GitHub and PyPI Introduce Time-Based Defenses Against Supply Chain Attacks
GitHub and PyPI both introduced time-based security measures this month that deliberately slow down the software supply chain. The idea is simple: make it harder for attackers to push malicious packages into your dependencies before anyone notices. Dependabot now has a default three-day cooldown before opening version update pull requests. PyPI will reject new file […]
Hermes AI Agent Weaponized in Thai Finance Ministry Cyberattack
Attackers used the Hermes AI agent to automate post-exploitation activities against Thailand’s Ministry of Finance, marking one of the first documented cases of an AI agent being weaponized in a real-world state-targeted cyberattack. Security researchers at Hunt.io discovered the artifacts on a compromised C2 server. The operator installed Hermes Agent (by Nous Research), switched off […]
Microsoft Secure Boot Bypassed by Decade-Old Unsigned Bootloaders
ESET researchers have found 11 old Microsoft-signed UEFI shim bootloaders that let attackers bypass Secure Boot entirely. The bootloaders date back to 2013, version 0.9 and earlier, and Microsoft never revoked their signatures. Secure Boot was introduced with Windows 8 in 2012 as a hardware-level protection. It checks that only trusted, signed bootloaders run during […]
Slopsquatting, phantom domains, and HalluSquatting are the same AI attack
There is a flurry of names floating around for essentially the same attack: slopsquatting, phantom domains, and HalluSquatting. They all describe one thing – attackers registering domains that large language models hallucinate, then tricking developers or users into visiting those domains through AI-generated content. The core mechanism is simple. LLMs do not know the difference […]
Azure Monitor now protects AI telemetry with dedicated access controls
The problem: AI prompts in the wrong table If you’ve been sending AI application telemetry to Application Insights, your users’ prompts and LLM responses have been sitting in the same traces and custom events tables as your infrastructure logs. That means anyone with access to your Application Insights instance — typically the whole monitoring team […]
Fake Claude app on Bing ads delivers SectopRAT malware
How the attack works A malvertising campaign on Bing is pushing a fake Claude desktop app installer that delivers SectopRAT, a .NET-based remote access trojan. The campaign, tracked by researchers as FakeAgent, has been active since at least April 2026 and has compromised 29 organizations so far, according to Huntress and IT Security Guru reports. […]
Azure Monitor adds dedicated storage for sensitive AI telemetry
If you run AI powered applications on Azure, your Application Insights logs have been storing something you might not have thought about. Every prompt you send to an LLM and every response the model returns has been sitting in the same logs as your standard application telemetry, accessible to anyone with log read permissions. That […]
Microsoft Defender CSPM assessments for PostgreSQL Flexible Server are now GA
Microsoft Defender for Cloud has shipped generally available CSPM (Cloud Security Posture Management) assessments for Azure Database for PostgreSQL Flexible Server, giving teams automated security evaluations that run continuously against their PostgreSQL deployments. The assessments are part of Microsoft Defender for Cloud’s CSPM framework, which evaluates Azure resources against security baselines and best practices. The […]
Microsoft Defender CSPM for Azure PostgreSQL Flexible Server Hits GA
Microsoft Defender for Cloud now includes generally available CSPM assessments for Azure Database for PostgreSQL Flexible Server, giving Postgres users continuous security posture evaluations without setting up additional monitoring infrastructure. What the assessments cover The assessments check your PostgreSQL Flexible Server instances against a set of security baselines published by Microsoft. These cover the usual […]
Microsoft Defender CSPM assessments for Azure PostgreSQL reach GA
Microsoft has released the general availability of Defender Cloud Security Posture Management (CSPM) assessments for Azure Database for PostgreSQL Flexible Server. If you run PostgreSQL on Azure, this changes how you track security compliance. Instead of writing custom queries or maintaining spreadsheets, you get automated, continuous evaluations that surface in the Defender dashboard. What CSPM […]
Securing RAG with Microsoft Purview Sensitivity Labels in Azure AI Search
Azure AI Search has added support for Microsoft Purview sensitivity labels in public preview, and this is one of those features that addresses a real blocker for enterprise AI adoption. The problem is simple: if you ground your AI agents in documents that include confidential information, you need a way to keep that information out […]
Network Security Perimeter for Azure Event Hubs Reaches GA, Simplifying Network Isolation
Network Security Perimeter Support for Azure Event Hubs Reaches GA Azure Event Hubs now supports Network Security Perimeter (NSP) at general availability, giving organizations a way to define logical network isolation boundaries for their event streaming infrastructure without resorting to complex firewall rules or private endpoint sprawl (source). For anyone running event-driven architectures on Azure, […]