30
42
Digital Guardian launches DG Wingman, a new free forensic artifact collection tool for security pros
55
30
30
30
30
How Developers Prevent Production Risk at the Source
Wiz argues shift-left code-stage security cuts remediation costs and ships Wiz Code, WizOS, and WizCLI to catch flaws pre-deployment.
A Wiz blog post argues that fixing vulnerabilities at the code stage costs a fraction of production remediation, citing the node:20-slim base image which ships 14 known CVEs, three of them critical. It claims AI agents can now analyze open-source commits and generate working exploits in minutes, shrinking the window between a public fix and automated attacks. The post promotes WizOS near-zero-CVE base images, WizCLI and MCP-server checks inside developer and AI agent sessions, and Wiz Code scanning across pull requests, repositories, and pipelines covering SAST, SCA, secrets, and IaC misconfigurations.
15
42
30
What It Took to Reach 1 Billion Build Manifests
Chainguard doubled container build manifests to over 1 billion in six months, powered by Factory 2.0's agentic self-correcting rebuild system.
Chainguard reports growing from 500 million to over 1 billion container build manifests in six months, across more than 3,000 unique images and 675,000 image versions. Its Factory 2.0 system, built on the purpose-built Chainguard OS, uses an agentic reconciliation engine called DriftlessAF to decide when to rebuild across thousands of interdependent projects without human intervention. All artifacts ship with SLSA Level 3 provenance, Sigstore signatures, and full SBOMs.
20
30
55
55
NIS2 compliance: Fixing IAM and access control before the 2026 audit
EU NIS2 enforcement deadlines approach; organizations are urged to prioritize service account inventory, lifecycle offboarding, and phishing-resistant MFA before audits.
EU member states are moving from NIS2 transposition into enforcement, with fines up to 10 million euros or 2% of global turnover for essential entities and personal liability for management bodies. The article argues access management is the fastest high-ROI starting point, estimating 2-4 weeks to enforce fine-grained password policy, vault shared credentials, and deploy phishing-resistant MFA versus 6-12 months for supply chain risk management. It flags three common pre-audit failures: unmanaged service accounts and API keys, dormant accounts from broken offboarding, and SMS OTP instead of phishing-resistant MFA under NIST SP 800-63B. The piece promotes Passwork as a single control plane for credential storage, RBAC, and WebAuthn.
22
IAM Compliance Requirements and Best Practices
A guide maps IAM compliance requirements across SOX, PCI DSS, HIPAA, ISO 27001 and NIST 800-53, urging verified enforcement over documented policies.
The guide argues IAM compliance requires demonstrating that access controls are enforced at runtime, not merely documented, highlighting gaps between policy intent and application-layer execution. It maps recurring requirements across SOX ITGCs, PCI DSS v4.0, HIPAA, ISO/IEC 27001:2022, NIST SP 800-53 and GDPR, covering least privilege, separation of duties, access certification and audit trails. It recommends continuous, evidence-backed verification and application-layer telemetry instead of relying on identity provider logs or quarterly access reviews.
15
NFTs That Cost Millions Replaced With Error Message After Project Downgraded to Free Cloudflare Plan
42
30
30
30
German Manufacturer Shrinks Security Alert Response While Protecting 10,000 Endpoints
Vendor case study: a German manufacturer's five-person SOC cut alert triage time using ANY.RUN's cloud sandbox across 10,000 endpoints.
ANY.RUN published a case study in which a five-person security team at an unnamed German manufacturer replaced an air-gapped forensic laptop with its cloud-managed interactive sandbox, protecting roughly 10,000 endpoints and 10,000 users. The vendor claims a median 15 minutes saved per alert, 20-40 daily tasks processed, a 2.5-minute alert-to-isolation target, and a 95% agreement rate between analyst and sandbox verdicts; all figures are vendor-supplied with the customer identity withheld. The writeup also describes detonating a multi-stage phishing chain from a PDF link to a password-protected ZIP to malware execution.
22
ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories
Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.
