23 articles tagged
Instinct's Terms of Service, revised 20 August 2026, take a perpetual, irrevocable licence over screen captures and keystrokes. Workspace data is carved out, so the same email can fall on both sides.
Google's 24 August 2026 AAOS SDV post says adding a security-sensitive service means updating every VM in the mesh. The AOSP deployment page describes a default policy built to avoid that.
AWS announced the rebuilt VPN Client on 13 August 2026, after 6.0.0, 6.0.1 and 6.0.2 had shipped. The rebuild relocates configuration, there is no auto-update, and the requirements now list only Windows 11.
Anthropic added allowed_domains and blocked_domains to Claude Managed Agents web tools on 20 August 2026. The Console organization-level list does not reach agent sessions and each list caps at 64 entries.
AWS IAM role manager reached general availability on 12 August 2026 across six service consoles. Four of them attach PowerUserAccess by default, and AWS's published lockdown SCP denies an action role reuse needs.
OAuth 2.1 removes the local proxy from AWS MCP Server setups. It also removes per-call AWS profile switching, which is the one feature consultancies working across client accounts actually rely on.
Putting origin access control in front of an S3 Multi-Region Access Point means reconciling a Developer Guide, an API reference and an S3 user guide that contradict each other on signing protocol, origin type and Region
CVE-2026-20253 is the first Splunk vulnerability ever added to CISA's KEV catalog: an unauthenticated RCE via the PostgreSQL sidecar. Here is the version matrix, the temporary workaround, and an hour-by-hour SOC runbook.
OpenAI is deprecating Atlas and moving browser agents into ChatGPT and Codex. Atlas stops working on 9 August 2026, bookmarks and cookies do not transfer, and the browser stops receiving security updates.
Two unauthenticated SharePoint Server RCEs, CVE-2026-50522 and CVE-2026-58644 (both CVSS 9.8), are exploited in the wild. Patching alone will not evict an attacker who stole your machine keys.
On July 27, 2026, Node.js patched HIGH-severity flaws across the 26.x, 24.x and 22.x lines, days after Next.js shipped its own. Here is which version to run and how to patch fast without breaking production.
OpenAI's Secure MCP Tunnel lets ChatGPT, Codex and the Responses API reach a private or on-prem MCP server over an outbound-only HTTPS path, with no inbound ports. How it works, how to set it up, and how to harden it.
MCP Apps shipped on 26 January 2026 as the first official MCP extension. Here is how the ui:// resource, the _meta.ui.resourceUri link, the sandbox CSP and the stateless 2026-07-28 core fit together.
The first scheduled Next.js security release landed on 20 July 2026 with nine CVEs across App Router, Server Actions, rewrites and the image endpoint. Here is who is actually exposed and how to patch.
Penalties reach ₹250 crore and full compliance is due 13 May 2027. Vendors quote ₹15 lakh to ₹2 crore. Here is what DPDP compliance actually costs a startup, and which line items you can build yourself.
Kubernetes 1.35 shipped Pod Certificates at Beta and constrained impersonation at Alpha. Neither is the zero-trust mTLS upgrade the headlines promised, and the KEP says so directly. Here is the real scope.
CISA added SharePoint RCE CVE-2026-45659 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog with a July 4, 2026 federal deadline. Here is the defensive patch-and-harden checklist for on-premises SharePoint Server.
iOS 27 brings real-time scam detection, monitorable Lockdown Mode, silent security patches, hardware integrity checks, and a stricter TLS requirement that can break enterprise MDM. Here are the five security features
Five engineering lessons from shipping AI delivery: treat the model as swappable, start with evals not vibes, budget tokens and latency, ground outputs with retrieval, and build security in from day one.
How the iOS 27 Passwords app fixes weak and compromised logins in one tap, using Apple Intelligence and Safari and the W3C change-password standard. What you need, where it works, and the key security questions.
iOS 27 turns Passwords into a security agent: Apple Intelligence and Safari replace weak or breached passwords in one tap. How it works, the standard behind it, and what developers must do.
With iOS 27, declarative device management becomes the standard, legacy MDM update enforcement is removed, and TLS 1.2 becomes mandatory. Eight fleet-readiness moves for CTOs before the ~September 14 release.
In iOS 27, the Passwords app uses Apple Intelligence and Safari to change weak or compromised passwords with one tap. How the auto-fix works, and five things enterprise security teams should change.
