Blogsby GlyphHow we built Render OIDC
Learn how Render built OIDC authentication using short-lived tokens, workspace-specific issuers, and a daemon that keeps credentials fresh.
Security
Vulnerabilities, auth, encryption, privacy and abuse. 2,156 posts on file, most from Check Point, Rapid7, Cloudflare.
Fri Nov 66 posts
Best Tools for AI Data Privacy and Compliance for Banks
The best tool for AI data privacy and compliance at a bank depends on the job: finding and controlling sensitive data, running privacy operations, governing...
+1more from Lyzr Blog that day
Beyond Unified Detection: What Email Security Teams Need to Control
For email security teams, evaluating an integration means understanding both the detections it brings together and the quarantine management and administrative workflows it supports.
Partnering with Hacktron to find vulnerabilities in OpenAI’s systems
OpenAI is partnering with Hacktron to find vulnerabilities, test connections with third-party services, and strengthen defenses with frontier AI.
The post-quantum future of web privacy
Cryptographic protocols like Privacy Pass help keep web sites safe from abuse while keeping their users private. This post looks at the quantum threat to these protocols, and some new post-quantum cryptography that may help close the gap.
Friday Five, November 6, 2026
Smart Talks with IBM: The $5 Billion effort to help secure the world’s shared softwareProject Lightwell commits $5 billion and aims for 20,000 engineers to help secure open source software.
Thu Nov 57 posts
Real-time fraud detection with Feature Views
Real-time fraud detection depends on three kinds of features: what a customer did...
A practical security guide for developers
Five steps to review the credentials behind your apps, tools, and AI agents. October’s security incidents carried real consequences: more than $6 billion in cryptocurrency stolen in one attack, and at least nine AI developer platforms...
+1more from 1Password Blog that day
Docker and ActiveState Extending Secure Defaults to the Packages Developers Install
Docker partners with ActiveState to continue to provide one standard for trusted content across everything you and your teams build on.
Gartner Report: The Attack Path is Closing Faster than Most Teams Can Patch
Security teams have never lacked vulnerability data. The harder problem is deciding which issues create a credible path to business impact, then acting before that path can be used.
GPT-6 Cyber Security Evaluation: CodeRabbit’s Results
Across 33 benchmark cases, CodeRabbit’s ensemble with GPT-6 Cyber caught 22 known issues versus 19 without it and reported 66% more high- and medium-severity findings.
ChatGPT Lockdown Mode Bypass Reveals a Wider Challenge in AI Security
Check Point Research (CPR) discovered a vulnerability that bypassed ChatGPT Lockdown Mode, a security feature designed to reduce prompt-injection-driven data exfiltration.
Wed Nov 46 posts
Vercel token scanning expands to more public sources
Vercel has partnered with Truffle Security to expand automated detection and revocation of publicly exposed Vercel tokens.
The Race Against the 3-Day Clock: How Rapid7 Helps Meet BOD 26-04 Compliance
Introduction to BOD 26-04 On June 10, 2026, CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk." Strip away the regulatory language and it reads like a single operational fact: for a vulnerability...
+1more from Rapid7 Cybersecurity Blog that day
PHP2Shell on Windows and macOS: Automating the PHP Upgrade, With or Without an Agent
Executive Summary PHP2Shell (CVE-2026-109618 and CVE-2026-109619) allows unauthenticated remote code execution on exposed PHP servers. PHP has released fixed versions. On Linux, distribution packages carry the fix.
HYFLOCK Ransomware Evolves with New Builds and Encryption Weaknesses
Four ransomware generations. Six months of development. Eight victim claims published in a single day. HYFLOCK spent much of 2026 building its ransomware operation, recruiting participants through underground forums and promoting...
A thousand fewer paths to root
OpenAI built an autonomous pipeline that found, validated, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel.
Tue Nov 39 posts
Vercel Security Review now in public beta
Vercel Security Review is now in public beta for Pro and Enterprise teams. Once enabled, every push to a connected GitHub repository is automatically reviewed for vulnerabilities, and findings are reported in the Vulnerabilities dashboard.
TeamCity 2026.2.2 and 2026.1.6 Updates
TeamCity On-Premises 2026.2.2 and 2026.1.6 bug-fix updates are now available. These updates resolve a significant number of issues, including security and performance issues, as well as the following bugs: As always, we strongly recommend...
