A newly disclosed vulnerability in Ivanti Endpoint Manager (EPM) tracked as CVE-2025-10573 allows unauthenticated attackers to inject persistent JavaScript into the EPM administrative dashboard. Assigned a CVSS score of 9.6, this vulnerability presents a critical security risk because it enables attackers to hijack administrator sessions and gain full control over managed endpoints.

During our research into Microsoft 365 security, we discovered a flaw in Outlook on the web (OWA) that exposed information about users and their mailboxes. By manipulating certain request headers against the “/owa/service.svc” endpoint, an attacker could not only confirm whether a user account existed, but also determine if that account had a mailbox associated with it.

When Anthropic dropped the Model Context Protocol (MCP) in late 2024, it felt like the missing puzzle piece for AI tooling: a standard way for Large Language Models (LLMs) to talk to data sources, APIs, and pretty much anything else you can think of. Think of it as a USB-C port for AI, as the protocol’s creators like to say. But like most shiny new standards, the devil’s in the details.

In November of last year, Aaron Bray made some supply chain security predictions for 2025. Now, as we approach the close of the year, we are going to look at how those predictions turned out. But first let’s start with the high-level statistics and review some of the campaigns we have been tracking and reporting on this year. As this year is not yet over, we have excluded data from December for both 2024 and 2025.

When it comes to distributing PHP applications, discussions often swing between two extremes: fully open-source everything or lock all your code behind encryption/encoding. Critics of encoding often argue that open source is superior because users can still inspect and customise code. But the truth is far more nuanced, and the most successful software vendors already know it.

Let’s be honest: if your SOC is drowning in noise, you’re not “doing security.” You’re babysitting tools that cry wolf. And the wolves? They’re doing just fine. Every vendor claims their AI magically cuts false positives. Most don’t. Why?

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! I’m sure techs were hoping for a gradual wind down for the holiday season…

I first met Tines co-founders Eoin Hinchy and Thomas Kinsella more than a decade ago at eBay. Even then, we shared the same frustration: too much important work was slowed down by brittle processes, manual handoffs, and disconnected tools. We all believed technology should help people focus on meaningful work, not slow them down in muckwork. That idea has shaped my career ever since. I started out in security operations, using automation to make my own job easier.