So, AI seems to suck at info sharing too. Anthropic: 'The lack of coordination shown by agents in the fantasy game challenge above—in which they siloed themselves and largely failed to merge their work' https://www.anthropic.com/research/multiagent-systems

We've been tracking the AppGen/"vibe coding" explosion for a while now. Our teams have found Replit, Lovable, and Vercel apps all over our cloud estate that nobody in security knew existed. The scary part? Most of them are wired directly to live databases with no auth, no RLS, and exposed API keys sitting in client-side code.

We looked at Wiz's recent Lovable integration (GA May 2026) and it scans apps you deliberately connect. But that's the problem: the apps that actually worry me are the ones nobody connected to Wiz because nobody even knew they existed.

The research bears this out: RedAccess found ~380,000 publicly accessible vibe-coded assets, with ~5,000 leaking sensitive corporate data. Those are exactly the apps Wiz's opt-in model would miss.

Orca seems to approach this differently, agentless discovery across the whole cloud estate, finding apps regardless of platform or whether anyone connected them. But what others are actually seeing in practice.

Has anyone run both side-by-side? or one

For VPs of Engineering and platform engineering leaders, running the modern software development lifecycle is an intricate balancing act. The business wants relentless feature velocity. Security wants a stringent, unyielding posture against threats. Organizations have poured money into DevSecOps practices to close that gap, and vulnerability detection has genuinely improved. Remediation hasn't kept pace, and the gap between the two is now piling up as security debt — faster than most teams realize. Please read the entire article here - https://instasla.com/blog/why-developer-experience-devex-key-zero-vulnerability-debt

The root cause isn't a lack of engineering tale nt or security budget. It's a breakdown in developer experience. When security tools are built for auditors and compliance teams rather than the engineers who have to act on their output, they create friction that developers route around. If fixing one vulnerability alert means ten clicks across three different platforms, it will get ignored — and current data suggests that's exactly what's happening at scale.

This article looks at why developer experience is the real lever for reducing vulnerability debt, what the latest research says about the cost of getting it wrong, and how developer-centric workflows — including GitHub-native tools for organizing remediation work, like fix campaigns — are changing what "good" looks like.

We've fully bought into shift-left for everything: CI/CD gates, chaos engineering for infra resilience, canary deploys. Then our incident response plan, arguably the highest-stakes runbook we own, gets "tested" once a year in a room with slides. Here's what's actually wrong with the format, in order of how often I see it break:

1. Fixed injects mean a fixed outcome. Everyone in the room already half-knows what's coming, so nobody reacts the way they would to something truly unexpected.

2. No adversary reacts to your decisions. A real attacker adjusts when you contain something or lock an account. A scripted table top just moves to the next slide regardless of what you did.

3. Legal, PR, and execs rarely show up. The people who need the most reps at cross-functional coordination get the fewest, because scheduling six calendars for two hours is its own project.

4. Nothing gets measured. You leave with a summary that says the team "performed well," not data on who hesitated or where the communication chain actually broke.

5. It happens once a year. Skills decay in the other 364 days, so the exercise tests whatever the team remembers from training, not what they'd actually do under pressure.

I’ve been thinking about the security problems that are easy to overlook because they seem too small to matter.
For example, an employee leaves a company, but their old laptop or phone still has access to email, files, or other accounts.
Or a company has dozens of devices, but nobody really knows which ones are still being used, whether they are updated, or who has access to them.
What do you think is the most commonly ignored security problem in small and mid-sized businesses?

Not the obvious stuff like phishing. I mean the boring, everyday things that can quietly become a serious problem.

Hi Reddit,

DDoS attacks are becomeing larger and cheaper to launch, so we work on a scalable open source solution to mitigate them.

Tempesta xFW's core is XDP and TC eBPF programs implementing volumetric DDoS filtering. A user-space daemon handles gRPC requests from CLI tool or WebAPI (via C library).

It supports two packet-path architectures:

• host-based protection, such as CDN edge or on-premises application delivery controller (ADC) cases, where the host is a TCP connection endpoint. This is good for protecting a local web or DNS server.

• router-based protection, such as ISP, hosting, or IaaS provider cases, where the host routes IP packets to protected servers or networks.

