ai
Anthropic’s Mythos Is Real. The Victory Lap Isn’t.
Everyone wants the AI bug hunter. Nobody wants the patch clock that comes with it. Mythos may be real. So is the part where leisurely patching starts looking like a career-limiting hobby.
vulnerabilities
weekly
SIGNALS WEEKLY: When Trust Breaks- Pipelines, PLM, and Phishing at Scale
Everyone loves “shift left” until the thing in the pipeline shifts your secrets somewhere else. Security tooling has officially joined the attack surface like it was invited.
![[SIGNALS WEEKLY] Ransomware’s New Priority Targets—Hypervisors, Recovery Paths, and Control Planes](https://storage.ghost.io/c/06/e5/06e5730b-7d78-4713-9cec-6cba31d297f5/content/images/size/w600/2026/03/z-5.png)
weekly
[SIGNALS WEEKLY] Ransomware’s New Priority Targets—Hypervisors, Recovery Paths, and Control Planes
Ransomware crews aren’t stopping at endpoints. They’re going after hypervisors, backups, and control planes now. KEV keeps growing, exploitation stays hot, and defender timelines keep getting shorter. Lovely. 🔥💀⚙️
![[SIGNALS WEEKLY] GitHub, npm, and Fake Interviews: Why Developer Supply Chain Attacks Are Converging](https://storage.ghost.io/c/06/e5/06e5730b-7d78-4713-9cec-6cba31d297f5/content/images/size/w600/2026/03/zz-3.png)
weekly
[SIGNALS WEEKLY] GitHub, npm, and Fake Interviews: Why Developer Supply Chain Attacks Are Converging
2026 cyber lesson: attackers don’t need your prod box first. They want your dev, your repo, your package manager, and your CI runner. Force-pushes, fake interviews, poisoned installers. Real classy stuff. 🤡🔧🔥
weekly
SIGNALS WEEKLY: Seedworm in U.S. Networks, Coruna on iPhones, and a Patch Window Measured in Days
This week’s pattern is ugly and simple: Seedworm is reportedly already sitting inside multiple U.S. organizations, Coruna shows spy-grade iPhone exploitation bleeding into broader use, and KEV + March patch drops are shrinking defender response time from “soon” to “right now.”
weekly
SIGNALS WEEKLY: Cisco Catalyst SD-WAN Exploitation + OAuth Redirect Abuse + Prompt Injection Observed in the Wild
Edge + identity + AI = the new “oops.” 😬🧨🤖 ED 26-03 on Cisco Catalyst SD-WAN exploitation, OAuth redirect abuse that lands users in malware without token theft, plus Gemini panel hijack vs indirect prompt injection in the wild.
weekly
SIGNALS WEEKLY: How AI Is Turbocharging Attacks on 600+ FortiGate Firewalls
Your firewall isn’t the perimeter. It’s the onboarding portal. 🔥
weekly
SIGNALS WEEKLY: Active Ivanti EPMM Zero-Days — What Defenders Must Do Now
Your control plane isn’t infrastructure. It’s leverage. 🔥
weekly
SIGNALS WEEKLY: Pre-Filled Links That Poison AI Recommendations (and Memory)
Pre-filled AI prompt links: now a delivery vector. Microsoft warns they can poison assistant recommendations + memory. 🧠🧪
weekly
SIGNALS WEEKLY: ShinyHunters, Vishing, and the MFA Hijack Problem in SaaS
MFA isn’t “done.” It’s now the excuse attackers use on the phone. ☎️😈🔑 Vishing → MFA reset/re-enroll → post-login SaaS data grabs. Plus: selective Notepad++ updater abuse + proxy traffic making IP rep cry.
weekly
SIGNALS WEEKLY: Teams QR/callback phishing beats patching
KEV speedrun of the week 🏁: Office CVE-2026-21509 + WinRAR CVE-2025-8088. Patch anyway… then protect sessions 🍪 (Teams QR/callback lures 📱, SSO/SAML token abuse)
identity
No malware required: device-code phishing + Teams as the intrusion surface
No malware. Still owned. 🧾🔑💬 Device-code phishing + Teams as the “lobby” + stolen OAuth tokens = API-speed SaaS exfil. If you’re hunting binaries, you’re late.