Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A new Mini Shai-Hulud wave hit keyv and 800+ npm packages. The malware now scans 469 secret locations, including AI agents, crypto wallets, and CI/CD tools.

Peak season brings challenges to the hospitality industry every year. Thousands of guests, temporary staff, vendors, and business partners interact daily with reservation systems, management platforms, mobile apps, and loyalty programs. That operational complexity makes hotels a particularly attractive target for cybercriminals. Artificial intelligence hasn't created a new problem for hotels, it is simply accelerating an existing one: identity-based attacks.

The insurance sector faces mounting pressure from both commercial growth and a persistent, evolving cyber threat landscape. This blog examines why insurers remain key targets, where their security gaps lie, and how cyber threat intelligence helps close the gap between ambition and resilience.

VMware ESX systems are a recurring target in ransomware campaigns. Threat groups including SCATTERED SPIDER, BlackBasta, Royal (aka BlackSuit), Akira, and the ESX-focused ransomware as a service (RaaS) platform shinysp1d3r have demonstrated that once an adversary reaches the hypervisor layer, they can rapidly encrypt virtual machines, disable logging, and cripple an entire data center.

AI is now in the pentest reporting workflow and plenty more updates from July. Ticketing gets even more updates, the Knowledge Base adds version control, and Fivetran connects to Job Monitoring. Here’s what shipped.

CISA calls phishing-resistant MFA the standard every organization should be working toward. For DoD components, federal agencies, defense contractors, and other organizations operating at NIST's highest authenticator assurance level (AAL3), that guidance narrows to two paths: FIDO2/WebAuthn, or PKI-based smart cards like CAC and PIV.

Most AI deployment policies stop at approved chat interfaces. Meanwhile, employees install browser copilots, AI extensions, and third-party plugins that never touch Microsoft's management stack. IT can't configure what it can't see, and Group Policy and Intune only govern Microsoft's world. This post covers what actually happens once AI tools show up outside policy, five things most teams miss, and how PolicyPak enforces controls directly on the apps and browser extensions themselves.

AI is changing how products get made. For user experience teams, that means the very shape of the work is changing.

Another Black Hat USA is in the books, and what a week it was. From a main stage keynote at the AI Summit to candid podcast conversations, a video interview with Cyber Defense Magazine, and a booth game that just wouldn’t quit, Mend.io showed up in Las Vegas ready to talk about the question every security leader is wrestling with right now: as AI reshapes both the software we ship and the systems we have to defend, who do we trust to verify that it’s safe?