Two of China's most respected hedge fund managers called the global AI rally a super bubble. Here is why that warning is actually good news for security and what a correction would do to the companies running on narrative versus the ones solving real problems.
OpenAI previewed GPT-5.6 Sol, their most capable model for cybersecurity yet. Exploitation primitives in Chromium and Firefox, U.S. government gating, and why the attacker-defender symmetry means continuous testing is no longer optional.
FulcrumSec claims 1.3 TB stolen from Novo Nordisk, including source code, the exact Ozempic formula and clinical trial data on roughly 11,500 patients. Initial access came from one GitHub token, two months of dwell time, and a lot of lessons every engineering org should take from it.
SpaceX's all-stock acquisition of Anysphere reshapes the software supply chain at a global scale. Known CVEs, prompt injection vectors, developer telemetry risks, and a hardening checklist for every team running Cursor in production.
Three days after launch, the U.S. Commerce Department ordered Anthropic to disable Fable 5 and Mythos 5 worldwide. The jailbreak that triggered it, the export control precedent it set, and what security teams must do now.
A threat actor claims to hold a massive iFood customer database and is demanding payment to suppress it. The pay-or-leak model, why CPF and contact data is dangerous, and concrete steps for businesses and customers.
How attackers use AI across the kill chain, what new risks AI adoption creates, why traditional pentests fall short, and how pentesty.co tests against AI-driven TTPs.
Misconfigurations still dominate cloud incidents. Hybrid sprawl, IAM as a frontline, and why checklist security misses real attack paths. Plus how cloud-aware pentesting closes the gap.
White-on-white text in a labor court petition targeted Brazil's judicial AI (Galileu). The judge called it prompt injection, imposed a fine, and referred the lawyers for discipline — a field lesson in indirect injection for any org that feeds external documents to LLMs.
Five phases from access to leak, why exfiltration-only extortion scales, what makes detection hard, and concrete controls — from cloud permissions to continuous pentesting.
After ShinyHunters leaked internal analytics in April 2026, the case became a textbook argument against paying extortion: scope, optics, legal risk, and what to build before the deadline hits.
The bank confirmed unauthorized access to international-account data after a cyberattack. Why finance is targeted, what clients should do today, assume-breach design, LGPD/GDPR angles, and why compliance is not the same as security.
ShinyHunters claimed 1.4M users hit with a pay-or-leak ultimatum. What was exposed, why learning platforms are targeted, credential reuse risk, and concrete steps for users and defenders.
A CVSS 9.8 CRLF injection in cPanel & WHM session loading granted unauthenticated admin access. Patch table, suspected zero-day timeline, and what to run on your servers today.
What the Anthropic frontend-design skill is, why it beats default AI layouts, how to install it, and how to pair it with a real brand kit so Claude Code ships UI with a point of view.
A practical walkthrough of every OWASP Top 10 category from the perspective of someone building software — what is happening in your code, and what a safer version looks like.
Most pentest reports are optimized for completeness, not clarity. Here is why that happens, what a good report looks like, and how to get more value from your next security assessment.