4+ hour, 49+ min ago   (209+ words) Permify is an open-source authorization service that answers access questions at run time: can user X view document Y, which posts can members of team Y edit. It keeps those rules in one place, apart from the application code that…...

4+ day, 4+ hour ago   (730+ words) Credential harvesting on developer machines has widened. Earlier infostealers worked from a short list of known targets, mostly browser stores and a few cloud credential paths. The families active now cast a much wider net. Shai-Hulud, for instance, ran a…...

4+ day, 20+ hour ago   (21+ words) Orchid Security adds drift detection and kill switches for AI agents to help enterprises control access as autonomous AI adoption scales....

1+ week, 1+ hour ago   (324+ words) A file transfer flaw in ScreenConnect Remote Access Support and Access sessions affects both Cloud and On-Premise deployments, ConnectWise confirmed. “A CVE identifier and an official fix will be issued within the week,” the company wrote in its September 3 advisory....

1+ week, 4+ hour ago   (243+ words) ToolHive is an open-source platform that runs Model Context Protocol servers inside containers. An MCP server is the connector that lets an AI client like Cursor or Claude Code reach an outside tool, and Stacklok ships ToolHive under Apache 2.0, so…...

1+ week, 4+ day ago   (235+ words) Seemplicity announced Response Options for vulnerability management and exposure management workflows. This new capability gives security teams multiple, actionable paths to closing a vulnerability finding based on context. The problem Response Options addresses is straightforward: the complete fix (a patch,…...

1+ week, 4+ day ago   (354+ words) There are five lessons that survived production and none of them care whether you are ingesting package malware reports, OSV records, or ISAC indicators. If community data feeds your automation, they apply to you. Provenance belongs on the same shelf…...

1+ week, 5+ day ago   (323+ words) Colin Watson is CTO at Stratus Security and works the engagements himself. “For example, on my most recent pentest there were thousands of credentials in Jira ticket comments found by this tool and their pentester for 5 years prior had never…...

2+ week, 4+ hour ago   (230+ words) Raw arguments never enter a record. Values get hashed and kept as a redacted summary, and the redaction is pattern matching against common secret and personal-data formats. The package has no runtime dependencies and runs about 5,300 lines of Python, which…...

2+ week, 5+ day ago   (220+ words) The Linux Foundation announced the contribution of TRACE (Trust, Runtime Attestation and Compliance Evidence), from OPAQUE. Collaboratively developed by AMD, Intel, Microsoft, OPAQUE and the Technology Innovation Institute (TII), TRACE creates a standard, open evidence layer that enables reliable governance…...