Mailchimp
Not subscribed to OpsMatters Newsletter
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Latest posts
Run AutoMCP To Supercharge Your AI Agent with Libraries MCP Servers
Artificial Intelligence (AI) is transforming software development with agentic coding tools like GitHub Copilot and Cursor, leading the charge. These tools use AI to assist developers in writing code, automate repetitive tasks, and expedite the development process.
Security Advisory: Critical RCE Vulnerabilities in React Server Components & Next.js (CVE-2025-55182 / CVE-2025-66478)
On December 3, 2025, coordinated disclosures revealed that multiple releases of React 19 and Next.js contain a critical flaw in the React Server Components (RSC) “Flight” protocol, allowing unauthenticated remote code execution (RCE). The vulnerability originates from unsafe deserialization of attacker-controlled data in server-side RSC payload handling.
Cloudflare's 2025 Q3 DDoS threat report -- including Aisuru, the apex of botnets
Welcome to the 23rd edition of Cloudflare’s Quarterly DDoS Threat Report. This report offers a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network. In this edition, we focus on the third quarter of 2025.
Cloudflare WAF proactively protects against React vulnerability
Cloudflare has deployed a new protection to address a vulnerability in React Server Components (RSC). All Cloudflare customers are automatically protected, including those on free and paid plans, as long as their React application traffic is proxied through the Cloudflare Web Application Firewall (WAF). Cloudflare Workers are inherently immune to this exploit. React-based applications and frameworks deployed on Workers are not affected by this vulnerability.
Attackers Don't Need to Breach Your API -They'll Breach the Tools That Touch It
The API supply chain is the new security blind spot. Attackers no longer need to breach your APIs directly; they can target the third-party services that connect to them. These unmanaged dependencies are now the shortest path to your sensitive data. The recent Mixpanel incident is a stark reminder of that fact.
2026 Phishing Threat Trends Report Preview
Ever wondered who answers when you call a cybercriminal? What happens in the aftermath of a Scattered Spider breach? Or why cybercriminals use legitimate platforms to send phishing emails? If so, this is the session for you. Join Jack Chapman, KnowBe4’s SVP of Threat Intelligence, as he pulls back the curtain on these topics. Jack will give you a first look at our latest Phishing Threat Trends Report, walking through attack scenarios and sharing the trends that are shaping the threat landscape.
Securing the New AI Edge: Why Salt Security Is Bringing MCP Protection to AWS WAF
The definition of the "edge" is changing. For years, security teams have focused on the traditional perimeter: web applications, public APIs, and user interfaces. We built firewalls, deployed WAFs, and established strict access controls to keep bad actors out. But with the rapid adoption of Agentic AI, the perimeter has expanded. Today, your "edge" isn't just where users connect to your apps; it's where AI agents connect to your data.
How deepfake scams are fueling a new wave of fraud
AI deepfakes are making fraud even more sophisticated. Learn how to stay safe from deepfake scams. Scammers are using deepfake technology to replicate your child's voice in a kidnapping hoax, catfish with AI-generated video dates, and impersonate executives to steal millions. Learn how to spot deepfake fraud, and use Avast Scam Guardian to help verify what's real before it's too late.
The future of workflows: changing how we work across the enterprise
This is the final post in a three part series examining the past, present and future of workflows. In the first two posts, we explored where workflows came from and what defines an intelligent workflow. This final article looks ahead. The goal is to understand how workflows will evolve in the coming years and why they will become central to how organizations run, make decisions, and adapt.
Sha1-Hulud: The Second Coming of The New npm GitHub Worm
Sha1-Hulud is back with a new evolution of its supply-chain attack that targets development environments via Node Package Manager (npm). npm is a very popular package manager for Node.js that provides millions of predeveloped packages of code to be used by JavaScript developers for access to millions of packages. This campaign trojans unsecured npm packages with malicious code that is automatically executed when developers using that package update to the trojaned version.