Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Microsoft is in the process of shaping major changes to Windows code signing that will have the effect of altering the certificate infrastructure, the cryptographic algorithms, and, in the end, how Windows applications will be protected against future quantum computing threats. The changes are of particular importance to developers, IT administrators, security teams, and organizations that are using their custom software or security tools that can do their own code signature validation.

How KomodoSec’s AigentX Penetration Tester and Red Teamer mapped an assumed-breach Active Directory environment, proposed an operator-approved attack plan, and autonomously demonstrated multiple routes toward full domain compromise inside a large enterprise company. Human-controlled strategy. Autonomous execution. Evidence-backed results. THE CHALLENGE.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! You have a Zimbra server? Not now you don’t…

A model ranks phishing sixth. The security team has spent three years on phishing and knows how often people click. Somebody in the room concludes the model is wrong, or that the security team is attached to its own program, and the meeting stops being useful. ‍ Most of these disagreements are not about risk. They are about which question each side answered, and establishing that first resolves a surprising proportion of them without anyone conceding anything. ‍

The OWASP list for agentic applications, published in December 2025, gives security teams a shared vocabulary for what goes wrong when software acts rather than answers. Ten categories covering planning, tools, identity, supply chain, code execution, memory, inter-agent communication, cascading failures, human trust and rogue behavior. ‍ Translating that into a financial figure is where programs stall, and the usual attempt makes a specific error.

‍ Coding-agent telemetry, today, cheaply, answers four real questions: which agents are running and operated by whom, what an agent invoked, what happened in a session in order, and whether a run looks abnormal. Part 1 of this series covers that case in full. ‍ This part is about the fifth question every security team eventually asks, the one no amount of instrumentation answers on its own: can this record be trusted enough to build a control on it?

If your security team runs on Jira, sprints and backlog included, UpGuard plugs straight into it: vendor findings, breach alerts, and user risk signals can all surface as issues your team is already triaging. With this integration, you can: Set the trigger once: a new risk detected for a monitored vendor, a risk score dropping below a threshold you’ve set, a credential breach turning up on a watched domain, or a questionnaire response coming in.

Most organisations that get hit by a serious cyber attack weren’t careless: Ransomware, supply chain attacks and identity-based breaches aren’t hypothetical risks anymore. They happen to businesses and public sector organisations of every size, across every sector. And the ones that come through them best aren’t necessarily those with the biggest security budgets.

The EU Cyber Resilience Act (CRA) introduces a 24-hour reporting requirement for actively exploited vulnerabilities from September 11, 2026. For companies selling products with digital elements into the EU, meeting that deadline will require more than compliance documentation — it demands fast vulnerability identification, clear ownership, reliable SBOM visibility, and a remediation process that can move quickly.

Criminals are now selling malicious AI tools for use in cyberattacks, according to researchers at Trellix. These tools dramatically lower the barrier for unskilled crooks to launch sophisticated attacks. “In the first half of 2026, the Trellix research team identified multiple distinct AI-related offerings across major underground forums,” the researchers write.