Introduction
Every so often a vulnerability disclosure isn’t remarkable for its sophistication it’s remarkable for how ordinary it is. That’s the case with CVE-2026-42542, a newly disclosed flaw in TDengine, the open source time-series database used across manufacturing, energy, automotive, and IoT environments to store sensor and telemetry data. Researchers at Ridge Security put […]
This blog article is the second blog in a two-part series on the 2026 AI platform security incidents, and what they actually teach network defenders.
Why the most capable AI models refused to help defend against the attack — and what that tells us about AI-era network security
Here is a detail from Hugging Face’s […]
A two-part series on the 2026 AI platform security incidents, and what they actually teach network defenders
Part One: The Attacker Was the Model
What the 2026 Hugging Face intrusion actually teaches network defenders — and what the coverage got wrong
On July 16, 2026, Hugging Face published a security disclosure that read like the […]
Most people don’t think of a grocery store freezer as part of the cyberattack surface. Maybe we should.
Beginning August 26, 2026, refrigeration systems at Defense Commissary Agency (DeCA) stores across the United States began experiencing unusual failures. Public reporting has confirmed problems at multiple military installations, while independent researchers have tracked as many as […]
Here is the uncomfortable truth every security leader already suspects: the agencies found these weaknesses even in organizations “with mature cyber postures.” Not because those teams are careless, but because modern hybrid environments have grown too large, too interconnected, and too fast-changing for any human or any spreadsheet, or any static Visio diagram to fully […]
More than 73,000 FortiGate VPN devices have reportedly been linked to credentials exposed in the recently disclosed FortiBleed dataset. Security teams are understandably focused on the leaked credentials. They should be equally focused on what happens next.
A compromised VPN credential doesn’t create a breach on its own. A breach happens when an attacker uses […]
Yesterday, CISA Acting Director Nick Andersen stood up at a Washington, D.C. event and said something that should stop every vulnerability management team in their tracks:
“We’re really asking people to take more of a focus on risk associated with each vulnerability. Is it with an asset that is internet-exposed? Does it align to a […]
CISA doesn’t issue Emergency Directives lightly. When ED 25-03 landed last week — mandating immediate action for federal agencies and urging all U.S. organizations to respond — it came with a warning that should stop every security leader cold:
Patching your Cisco ASA/FTD devices will not remove this threat.
FIRESTARTER is a persistent backdoor specifically […]
How RedSeal’s preemptive exposure management uses empirical attack path analysis and workflow automation to help you lock down your enterprise before the next AI threat emerges.
The Mythos moment: Why everyone is freaking out
On April 7, 2026, Anthropic announced Claude Mythos Preview, and the cybersecurity world collectively held its breath. Here’s why:
Mythos […]
The Department of Energy just did something it has never done before.
On March 19, 2026, the Office of Cybersecurity, Energy Security, and Emergency Response (CESER) released its first-ever comprehensive five-year strategic plan. This isn’t just another government report—it’s a clear signal that the federal government expects measurable progress on energy infrastructure security, and it […]
