What permissions are developers granting to Claude Code, and could those permissions pose a risk if the coding agent were exposed to malicious inputs? To answer this question, we turned to GitHub, the website where developers go to share their… Read More "YOLO Mode: Hidden Risks in Claude Code Permissions"
A critical vulnerability in the Cline Kanban server has been disclosed that allows any website a developer visits to silently exfiltrate workspace data, inject commands into the AI agent’s terminal or kill active agent sessions. The flaw, given a CVSS… Read More "Cline Kanban Flaw Lets Websites Hijack AI Coding Agents"
Humans have always sought to streamline productivity through the most convenient solutions available, prioritizing speed to stay ahead and gain an edge over the competition. From the assembly line to the cloud, the goal remains the same: do more with… Read More "Productivity at a Price: The Rising Cost of AI Convenience"
The bug tracker entry that contains the technical details was accessible long enough to be archived by users, and a copy can be easily found online even though the original entry is now set to private again. The flaw abuses… Read More "Google leaks details for Chromium bug that can turn browsers into bots"
Traditional network security tools are inhibiting firms from adequate data security as a majority of IT leaders report that data security has never been more critical. A new report, commissioned by Capital One Software with research conducted by Forrester, found… Read More "Legacy Security Tools Failing Data Protection"
Organizations face a complex cybersecurity conundrum. Attack surfaces are expanding faster than SOC teams can scan. All of which is leading to a never-ending cycle of swivel-chair security, context-free lists, increased alert fatigue, and slow remediation. The strategic pivot needed… Read More "A Practical Approach to Continuous Threat Exposure Management"
Security researchers at Varonis have uncovered a new information stealer malware (infostealer) strain that harvests browser credentials, session cookies and crypto wallets before quietly sending everything to the attacker’s server for decryption. Called Storm, the infostealer emerged on underground cybercrime… Read More "New ‘Storm’ Infostealer Remotely Decrypts Stolen Credentials"
The thing about blanket approaches is that they rarely work or scale. The same holds true for third-party cyber risk management. Treating every provider, stakeholder, or partner with the same intensity is neither productive nor cost-effective. While defaulting to treating… Read More "The Vendor Tiering Series: Why Tier Your Vendors"
A credential theft campaign that targeted C-suite executives and senior personnel at major global organizations from November 2025 to March 2026 has been uncovered by researchers at Abnormal. They have detailed a previously undocumented phishing-as-a-service (PhaaS) platform called Venom that… Read More "New Phishing Platform Used in Credential Theft Campaigns"
In the world of Risk Management, speed is often the enemy of thoroughness. Security teams are stretched thin, acting as “human APIs” by manually moving data between spreadsheets, ticketing systems, and risk dashboards. Today, we are thrilled to announce the… Read More "Announcing Risk Automations: From Discovery to Resolution In Seconds"
