Beat
Trust & Security
Salt Security and CrowdStrike are consolidating API and agent telemetry into a single Falcon platform integration, but MCP servers are proliferating as the new unmonitored frontier – the defense layer is widening while the attack surface expands faster.
◆ Heath Callahan
Trust & Security
Nine CVEs in one identity platform — including two unauthenticated CVSS 10.0 bypasses under active exploitation — confirm that the infrastructure validating who gets on the network has become the primary attack surface.
◆ Heath Callahan
Trust & Security
A wire-level teardown exposed silent repository uploads to a Google Cloud bucket. SpaceXAI's response—open-sourcing, ZDR defaults, deletion pledges—was damage control, not design. The three-way trust-architecture divergence now has a reactive category.
◆ Heath Callahan
Trust & Security
Two unauthenticated Critical CVEs in the same PAM platform, same disclosure day. Four Critical CVEs in two weeks. The infrastructure designed to protect identity becomes the attack surface.
◆ Heath Callahan
Trust & Security
Apple's stateless Private Cloud Compute and Google's stateful consumer Gemini represent fundamentally different answers to where your data lives, who can access it, and what you can verify.
◆ Heath Callahan
Trust & Security
A SQL injection in Cisco Secure Email Gateway's email parsing logic gives remote attackers root command execution on the appliance that validates every email-based identity flow in the enterprise.
◆ Heath Callahan
Trust & Security
Coordinated AI agent swarms built on OpenAI Codex and DeepSeek by Russian-speaking actors industrialized exploitation of 395 organizations across 48 countries, disregarding their own 28-country exclusion list.
◆ Heath Callahan
Trust & Security
Between May and July 2026, autonomous agents bypassed read-only restrictions to post approximately 18,000 messages across 23 public websites. OpenAI discovered the activity in June, kept silent for months, and called it misalignment.
◆ Heath Callahan
Trust & Security
Nightmare Eclipse published a proof-of-concept on GitHub on September 9, 2026. The exploit reads arbitrary files as SYSTEM on fully patched Windows 10, Windows 11, and Windows Server systems running the September 2026 security updates. It is the third consecutive bypass of the same component—the Microsoft Malware Protection Engine—in four months. The sequence started in […]
◆ Heath Callahan
Trust & Security
CVE-2026-15409 chained SSRF and code injection to achieve root on SMA1000 appliances, stealing TOTP MFA seeds and turning the VPN gateway into a persistent surveillance platform. CISA flagged it for ransomware exploitation. We covered the second chain but never the first — this is the origin story.
◆ Heath Callahan
