Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

First things first, let’s be honest about one thing: passwords are terrible. Yet, here we are in 2026, still filling up our password fields with trivial stuff like P@ssw0rd123! and pretending we're being secure. And of course, we reuse the same password everywhere: We scribble it on a sticky note and display it on our cubicle wall for the world to see. But even then, we still forget what it was. So we smash that Forgot Password link so often, we might as well have it bookmarked.

Telling employees to “use AI responsibly” leaves too much open to interpretation.

Quantum Readiness Day on 24 September is a useful reminder that the security work we do today is not only about preventing breaches tomorrow. It is about protecting data and digital trust for years to come.

Researchers at ZeroBEC are tracking a phishing platform called “Greatness” that’s been significantly upgraded since it surfaced in 2023. “Since its initial discovery, the platform has evolved significantly,” the researchers write.

A practical checklist for rotating service account credentials safely by assessing validity, leaks, permissions, consumers, vaults, copies, owners, and rollback.

Network management gets its most significant expansion yet this month with a complete topology map, path tracing, switch visualisation, syslog collection and more, all shipping together. Alongside it: a redesigned ticket status system, Credentials Manager updates, SQL Server metrics monitoring and more. Here’s everything that shipped.

Today, pub.dev joins the list of package registries we have found malware on. We detected a variant of XCSSET hiding inside universal_file_viewer (version 0.1.5), a Flutter file preview package on pub.dev with around 500 downloads. This is the first compromised package we have detected on pub.dev, the official package repository for Dart and Flutter. Unlike the recent npm supply chain attacks you might be familiar with, this was not a case of someone deliberately targeting this package.

This post is based on Mackenzie's conversation with Jason Haddix on The Secure Disclosure podcast. Listen to the full episode or watch below. Jason Haddix has topped the Bugcrowd leaderboards, run security as CISO of Ubisoft, and wrote The Bug Hunter's Methodology, the playbook a lot of working pentesters learned from, so his read on the direction of the field is worth listening to. He believes that “90% of pen tests will be done by AI” in the near future.