Worm in the Supply Chain, a Wide Open Front Door
A self-propagating npm worm dubbed ChainDrop infected more than 400 packages with a combined two billion-plus downloads, Framework disclosed a CVSS 10.0 SQL …
Iran
Agents Off the Leash, a Deadline That Moved, and a Patch That Already Shipped
Issue 025 covers Anthropic disclosing that three of its own models autonomously attacked real organisations during testing, a Check Point admin-authentication …
Double Whammy with a Pinch of Catastrophe
Iran contests the Strait of Hormuz while the Houthis squeeze Bab el-Mandeb — two chokepoints, both ends of the Arabian Peninsula, at the same time. Six …
Zero-Day Pairs, Arctic Satellites, and Ten Nights Over Tehran
Issue 024 covers two SonicWall SMA 1000 zero-days (CVE-2026-15409 and CVE-2026-15410, both CVSS 10.0, exploited before vendor disclosure), a …
First Agentic Ransomware, Four Nights Over Kyiv, Ankara Draws the Line
Issue 023 covers 4–11 July 2026: JadePuffer, the first documented fully agentic LLM-driven ransomware, arriving alongside a BeyondTrust critical auth bypass …
Assembly Breach, Five Thousand Sorties, Black Walks
World Leaks ransomware group breached Tata Electronics, Apple’s primary iPhone assembly partner in India, leaking more than 200,000 iPhone 18 Pro …
The Easter Escalation
A browser zero-day hitting 3.5 billion users. A US fighter jet shot down over Iran. Russia stalling for the first time in years. And the Epstein fallout …
MuddyWater Follow-Up: April 2026
A lot changed in four weeks. MuddyWater rebuilt their toolkit in Rust, started using AI to write malware, compromised US banks and airports, and picked up new …
One Month of Fire
The Iran war hits one month with Houthis entering the fight, Iran strikes Bahrain, and US deploys 3,500 marines. FBI Director Kash Patel’s personal email …
The Week Everything Moved
EU Chat Control collapses, E2EE survives. Mette-Marit speaks, Stortinget votes unanimously for Epstein commission. Tycoon 2FA dismantled, Medusa ransomware hits …
The Genie Problem
Claude Opus 4.6 broke its own exam by identifying the benchmark, finding the encrypted answer key on GitHub, and decrypting it across 18 independent runs. …
Fifteen Days of Fire
Iran war hits Day 15 with Kharg Island struck and oil past $100, Økokrim finds classified documents in Rød-Larsen’s basement, Reuters reveals FBI Epstein …
The Bombs Don't Stop
Iran war enters its eighth day with 1,450+ killed and 5,000+ bombs dropped, Økokrim seizes Oslo Accords documents from Rød-Larsen, LexisNexis breach exposes …
MuddyWater: Inside Iran's Cyber War Machine
A comprehensive look at MuddyWater, the Iranian APT embedded in US banks and airports before the bombs even fell. From Operation Olalampo to exposed server …
The World Catches Fire
US and Israel strike Iran in coordinated assault, Pakistan declares open war on Afghanistan, Cisco SD-WAN zero-day exploited since 2023, Mandelson arrested over …