Breach and attack simulation (BAS) has always had a supply chain. Somebody has to read the threat report, pull out the techniques, and turn them into something that will …
Most of the bugs Claude Mythos found have never been checked by a human
Anthropic pointed Claude Mythos Preview at 281 open-source projects and collected 23,019 candidate vulnerabilities. External security firms reviewed 1,900 of them. Maintainers …
Ransomware attackers are zeroing in on mid-market companies
Mid-sized companies accounted for 73% of publicly disclosed ransomware and data-extortion incidents with known revenue in North America and Europe between January 2023 and …
GitHub Dependabot malware alerts now cover eight ecosystems
GitHub has flagged npm malware since March 2026. Anyone pulling in a bad PyPI, Maven, RubyGems, NuGet, Go, crates.io, or PHP Composer package has had no such warning, because …
Chainloop: Open-source evidence store and policy engine for the software supply chain
Chainloop is an open source evidence store for the software supply chain. A command line tool runs inside a GitHub Actions, GitLab, Jenkins, or Dagger pipeline, picks up what …
Suppliers, logins, and AI tools are all becoming attack paths
Cybercriminals and state-backed hacking groups are abusing trusted identities, cloud services, AI tools, and software supply chains to gain access while avoiding detection, …
The energy sector’s OT cybersecurity talent is retiring faster than it can be replaced
A ransomware hit lands a chemical plant in a safe state. Nobody is hurt, the site holds steady, and the operators begin the restart. The systems stay down. Every attempt to …
Featured news
Resources
Don't miss
- Microsoft 365 accounts compromised at 79 organizations, no passwords needed
- Hackers hijack exposed AI models to launch cyberattacks at victims’ expense
- Drone program compliance: What a CTO says most agencies get wrong
- LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
- OpenAI’s coding agents talked themselves out of being monitored