Posts

🟡 Medium | Source: The Register — Security Homebrew 6.0 has been released with a new security mechanism and a Linux sandbox, addressing longstanding concerns about the package manager’s vulnerability to supply chain attacks. The project lead noted that Homebrew has historically been more exposed than npm, making these improvements significant for developer environments. The update represents a meaningful step forward in hardening a widely used tool in macOS and Linux development workflows. ...

🟡 Medium | Source: Schneier on Security The US federal government has disclosed 3,611 active or planned AI use cases across agencies, a 70% increase from the previous administration, covering sensitive areas including public health, individual freedoms, and nuclear safety. This represents a significant and largely unscrutinised transfer of consequential decision-making from humans to automated systems. The scale and pace of deployment raises serious concerns around accountability, auditability, and the absence of robust AI governance frameworks. ...

🟡 Medium | Source: The Register — Security Dutch police have arrested six individuals, including a 15-year-old, suspected of running a helpdesk fraud operation that combined phone-based social engineering with in-person house visits to convince victims their bank accounts were compromised. By physically attending victims’ homes, fraudsters added a veneer of legitimacy to their scams, making it easier to extract banking credentials or cash. The case highlights an escalating tactic where cybercriminals blur the line between online fraud and physical deception. ...

🟡 Medium | Source: The Register — Security A Python developer narrowly avoided installing a malicious or destructive package after their instincts — backed by an AI assistant — flagged the repository as suspicious before installation. The incident highlights the growing risk of supply chain attacks via third-party Python packages, where a single compromised or typosquatted library can cause significant system damage. AI tooling is beginning to play a practical role in catching threats that human attention alone might miss. ...

🟡 Medium | Source: AWS Security Blog Subdomain takeover occurs when DNS records point to resources that no longer exist, allowing attackers to claim those resources and serve malicious content under a legitimate domain. This is a well-known but frequently overlooked risk in cloud environments where infrastructure is regularly provisioned and decommissioned. The AWS Security Blog post explains how to identify dangling DNS records and use AWS services to prevent or mitigate this attack vector. ...

🟡 Medium | Source: Microsoft Security Response Center CVE-2026-45602 is a tampering vulnerability affecting the Windows Dynamic Host Configuration Protocol (DHCP) service. This update is an informational change only, correcting the CWE classification with no change to severity, patch status, or exploitability. No new action is required as a result of this revision. Security Architect’s Take: No immediate action is required from this update — verify that any existing mitigations or patches applied for CVE-2026-45602 remain in place, and update internal vulnerability tracking records to reflect the revised CWE classification. ...

🟡 Medium | Source: The Hacker News A new survey reveals that 94% of security incidents involve anonymised infrastructure such as VPNs, proxies, and hosting services, making it difficult to attribute attacks to real threat actors. Despite access to large volumes of IP enrichment and threat intelligence data, most security teams remain reactive rather than proactive. The core problem is signal-to-noise ratio — too much data, too little actionable context. Security Architect’s Take: Review your threat intelligence pipeline for coverage of anonymising infrastructure (e.g. Tor exit nodes, residential proxies, bulletproof hosting ASNs) and ensure your SIEM or SOAR rules treat traffic from these sources with elevated suspicion by default. Consider integrating purpose-built IP context providers that specialise in anonymisation detection rather than relying solely on generic reputation feeds. ...

🟡 Medium | Source: Schneier on Security Law enforcement officers in the United States have been found abusing Flock Safety’s automated licence plate recognition (ALPR) camera network to stalk individuals, with over a dozen cases recorded nationally. Flock cameras are widely deployed by police departments and private communities, making insider misuse a significant concern. The pattern highlights how privileged access to surveillance infrastructure can be weaponised for personal misconduct. Security Architect’s Take: If your organisation integrates with third-party physical surveillance or data-sharing platforms such as Flock, audit who holds query access and ensure all lookups are logged, attributed, and subject to anomaly detection — excessive or off-hours searches by a single user should trigger alerts, mirroring the least-privilege and monitoring controls you would apply to any sensitive cloud data store. ...

🟡 Medium | Source: The Register — Security The Federal Data Center Enhancement Act (FDCEA) of 2023, which sets security and sustainability standards for US federal datacentres, is set to lapse with no replacement legislation in sight. The regulatory gap leaves federal datacentre operations without a clear statutory framework governing security baselines and environmental requirements. For organisations operating within or supplying to the US federal cloud ecosystem, this creates uncertainty around compliance obligations and security assurance expectations. ...

🟡 Medium | Source: The Hacker News Many organisations issue temporary passwords during employee onboarding that are shared over insecure channels such as email or SMS, and often never changed. These credentials can persist indefinitely, be reused across multiple accounts, and represent an easily exploitable entry point for attackers. The risk is compounded at scale, as every new hire represents a potential window of exposure if the process is not tightly controlled. ...