All topics
This week we have some old-school disclosure drama when a researcher used full disclosure after months of silence from Cursor, then we discuss the enormous Patch Tuesday from Microsoft–662 bugs–and what it might mean going forward, and finally some news about DoJ sanctions and Scattered Spider members being sentenced. Links Cursor bug: https://decipher.sc/2026/07/15/bug-in… First VPN […]
It’s a pre-July 4th extravaganza! To celebrate, we dive into a little cybersecurity history with a story about the MySpace Samy worm, then we jumpe into the news of the week, including an update on the Fable 5 export control drama, and the emergence of the ARToken operator panel. Links ARTokens story: https://decipher.sc/2026/06/26/new-turla-stockstay-backdoor-emerges/ Scattered Spider […]
This new ARToken operator panel has a clear lineage going back to the EvilTokens framework, which emerged in early 2026.
We regret to inform you that there are more npm supply chain attacks this week, and a new variant of the Shai Hulud worm is involved. We also talk about the new analysis from Anthropic on a year of data relating to how attackers are using AI in their operations, and the continuing adventures of Microsoft’s relationship […]
Microsoft's reaction to the Nightmare-Eclipse saga is raising memories of the worst days of the disclosure debate.
The current exploits are targeting CVE-2026-32202, a bug in the Windows Shell that allows an attacker to gain access to some sensitive data on the target network.
