Topic
Emerging Issue
Mini Shai-Hulud supply chain attack: Why this campaign changes how defenders should think about trusted software
The Mini Shai-Hulud supply chain attack compromised more than 170 packages across npm and PyPI, including packages from TanStack, Mistral AI, and Guardrails AI, by hijacking legitimate CI/CD publishing workflows to distribute malicious versions that still carried apparently valid provenance signals.
Is Windows Autopatch ready for enterprise use, or does it trade too much control for convenience?
Windows Autopatch is a Microsoft service, included with Windows Enterprise E3 and above, that automates the scheduling and deployment of Windows quality updates, driver updates, and Microsoft 365 app updates across Intune-managed devices. It reduces the manual overhead of patch scheduling by managing update rings and cadence on your behalf, but it does so by abstracting away the granular controls that enterprise patch management workflows typically depend on.
Copy Fail (CVE-2026-31431): What Linux administrators need to know now
Copy Fail, or CVE-2026-31431, is a Linux kernel local privilege escalation vulnerability that can let an unprivileged local user corrupt page-cache-backed file data under specific conditions and potentially escalate privileges. Exposure depends on the running vendor kernel and backported fixes. Installing a vendor-provided kernel fix is the primary remediation, with temporary mitigations available in some environments if patching is delayed.
How Mythos is reshaping enterprise security posture
Tanium CRO Pedro Diaz and Sr. Director of Solution Engineering Mark Liu break down why Anthropic's Mythos model is fundamentally changing the threat landscape, and what enterprise security teams must do right now to keep pace with machine-speed attacks.
Vercel security incident: What the breach reveals about OAuth trust, supply chain risk, and response speed
Public reporting suggests the incident involved abuse of a third-party application that had been granted OAuth access to a Vercel employee account, enabling unauthorized access to some internal resources. Certain customer‑related tokens, environment variables, or other access artifacts may have been exposed, though Vercel has not stated that password theft was part of the initial access path. The breach illustrates how trusted SaaS integrations and delegated access have become a significant attack surface for enterprises with interconnected developer workflows, even when no software vulnerability in production infrastructure is exploited.
Understanding shadow AI in your endpoint environment
Learn how shadow AI appears on endpoints, from local models to MCP servers, and why visibility, governance, and secure configuration matter now.
Claude Mythos security risks: What the Anthropic System Card tells us
Anthropic's Claude Mythos Preview demonstrated significant acceleration in capabilities for autonomously identifying vulnerabilities and exploit chains across major software and operating systems. Government and industry leaders are focused on understanding the real risks the model presents, and how to leverage these advanced technologies to protect and defend against adversarial use.
Axios npm package compromise: What happened, what matters, and how to respond
Learn what happened with the Axios npm package vulnerability, how to confirm exposure to malicious versions, and how Tanium Guardian can help investigate.
Claude Code source exposure: What enterprises should do next
Inside the npm packaging mistake that exposed half a million lines of Claude Code.
CVE‑2025‑47813: Wing FTP Server vulnerability flagged by CISA
CISA KEV‑listed CVE‑2025‑47813 exposes Wing FTP Server install paths used in attack chains. Learn which versions are affected and how to remediate.
A Supply Chain Attack in Notepad++
The Notepad++ update process was compromised by a supply chain attack, and users are strongly advised to upgrade to version 8.8.9 or later to ensure their security.
IDE extensions: a new persistent risk to your organization
User-installable extensions for Visual Studio Code, Cursor, and other Integrated Development Environments are an increasingly exploited attack vector, with new malicious extensions discovered almost weekly. Do you have visibility and control?