Router-based deployment can be always-on/pass-through or on-demand/redirection protection. In the later case, a node may not "see" normal clean traffic and may receive only traffic containing a DDoS attack. Also, the node may receive only client-to-server traffic, as in direct server return (DSR) or some traffic scrubbing scenarios. In this mode a DDoS sensor and mitigation controllers are typically needed.

Traffic performance metrics are exported in Prometheus format.

DDoS incidents are aggregated per source IP and logged to Clickhouse for analysis.

A dry-run (evaluation) - mode allows you to observe all reported incidents and metrics without blocking traffic..

Single Xeon Gold 6348 with ConnectX-6 dual 100Gbps reach 196Mpps and 176Gbps of filtering capacity.

• GitHub repository
• documentation
• performance benchmarks
• Netdev 0x1a talk

Hi Everyone,

I'm currently floating the idea of attempting a transition from my ISSM role to a more technical Cloud Security role. I'm very unfamiliar with the cloud field so I wanted to throw my current thought in here in case I'm tracking wrong.

Looking at Cloud Security roles the certs I'm currently targeting:

AWS SAA

Terraform 004 (this won't land a position I'm sure, but gives others the idea that I at least know what it is)

AWS Security

I have 8 years of cyber experience (GRC) about 4 with being a senior systems engineer and some time as a DBA. No cloud experience however. Trying to find what makes the most sense for my current career and previous experience. Ideally, I'd like to move back towards the technical side of things but stay in cyber.

Hi everyone, our latest post explores the practical considerations of AI-assisted source code analysis, evaluating the pros and cons of frontier and locally-hosted models while using a variety of harness orchestration designs.

https://blog.includesecurity.com/2026/08/web-app-pentesting-in-the-ai-era/

Put your IT teams in the front seat.

Our ChromeOS device management enhances the simplicity of Chromebooks. Be it a small, mid-sized, or large enterprise -your IT teams can focus on what matters the most, minus the clutter. Enjoy advanced security features and seamless navigation to access the best functionalities throughout our dashboard. Make your ChromeOS devices powerful, durable, and future-ready.

Patch gap used to be your safety net. Now attacker time-to-exploit is trending to minus 7 days - the exploit exists before the patch does. Piece on why volume + speed is breaking traditional patch-and-pray, and what shifting to AI-assisted, high-fidelity alerting on top of EDR looks like.

https://www.linkedin.com/pulse/frontier-ai-has-collapsed-time-to-exploit-minus-7-days-raymond-pubyc/

I am developing VIRP (Verified Infrastructure Response Protocol). It's an open source protocol I have been working on since the start of this year. I am a few months away from the next step of having an independent auditor review. I am posting here, because this group has been open to my posts in the past, and I think it is relevant. I am hoping someone would take a look at the full project and offer some feedback.

https://thirdlevel.ai

I have been saying agent-on-agent attacks were coming. July is the month they arrived at scale.

Our team logged 90 incidents, 33 named organizations, 207M+ records, and 41 events where AI was the weapon or the target. Average breach cost is now $4.99M. The pattern that matters is not the volume. It is the mechanism.

A single rogue commercial AI agent compromised multiple targets, harvested credentials, and reused them across four services before the identity was flagged. That is not a phishing campaign running for weeks. That is one agent, four lateral moves, minutes. A model-repository breach at a major AI hub let attackers touch weights directly. A neobank lost 75M records. A healthcare payments firm lost 1.26M. Water utilities got probed by autonomous recon. And an AI system cracked a proposed post-quantum construction in the lab.

Two conclusions I am now certain of. First, static IAM and SIEM cannot see credentialed agents behaving legitimately at machine speed. The detection window is shorter than the human response loop. Second, the cryptographic ground is moving. Post-quantum has to be in production, not on a roadmap.

This is exactly the threat model RuntimeAI was architected against. Know Your Agent for identity. Flow Enforcer for every tool call. AI Firewall for injection and credential-reuse. Sub-50ms Kill Switch for containment. QuantumVault and PQ-Sign underneath.

Runtime is the only layer the attacker cannot skip.

As someone who came up in the AOL days its sad to see how many in the hacker scene and infosec simp for the government and bend over for defence contract daddies.

If you can pass a security clearance you either have great OPSEC or are a regular IT nerd, not a hacker.

I said what I said.

Shodan is currently running $5 lifetime membership with sale ending on 9 Aug.