Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On 6 September 2026, researchers publicly described a Telegram zero-day crash. A group owner said a chat they own became unreachable: opening it crashed official clients on iOS, Android, Desktop and Web. A second researcher posted a short recording of a script sending one specially prepared sticker into a test chat. The harm is availability, not account takeover. If the sticker stays in chat history, the crash can happen again every time someone opens that conversation.

The blast radius of a prompt injection against your coding assistant was set weeks ago, by whoever built the dev environment image. Same assistant, same model, same injected sentence: on a laptop it collects every repository, SSH key and cloud login the developer holds; on a provisioned dev box it collects an organization token plus whatever the image left behind; on a CI runner it collects a deployment credential and a network path to production. Three environments, three incidents, one payload.

Every time Cloudflare opens a new TLS 1.3 connection to an origin server, we have to make a guess: the protocol requires us to commit to a key agreement algorithm in the very first packet we send, before the origin has told us anything about itself or what it can support. If we guess right, the handshake completes in one round trip. Guess wrong, and the origin replies with a HelloRetryRequest, we start over, and the connection costs two round trips.

This post is based on Mackenzie's conversation with Jason Haddix on The Secure Disclosure podcast. Listen to the full episode or watch below. Jason Haddix has topped the Bugcrowd leaderboards, run security as CISO of Ubisoft, and wrote The Bug Hunter's Methodology, the playbook a lot of working pentesters learned from, so his read on the direction of the field is worth listening to. He believes that “90% of pen tests will be done by AI” in the near future.

Today, pub.dev joins the list of package registries we have found malware on. We detected a variant of XCSSET hiding inside universal_file_viewer (version 0.1.5), a Flutter file preview package on pub.dev with around 500 downloads. This is the first compromised package we have detected on pub.dev, the official package repository for Dart and Flutter. Unlike the recent npm supply chain attacks you might be familiar with, this was not a case of someone deliberately targeting this package.

Network management gets its most significant expansion yet this month with a complete topology map, path tracing, switch visualisation, syslog collection and more, all shipping together. Alongside it: a redesigned ticket status system, Credentials Manager updates, SQL Server metrics monitoring and more. Here’s everything that shipped.

A practical checklist for rotating service account credentials safely by assessing validity, leaks, permissions, consumers, vaults, copies, owners, and rollback.

Researchers at ZeroBEC are tracking a phishing platform called “Greatness” that’s been significantly upgraded since it surfaced in 2023. “Since its initial discovery, the platform has evolved significantly,” the researchers write.