npm adds a 72-hour hold after recovery-code sign-in
All npm accounts now receive a 72-hour hold after recovery-code authentication to slow account takeovers.
npmsecurity2FA
Topic
Cyber threats
Vulnerabilities, ransomware, phishing and incident response.
This topic connects security alerts with operational decisions: actual exposure, patch priorities, identity protection and the ability to restore systems after an incident.
Android makes password and passkey transfers safer
Android 8 and later can transfer passwords and passkeys directly between compatible managers without creating a plaintext export.
Androidpasswordspasskeys
Docker argues for secure-by-default AI agents: controls that matter
Docker outlines an approach built on verified images, isolation, least privilege and end-to-end traceability for the agent software supply chain.
DockerAI agentssupply chain
WhatsApp strengthens accounts with multiple passkeys and full passwords
WhatsApp now supports multiple passkeys, replaces the verification PIN and displays more context for calls from unknown numbers.
WhatsApppasskeyssecurity
Docker Hub adds GitHub Actions OIDC: moving beyond permanent CI tokens
Docker Hub can exchange a signed GitHub job identity for a short-lived token. Here is how to scope rules and migrate from PATs.
Docker HubGitHub ActionsOIDC
Windows 11: what the August update should change on your PC
Windows 11 is preparing its August update with broader Windows Hello support, a removable AI component and several fixes. What to check before installing it.
Windows 11updateWindows Hello
WebMCP arrives in Chrome 149: preparing websites for agents securely
WebMCP lets websites expose structured actions to AI agents. API design, the Chrome 149 trial, use cases, security risks and a practical test plan.
WebMCPChrome 149AI agents
GitHub Copilot can block unapproved MCP servers: how to configure the policy
Enterprises can govern the MCP servers used by GitHub Copilot. How allowlists, matching, deployment and complementary security controls work.
GitHub CopilotMCPsecurity
Node.js 22, 24 and 26: security fixes to deploy now
Node.js fixes eleven vulnerabilities across releases 22, 24 and 26. Patched versions, HTTP/2, TLS and Permission Model risks, and a deployment plan.
Node.jssecurityHTTP/2
Google offers selfie video account recovery: should you enable it?
Google is adding selfie video to account recovery. How it works, eligible accounts, privacy choices and the backup methods to retain.
GoogleGoogle Accountaccount recovery
Android 17: should you install the update as soon as it arrives?
Android 17 is rolling out first to Pixel devices. Features, security, compatibility and backups: the checklist before installing the update.
Android 17smartphoneupdate
GitHub blocks suspicious Actions workflows before they steal CI secrets
GitHub Actions now holds some suspicious workflows for review. What this automatic control protects and what maintainers must still inspect.
github actionsci cdsupply chain
Docker Compose in production: deploy, secure and roll back
Immutable images, secrets, healthchecks, networks, migrations and rollback: a complete method for operating Docker Compose on one server.
dockercomposeproduction
Password manager, passkeys or MFA: what should you use?
Strengths, limits, recovery and use cases: a practical method for combining password managers, passkeys and MFA according to risk.
passwordspasskeysmfa
How to evaluate an AI coding assistant as a team
Tasks, metrics, security, costs and decision gates: a reproducible framework for comparing AI coding assistants on a real repository.
aicoding-assistantsevaluation
Hacked account or data breach: what to do in the first 24 hours
An urgency-based method to regain control of an account, limit fraud and respond properly when your personal data has been exposed.
hacked-accountdata-breachpasswords
Small business cybersecurity: the priorities that actually matter
A pragmatic method for protecting accounts, devices, backups and critical services without turning a small business into a security operations centre.
securitysmall-businessbackup
Generative AI for business: use cases, cost, security and governance
A practical guide to selecting an AI use case, evaluating an assistant, protecting data and measuring value before scaling.
aibusinessgovernance
GitHub tightens its bug bounty as AI-generated reports flood triage
GitHub now separates its public program from a better-paid VIP tier. The platform wants to reward deep research instead of submission volume.
githubbug-bountysecurity
Open Secure AI Alliance: open AI organizes around the security question
NVIDIA, AMD, IBM, Microsoft and other companies are backing a security alliance for open-weight models as the debate becomes harder to avoid.
open-weightsecuritygovernance
OpenAI, Hugging Face and the runaway agent: cybersecurity is changing pace
An incident involving a research agent shows why autonomous systems need real incident procedures, not only prompt-level guardrails.
agentsopenaiincident
Frontier AI: researchers ask for ways to slow the race when needed
More than 1,200 AI lab employees are calling for tools to pace the development of systems that could automate AI research.
governancefrontier-aisecurity
iOS 26.6: the boring update iPhone users should still install
Apple fixes dozens of vulnerabilities in iOS and iPadOS 26.6. Even without a flashy feature, this update matters for everyday users.
iphoneiossecurity
SharePoint: patching is not enough if secrets may have leaked
Critical SharePoint vulnerabilities show a hard rule: after likely compromise, patching must be paired with key rotation and incident hunting.
sharepointmicrosoftincident
Steam ClickFix scam: a simple guide to avoid trapping your own PC
Fake troubleshooting tips are pushing gamers to paste PowerShell commands. Here is how to spot the trap and what to do if you already ran one.
steamclickfixgamers
ClickFix and agentic ransomware: cybercrime automates old tricks
Recent cyber alerts point in the same direction: AI and automation amplify attacks that still rely on very familiar social and technical patterns.
clickfixransomwaredefense
Integrating an AI model without exposing data: a security guide
Before adding an AI component to a product, teams need to frame data, outputs, permissions and monitoring like any other critical system.
securitygovernancedata
CISA KEV catalog: prioritizing patches without getting lost
Not every vulnerability deserves the same urgency. Actively exploited flaws should move up the queue.
vulnerabilitypatchkev
Ransomware: backups are worthless if restore is not tested
Companies talk a lot about backups. In a crisis, the real indicator is the ability to restore quickly and cleanly.
ransomwarebackupresilience
Windows 11 support dates should guide PC fleet planning
Windows 11 versions have different end-of-support dates. For small companies, tracking the calendar prevents rushed migrations.
windowssupportsecurity
Browser extensions: supply chain risk in users’ pockets
An extension installed to save time can read sensitive pages. Teams should treat the browser as a critical surface.
browsersupply-chainrisk
Prompt injection shows that AI reads too much
LLM applications mix instructions, documents and actions. Prompt injection exploits that confusion of roles.
llmprompt-injectionsecurity
SBOMs are becoming a software purchasing argument
Customers want to understand what they install. The SBOM turns software dependency into a concrete discussion object.
sbomsupply-chainsoftware
QR code and mobile phishing bypass the workstation
QR codes move users to their phones, outside many usual enterprise protections.
phishingmobileqr-code
Security logs: what you need before the incident
Useful logs cannot be improvised during a crisis. Teams need to decide in advance what must be visible.
logsincidentdetection