Mailchimp
Not subscribed to OpsMatters Newsletter
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Latest posts
Prompt Injection Through Tool Output Is Two Events (Your Screens Read One)
Tool output is untrusted because your own systems produce it. That is the part of the OWASP guidance that never makes it into a deployment. The label goes on web pages and email bodies, where an outsider obviously wrote the text. It never goes on the ticket store, the CRM, or the repo, because those are yours. The attacker does not care whose system it is. He cares which field takes free text: the ticket body, the opportunity note, the PR description.
Prompt Injection in RAG: The Payload Is Still in Your Index
Every action in your agent-incident runbook operates on the agent. The payload of a RAG prompt injection sits in the index. You can kill the pod, rotate the credential and revoke the session, and each of those stops this workload from doing that thing again. None of them touch the chunk that caused it.
Top Free Active Directory Management Tools
Free Active Directory management tools handle lockouts, stale accounts, permissions reporting and bulk changes without a purchase order, and most teams already run several without having picked them deliberately. Each one stops somewhere specific. Knowing where the free editions end, and which gaps close only with a licensed product, decides how the next audit goes.
Ultimate Guide to Group Policy Management in Active Directory
Group policy management determines whether a domain enforces consistent security settings or drifts into configuration chaos one unaudited change at a time. Creating, linking, filtering, enforcing, delegating and backing up policy objects are the daily mechanics, while inheritance and precedence decide which setting wins when two conflict. Permissions on those objects turn misconfiguration into an attack path.
DarkTortilla Malware: What's Wrapped Inside This Crypter?
DarkTortilla is a sophisticated and adaptable.NET-based crypter, active since at least August 2015, known for delivering a range of malicious software, including prevalent information stealers and remote access trojans like AgentTesla, AsyncRat, NanoCore, and RedLine.
Where Does Session Replay Cross the Line?
Session replay has quietly become default infrastructure. Product teams want to see where users stall, support wants to stop asking "can you send a screenshot," and engineering wants a reproduction path for the bug that only happens on one customer's machine. The business case writes itself. The security review, in most organisations, never really happened. So when the question finally comes up - where does this stop being lawful? - most teams go looking for the answer in the wrong place.
I Tested 16 AI Video Generators for Storytelling. Here's My 2026 Ranking
AI video gets much harder the moment you ask it to tell a story. A single beautiful shot can hide a lot of weaknesses. Narrative work exposes them: the character has to remain recognizable, actions need to happen in the right order, camera changes have to make sense, and the next clip should feel as if it belongs to the same world. That is why we are not ranking these tools by the prettiest demo. We care about how useful they are for building scenes, maintaining visual direction, working from references and turning multiple clips into something that feels intentional.
Who Signs the CMMC Affirmation for Your Company?
CMMC is increasingly important for any company that is even tertiary to the Department of Defense and the defense industrial base. Prime contractors are prime targets, but even two, three, four, or more steps down the chain, CMMC may be mandatory. It's all about protecting information, after all. This means a lot of businesses are looking seriously at CMMC, and a lot of high-level executives are being asked to put their names on things they might not understand at a glance.
CrowdStrike Falcon Sensor Local Privilege Escalation Zero-Day (FalconFlank)
On September 3, 2026, a security researcher known as Nightmare Eclipse/Chaotic Eclipse publicly disclosed a zero-day dubbed ‘FalconFlank’ which abuses the Office malicious macro remediation workflow in CrowdStrike Falcon Sensor. The attack leverages a time-of-check to time-of-use (TOCTOU) race condition, allowing an attacker with code execution on a vulnerable system to hijack the Falcon macro remediation routine. This results in DLL side-loading and execution as NT AUTHORITY\SYSTEM.
Rethinking AI Guardrails: A Layered Approach to AI Infrastructure Security
Rethinking AI Guardrails: A Layered Approach to AI Infrastructure Security Are guardrails enough to secure AI models? A10's Jamison Utter and Arjoyita Roy explore why relying solely on edge filtering creates a false sense of security for modern infrastructure. Discover the necessity of a layered, architectural approach to guardrail systems. Key Takeaways.