Path & Payload

In August 2026, Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal that it collectively named CoSnitch.

In 1994, Congress passed a law requiring U.S. telecommunications carriers to build a door for court-authorized surveillance.

Last week’s JadePuffer attack chain breakdown documented what happens when a sophisticated ransomware actor deploys an AI agent as a decision-making orchestrator across an end-to-end intrusion. bandcampro is at the opposite end of the spectrum: a solo ope…

In late June 2026, an AI agent appears to have executed the active phases of a ransomware operation — from reconnaissance through data destruction — with human involvement limited to only a few steps after setup.

Before the ransom demand lands in a target's inbox, the attacker has read their cyber insurance policy and used it to calibrate the number listed in the note.

By mid-March, 2026, a campaign began that would eventually hit hundreds of organizations per day across the United States, Australia, Canada, France, and more than a dozen other countries.

In April 2026, a software consultancy in the U.K. disclosed a breach.

Another AI coding tool has now patched an MCP configuration-to-execution flaw.

A single dormant credential at one mid-market software vendor exposed the CRM and customer engagement data of dozens of organizations.

In late 2025, a DragonForce affiliate operated for one to two months inside a major U.S. services firm.