Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Years ago, we published the blog post, “Why do organizations trust Snyk to win the open source security battle?” which laid out the methodology and practices for building the Snyk Vulnerability Database.

Elastic partners with Microsoft to provide integration with the Azure AI Foundry Model Catalog. This collaboration significantly enhances the choices available to security analysts, providing access to a diverse array of powerful large language models (LLMs) that are native to the Azure cloud ecosystem. This partnership underscores Elastic's commitment to delivering cutting-edge cyber defenses for Microsoft Azure customers, using their existing cloud infrastructure and investments.

Phishing is no longer just an email problem. Reports state that 40% of phishing campaigns now span channels beyond email, hitting collaboration tools like Slack and Teams, plus SMS, and social media platforms. Voice phishing (“vishing”) in particular is on the rise: 30% of surveyed organizations reported at least one instance of attackers using spoofed or AI-cloned calls to steal credentials in the past year.

In June 2025, a disturbing security failure surfaced involving McDonald’s AI-powered hiring assistant, Olivia, operated by Paradox.ai. The platform, designed to screen job applicants via chatbot, exposed the personal information of over 64 million people. That included names, contact info, shift preferences, and even chat transcripts. The root cause? A combination of missteps that highlight the growing risk of insecure APIs in modern, AI-driven systems.

Arctic Wolf Customer, Proof-of-concept exploit code is now available for a high-severity arbitrary file write vulnerability in Git, which poses a risk to developers who regularly work with third-party code. If Git is used in your environment, we recommend reviewing this security bulletin and taking immediate steps to mitigate the risk.

The U.S. Department of Health and Human Services (HHS) clarified in 2022 and again in 2023 that tracking technologies like Meta Pixel and GA4 can expose Protected Health Information (PHI). This applies even if PHI isn’t explicitly shared—contextual data such as appointment searches or logged-in status on a patient portal can qualify.

Over the last few years, news reports around ransomware attacks have noted that the attacks are increasingly sophisticated. Simultaneously, they say that the attackers are less sophisticated than in the past. While these two statements appear to conflict with each other, they are both true when viewed through the lens of the current cybercriminals business models.

Text messages used to be a safe space—quick birthday wishes, delivery updates, maybe the odd emoji from a friend. But in today’s digital world, not every ping on your phone is innocent. Some are traps, carefully crafted to trick, scare, or confuse. One of the sneakiest tricks out there? Smishing. Yep, it’s a mashup of “SMS” and “phishing.” If phishing is the scam that hides behind a shady email, smishing is its text-based cousin.