+1more from The JetBrains Blog that day
Future-proofing enterprise AI: The impact of post-quantum cryptography on Red Hat AI Enterprise
We are rapidly approaching an intersection of 2 generational technology shifts: The explosive adoption of generative artificial intelligence (AI), and the looming reality of cryptographically relevant quantum computers (CRQCs).
+1more from Red Hat Blog that day
FedRAMP Authorization Is the Easy Part: How to Stay Authorized with Qualys Policy Audit
Key Takeaways FedRAMP authorization isn’t the finish line. Providers are expected to keep monitoring their security posture and give federal agencies the information they need for ongoing, risk-based decisions.
bREACHYing the Perimeter: How One HTTP Request can Hijack your AI Robot
Software supply chain attacks are on the rise, and naturally taking the headlines. But with the rise of localized models and common software embedded into smart “things”, risks may even be hidden in plain sight – or, in some cases, quite...
How Runtime Verification works in CodeRabbit Secure
Testing a suspected vulnerability takes more than sending a request and checking the response. Runtime Verification in CodeRabbit Secure turns a Deep Scan finding into a Reproducer Guide, runs it with Runtime Analysis in a prepared...
Prompt Adware: How Hidden AI Instructions Could Create a New Enterprise Security Risk
Check Point Research (CPR) discovered Haiou, an OpenAI Codex jailbreak bundle that persistently modifies an AI agent’s trusted instructions to inject advertisements for a third-party AI gateway.
Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities
Zero Wire on Cloudflare Radar pairs plain-language briefings with global attack telemetry and remediation steps. Triage critical CVEs faster and decide how to protect your infrastructure.
Mon Nov 25 posts
Guiding Customers Through Critical PHP Vulnerabilities
Over the past week, our industry has faced a wave of critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). As Palo Alto Networks Chief Technology and Product Officer Lee Klarich highlighted, these high-severity …
Introducing Vercel Security Review
Today, we are launching Vercel Security Review in public beta. Security Review is a new capability in Vercel Agent, alongside Code Review and Investigation.
Runpod Achieves SOC 2 Type II Certification
Runpod has officially achieved SOC 2 Type II certification, validating that its enterprise-grade security controls not only meet strict design standards.
Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both.
OpenAI appoints Dan Driscoll as Senior Counselor for National Security Modernization
OpenAI appoints Dan Driscoll to advise on responsible AI for national security modernization, cyber resilience, and collaboration with U.S. allies.
+2more from OpenAI News that day
Sun Nov 11 post
The $6.3B Binance Hack: What Happened and What It Teaches Security Teams About Investigation
TL;DR On October 29, 2026, attackers drained about $6.3 billion in crypto assets from Binance’s hot wallets, the largest crypto theft on record.
Fri Oct 306 posts
Compromised eMudhra Certificates: Update Your JetBrains IDEs, ReSharper,.NET Tools, Toolbox App, and Gateway Now
Summary Available fixed versions The issue is fixed in the following versions: The 2025.2.6.* updates for all IDEs now contain only the JBR fix. They will get a separate hotfix for the JCEF problem.
Multistate Payroll Compliance: The Case for Single-Platform Regulatory Management
Four things decide whether a multistate payroll process holds up: where the work location lives, on the employee record that drives automated processes, or in a field someone updates on the side how many systems must agree, one, or several...
Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)
Overview An origin-validation flaw in BeyondTrust Remote Support lets an unauthenticated attacker write files on the appliance and execute code as the site's operating-system user.
Operationalizing CISA AA26-194A: Automating Cisco Router Security Assessments with Qualys Policy Audit
Key Takeaways CISA AA26-194A provides actionable guidance to improve the security of Internet-facing Cisco routers against real-world attack techniques.
“Are We Exposed?” What CISOs Need to Know About Their Software Risk
Recent events have once again highlighted the need to quickly answer the question, “Are we exposed?” We now face threats to businesses and governments from vulnerabilities and compromises in three fundamental components used in software...
“Patch or Perish”: A Spooky Security Tale for FlashArray, FlashBlade, and Portworx
“Patch or Perish”: A Spooky Security Tale for FlashArray, FlashBlade, and Portworx by Everpure Blog The threat of a cyberattack hitting your organization can seem scarier than a haunted house.