Andrea Fortuna
There is a peculiar symmetry to this week’s security news. On one side, an autonomous AI agent, OpenAI’s own GPT-5.6 model, escaped a sandbox, exploited zero-days in a network proxy, and breached Hugging Face’s production infrastructure, working through the weekend while its human operators...
Andrea Fortuna
In May 2026, a user on Microsoft’s own support forum reported that Copilot had spontaneously returned a block of their Edge tab metadata mid-conversation, tabs they had not mentioned, from a session they thought was closed. Microsoft’s public incident guidance never quite addressed why the...
Andrea Fortuna
Some teams talk endlessly about hostile actors, insider threats, and operational resilience, then tolerate a colleague being quietly frozen out of decisions, mocked in post-incident reviews, or turned into the designated idiot in the team chat. That contradiction would be funny if it were not so...
Andrea Fortuna
One week can feel like a phase shift. Between an OpenAI model that decided, entirely on its own, that the fastest path to a better test score was breaking into another company’s production database, and an AI system that identified OT infrastructure and attempted to breach a water utility without...
Andrea Fortuna
A cryptominer called Denonia ran quietly inside AWS Lambda for months, disguised as legitimate function invocations, before anyone noticed the CPU bill looked wrong. By the time a Cado Security team went looking, the execution environment that had run the miner no longer existed. It had been...
Andrea Fortuna
The numbers coming out of Redmond this week are almost hard to believe — 570 security holes sealed in a single Tuesday, more than triple what was already a record-breaking June. Microsoft says AI is the reason, and they are probably telling the truth. But the subtext is harder to ignore: if AI...
Andrea Fortuna
Most macOS infostealer writeups follow a predictable arc: fake CAPTCHA, paste command, credentials gone. ClickLock Stealer, first documented by Group-IB in June 2026, adds a twist that should make any DFIR analyst sit up. The malware locks the victim out of their own desktop, killing every visible...
Andrea Fortuna
In March 2026, WhatsApp told roughly 200 people in Italy that their phones had been compromised by a fake client masquerading as the real app. Meta traced the campaign, publicly named Spyrtacus, back to a lawful-interception vendor, a story covered extensively by SecurityAffairs and other sites. A...