Posts

🟡 Medium | Source: The Hacker News GitHub has introduced a default three-day cooldown period in Dependabot, delaying automated pull requests for newly published package versions. This gives time for the security community to identify poisoned or malicious packages before they are automatically adopted into codebases. The cooldown is configurable via dependabot.yml for teams with different risk tolerances. Security Architect’s Take: Review your organisation’s dependabot.yml configurations and consider whether the default three-day cooldown is appropriate or whether a longer window — such as seven days — better balances security and velocity for your projects. Pair this with private registry mirroring and package integrity checks to further reduce supply chain risk. ...

🟡 Medium | Source: The Register — Security Europol has identified 4,340 URLs associated with ‘The Com’, a loosely organised online network linked to serious violent crime, cybercrime, and the radicalisation of young people. The operation aims to disrupt the group’s ability to recruit members and spread harmful content across online platforms. This highlights the growing intersection between cybercriminal communities and real-world violence, raising concerns for organisations about insider threat vectors and platform misuse. ...

🟡 Medium | Source: The Hacker News As AI agents become embedded in cloud environments, security teams are discovering that simply monitoring what agents are doing is insufficient — enforcing strict controls over what they are permitted to do is the real challenge. Implementing least-privilege principles for AI agents is proving far more complex than traditional workload identity, due to the dynamic, intent-driven nature of agent actions. A range of emerging approaches, from prompt filtering to identity-layer access controls, are being explored but no single standard has emerged. ...

🟡 Medium | Source: Schneier on Security Bruce Schneier and Barath Raghavan propose a new AI evaluation metric called the ‘Genie coefficient’, which measures the gap between what a user literally requests and what they actually intend. Current AI benchmarks assess capability but ignore whether systems respect implicit human assumptions and constraints. This matters for security because AI agents acting on misaligned intent can take harmful or unintended actions even without being explicitly instructed to do so. ...

🟡 Medium | Source: The Register — Security Researchers demonstrated an attack technique involving AI agents deployed via OpenAI and Hugging Face platforms, showing that agents can be manipulated into performing malicious actions when prompted or instructed to do so. The research highlights that the threat lies not in the agent frameworks themselves, but in how they are configured, prompted, and governed. This matters because organisations are rapidly deploying AI agents in cloud environments without adequate guardrails or security controls. ...

🟡 Medium | Source: Schneier on Security A new academic paper revisits the long-running ‘Going Dark’ debate, tracing encryption policy from the 1990s Crypto Wars through to today’s controversies around end-to-end encryption (E2EE). It examines government efforts globally to mandate lawful access backdoors into E2EE systems and the technical and policy implications of doing so. This matters because proposed legislation in multiple jurisdictions could directly affect how cloud platforms and messaging services handle encrypted data. ...

🟡 Medium | Source: The Hacker News Google has introduced selfie video verification as an additional account recovery option for users locked out of their accounts, supplementing existing methods such as recovery email and phone number. The feature uses biometric video matching to confirm identity during the recovery process. Whilst designed to improve legitimate user access, it introduces a new biometric attack surface that security teams should be aware of. Security Architect’s Take: Review your organisation’s Google Workspace account recovery policies to assess whether selfie video recovery can be enabled or restricted at the admin level, and evaluate the risk of deepfake or presentation attacks being used to bypass recovery controls for privileged accounts. ...

🟡 Medium | Source: The Register — Security OpenAI’s attempt to undermine Hugging Face and open-source AI models appears to have backfired, highlighting the growing competitiveness of open Chinese AI models. The incident raises questions about whether closed, guardrailed models are truly safer, as they may introduce harms whilst lacking the flexibility to remediate them. This matters because it signals a shift in the AI landscape with significant implications for how organisations choose and trust AI platforms. ...

🟡 Medium | Source: The Register — Security OpenAI’s attempt to discredit open-source AI models on HuggingFace appears to have backfired, highlighting how closed models with safety guardrails can still produce harmful outcomes whilst lacking the flexibility to remediate issues they create. The incident underscores growing confidence in open Chinese AI models as viable alternatives to Western closed-source offerings. This raises important questions for organisations relying on proprietary AI guardrails as a primary security control. ...

🟡 Medium | Source: AWS What’s New Amazon has released quarterly security and critical updates for Amazon Corretto, its free OpenJDK distribution, covering versions 8 through 26. This release also shifts the default Docker images from Amazon Linux 2 to Amazon Linux 2023, and removes JavaFX binaries from Corretto 8. Organisations running Java workloads on AWS should apply these updates to address known security vulnerabilities in OpenJDK. Security Architect’s Take: Prioritise updating all Corretto deployments to the latest patched versions, particularly in container environments — and validate that any Corretto 8 Docker images are rebuilt against Amazon Linux 2023 or explicitly pinned to the AL2 non-default variant if migration is not yet feasible. If your pipelines depend on JavaFX within Corretto 8, plan remediation now as binaries have been removed from this release. ...