Topic
Emerging Issue
AI Is Accelerating Vulnerability Discovery. Tanium Helps You Keep Up.
Daily vulnerability findings across Tanium customer environments jumped from around 1 billion before mid-June 2026 to as high as 6 billion in September. Here is what is driving the surge and how to keep up.
Hunt or be Hunted: FalconFlank Zero-Day
Within 48 hours of the FalconFlank exploit's release, Tanium HuntIQ built seven behavioral detections and a single Atlas hunt prompt to catch attackers who turn CrowdStrike Falcon's own privileged clean-up against itself. See how Tanium Atlas sweeps an entire Windows fleet for the exposure in about a minute.
Hunt or be Hunted: ShieldBreak Zero-Day
Learn how Tanium HuntIQ turned a Windows Defender zero-day into a tested mitigation before a CVE was assigned.
Latest agentic AI developments and industry trends
A practitioner's guide to the capability shifts, framework changes, and regulatory developments reshaping how enterprise IT and cybersecurity teams govern, deploy, and defend against autonomous agents.
Critical Netlogon RCE on domain controllers (CVE-2026-41089)
A critical, unauthenticated remote code execution vulnerability in Windows Netlogon (CVE-2026-41089, CVSS 9.8) lets a remote attacker run code as SYSTEM on a domain controller. Patch all domain controllers in the same maintenance window with the May 2026 security updates.
Locked Shields and the OSI Model: Stop blaming the firewall
A back-to-basics walk through what blue teams actually defend at each layer, and why the unglamorous stuff (Layer 2, BGP) keeps deciding the scoreboard.
May 2026 GitHub breach: Extension hygiene is still a challenge–so what can we do about it?
On May 20, 2026, GitHub disclosed that an employee device was compromised through a malicious VS Code extension, with attackers claiming to have exfiltrated roughly 3,800 internal repositories.
Mini Shai-Hulud supply chain attack: Why this campaign changes how defenders should think about trusted software
The Mini Shai-Hulud supply chain attack compromised more than 170 packages across npm and PyPI, including packages from TanStack, Mistral AI, and Guardrails AI, by hijacking legitimate CI/CD publishing workflows to distribute malicious versions that still carried apparently valid provenance signals.
Is Windows Autopatch ready for enterprise use, or does it trade too much control for convenience?
Windows Autopatch is a Microsoft service, included with Windows Enterprise E3 and above, that automates the scheduling and deployment of Windows quality updates, driver updates, and Microsoft 365 app updates across Intune-managed devices. It reduces the manual overhead of patch scheduling by managing update rings and cadence on your behalf, but it does so by abstracting away the granular controls that enterprise patch management workflows typically depend on.
Copy Fail (CVE-2026-31431): What Linux administrators need to know now
Copy Fail, or CVE-2026-31431, is a Linux kernel local privilege escalation vulnerability that can let an unprivileged local user corrupt page-cache-backed file data under specific conditions and potentially escalate privileges. Exposure depends on the running vendor kernel and backported fixes. Installing a vendor-provided kernel fix is the primary remediation, with temporary mitigations available in some environments if patching is delayed.
How Mythos is reshaping enterprise security posture
Tanium CRO Pedro Diaz and Sr. Director of Solution Engineering Mark Liu break down why Anthropic's Mythos model is fundamentally changing the threat landscape, and what enterprise security teams must do right now to keep pace with machine-speed attacks.
Vercel security incident: What the breach reveals about OAuth trust, supply chain risk, and response speed
Public reporting suggests the incident involved abuse of a third-party application that had been granted OAuth access to a Vercel employee account, enabling unauthorized access to some internal resources. Certain customer‑related tokens, environment variables, or other access artifacts may have been exposed, though Vercel has not stated that password theft was part of the initial access path. The breach illustrates how trusted SaaS integrations and delegated access have become a significant attack surface for enterprises with interconnected developer workflows, even when no software vulnerability in production infrastructure is exploited.