All Posts

In the back half of June 2026, four of Japan's largest and most recognizable companies disclosed cyber intrusions inside a two-week window: Aflac's Japanese...

There is a botnet called RustDuck that most defenders can safely ignore today on the numbers alone. It is not large. It is not, yet, knocking major services...

BlackNevas is a ransomware crew that surfaced in the second half of 2025 and has been quietly building a victim list across technology, manufacturing,...

There is a ransomware-as-a-service operation that calls itself The Gentlemen. Since it surfaced in mid-2025 it has posted 483 victims across sixty-six...

We took no venture capital. No Series A, no seed, no bridge. Two people run this on a budget you could mistake for a rounding error. We say that first...

Trend Micro published a report this week dissecting a cryptomining campaign that abused CVE-2026-33017 — the unauthenticated remote-code-execution flaw in...

A critical vulnerability in Progress Kemp LoadMaster — CVE-2026-8037, CVSS 9.8 — lets an unauthenticated attacker run commands as root on the appliance by...

There is a new information stealer in the wild called Djinn, and it is different from the pile of credential-grabbers that came before it in one way that...

On June 9, CISA added three vulnerabilities to the Known Exploited Vulnerabilities catalog in one shot: a Cisco Catalyst SD-WAN Manager flaw, a Google Chromium V8 memory bug, and CVE-2026-7473 in Arista EOS. Two of the three you can patch this week. The Arista one you cannot patch at all, because Arista says no patch is planned. Read that again. A vulnerability that CISA confirms is being exploited in the wild, on the switches that carry the spine of enterprise and data-cente

Microsoft started handing out report cards and most people have not noticed yet. On February 11, 2026, Bing Webmaster Tools shipped a new section called AI Performance, in public preview. For the first time it shows publishers how often their content gets cited inside generative answers — Microsoft Copilot, the AI summaries that now sit at the top of Bing, and a handful of partner AI experiences. It surfaces the exact pages that get referenced, and it introduced a strange new

The vocabulary of AI visibility is being invented in real time, mostly by vendors with an incentive to keep it fuzzy. Here is a plain-English glossary of the terms that actually matter in 2026, defined so a machine — or a human in a hurry — can lift any single entry cleanly. AI Presence Management (AIPM) is the practice of measuring and improving how accurately large language models describe your company when someone asks about it. It is the AI-era successor to SEO. Generativ

The Bing AI Performance report, found inside the free Bing Webmaster Tools, shows how often Microsoft Copilot and Bing's AI-generated answers cite your website's content. It launched in public preview on February 11, 2026, and expanded on June 16 with intent labels, topic clusters, a Citation Share metric, and period-over-period comparison. It is the first official, vendor-run scoreboard for whether the AI layer that is replacing search can see you at all. Here is how to read

A grounding query is the reformulated search question an AI assistant writes to itself — automatically and invisibly — when it decides it needs to go read the live web before answering a user. When you ask Microsoft Copilot a messy, conversational question, it does not paste your exact words into a search box. It rewrites your intent into one or more cleaner, machine-optimized queries, runs those against Bing's index, reads the results, and uses what it finds to ground its an

AI Presence Management (AIPM) is the practice of measuring and improving how accurately large language models describe your company, product, or brand when a person asks about it. It covers four things you can actually measure: whether the models are aware you exist, whether they get your facts right, whether they speak about you with positive or negative sentiment, and whether they would recommend you. If SEO was about ranking on a page of blue links, AIPM is about what the

On June 29 we published a piece arguing that Nissan's run of breaches followed a single pattern — the data never left through Nissan, it left through a...

This week we did something quiet and overdue: we gave CyberAv3ngers — the IRGC-Cyber-Electronic-Command crew that has been compromising internet-exposed water and energy controllers by reading the manual, not the zero-day — a permanent, structured profile in our adversaries index, and we ingested the one cleanly-attributed sample of their custom OT implant. Not a blog mention. A file. The same kind of file a defender at a water utility can query at three in the morning when a

On June 18 we wrote that a crew calling itself Icarus had breached Klue, stolen OAuth tokens "for everything," and that an operator signing as "Mr Bean" was sending the extortion emails. We said the attack class was not new — it was the third Salesforce OAuth breach in twelve months. Today the downstream victim list filled in, and it reads like a security-industry conference badge rack: HackerOne, Gong, OneTrust, Tanium, Huntress. We are not surprised. We told you the door wa

Every time Nissan customer data hits a leak site, Nissan says the same true, useless thing: our systems were not compromised. And every time, it is correct — because the data did not leave through Nissan. It left through a vendor. The pattern is the story, and "our systems are clean" is becoming the most hollow reassurance in breach response. There are two separate Nissan data incidents in the public record from the last nine months, plus a longer tail of prior years, and the

The interesting thing about DragonForce in 2026 is not the encryptor. It is that the encryptor has become optional. The crews wearing the brand are increasingly skipping the lock-the-files step entirely and going straight to the part that actually pays: copy the data, threaten to publish it, and pick targets where publication is unthinkable — the energy sector and the medical-device supply chain. We have been watching the same door these crews keep walking through, and the do