Socket found four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) stealing session tokens and wallet data from Axiom Trade and Padre users via attacker-controlled Vercel deployments. Hunt.io reported a Chinese-speaking operator using Claude Code, Alibaba Qwen, and DeepSeek with the SecFlow orchestration framework to automate intrusions against government and financial targets in Afghanistan, Thailand, Taiwan, and the US. The UK NCSC warned shadow AI use risks breaches and regulatory failure, Microsoft announced privacy-preserving Windows Age APIs, and Gen Digital described fake M&A wire-fraud scams. A 119,000-domain fake-shop operation called DoppelCart was also highlighted.
25
Top 10 Best Endpoint Encryption Software in 2026
A 2026 roundup of ten endpoint encryption products argues the engines are solved and buyers should choose management layers like Intune, Sophos, or Trellix.
The guide ranks ten endpoint encryption options, arguing BitLocker and FileVault have won the engine war so the real purchase decision is the management layer for compliance proof, key escrow, and cross-platform policy. Microsoft BitLocker with Intune is named the baseline for Windows estates, with Sophos, ESET, Trend Micro, Check Point, Trellix, and others covering mixed or regulated fleets. It also warns that TrueCrypt-lineage freeware is unmaintained and that Kaspersky cannot be sold to US customers.
12
What breach and attack simulation needs to become in the AI era
Picus argues calendar-driven BAS is obsolete as AI compresses exploit timelines, citing 338 million simulations showing 69% prevention and a flat 14% alert score.
In a vendor opinion piece, Picus Security contends that with over 130 CVEs disclosed daily, fewer than 0.5% patched upstream, and disclosure-to-weaponized-exploit timelines near 10 hours, scheduled breach and attack simulation no longer keeps pace. The Picus Blue Report 2026, aggregating 338 million production simulations, found average prevention effectiveness of 69%, 58% of attack actions captured in the SIEM, an unchanged 14% alert score, and detection rule failures driven by performance issues (49%) and silent log collection gaps (41%). Picus proposes agentic BAS as a closed loop—simulate, validate, fix, verify—with AI-built threats and humans at decision gates.
32
Triage & Response Bottlenecks Eating into MSSP Margins: How to Remove the Friction
ANY.RUN says manual triage bottlenecks erode MSSP margins and promotes its Threat Intelligence Lookup and sandbox to cut Tier 1 workload by up to 20%.
Vendor blog post from ANY.RUN describes recurring MSSP triage and response bottlenecks: manual alert validation, unnecessary Tier 2 escalations, manual handoffs, outdated threat data, and disconnected tools. It cites a healthcare MSSP case study where the Tier 1 closure rate rose from 20% to 70% and false escalations dropped 34% after adopting its tools. The piece claims ANY.RUN can reduce Tier 1 workload by up to 20%, letting MSSPs absorb more clients without proportional headcount growth.
18
Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones
Opinion piece argues attackers prioritize repeatable playbooks like ClickFix (47% of Microsoft-notified attacks) and living-off-the-land over novel techniques.
The column analyzes why commodity techniques scale: Microsoft observed ClickFix as the top initial access method at 47% of its notifications last year, while Bitdefender found 84% of 700,000 analyzed high-severity incidents involved binaries already present on machines. Verizon's DBIR shows vulnerability exploitation rising to 31% of initial access vectors, up from 20%, and ransomware leak-site rankings show Qilin (roughly 1,600 claimed victims) and The Gentlemen (121 claimed victims in June) competing on throughput. The author argues attackers behave like a generics business, standardizing repeatable procedures rather than investing in novel tradecraft.
28
Cybersecurity jobs available right now: December 16, 2025
Help Net Security rounds up open cybersecurity jobs at Grant Thornton, Central Bank of Ireland, Ford, Kraken, Docebo and others across multiple countries.
This is a job listing roundup covering cybersecurity openings at organizations including Grant Thornton, the Central Bank of Ireland, Ford Motor Company, Global Medical Response, banglalink, Mindrift, Kraken, PFH Technology Group, Kiwibank, Mazrui International, Docebo and Alpitronic. Roles span SOC operations, GRC, endpoint security, FedRAMP compliance, threat intelligence and privacy leadership across the USA, Ireland, India, Bangladesh, France, UAE, Canada and other locations. All listings were marked as no longer accepting applications at publication time.
12
42
55
42
55
30
30
55
30
30
30
30
55
30