From Prevention to Resilience: Reducing What Attackers Can Reach in a Zero-Trust World securityreviewmag.com
What if zero trust meant shrinking the blast radius, with passwordless, VMI, CBOMs, and a staged PQC migration?
trending11
01 02 [tl;dr sec] #336 - Autonomous Vulnerability Hunting, GuardDog 3.0, Are Bug Bounties Cooked? tldrsec.comSecurity newsletter issue on AI vuln hunting, GuardDog 3.0, bug bounty economics, and assorted supply-chain/RAT/jailbreak bits.03 Post-quantum keyslots, because passphrases were too mainstream: a Rust encrypted-container tool that mounts real drives on 3 OSes.04 [tl;dr sec] #335 - Prompt Injection as Role Confusion, PHP Ecosystem Security, New MCP Spec tldrsec.comPrompt injection, apparently, is role confusion, in a newsletter that also hits PHP hardening and the new MCP spec.05 Even the FBI says TeamPCP turned dev tools into a credential vacuum for cloud keys, SSH, and K8s secrets.06 Auditing OpenReception: 16 CVEs in an end-to-end encrypted appointment booking platform moltenbit.netAudit of OpenReception, an E2EE appointment booking app, with 16 CVEs and the usual tenant-isolation comedy.07 How do you steal Gmail without the password? By abusing Chromium remote debugging and OAuth code theft via Umbrij.08 Security roundup: package proxies, AI-agent canary benchmarks, and OpenAI's Daybreak/Codex updates, plus the usual cloud mess.09 VivaTech 2026: AI Agents, Post-Quantum Cyber Resilience & The New Frontier Of Enterprise Security + Video undercodetesting.comPost-quantum migration is the easy part; the real mess is keeping AI agents from leaking data and swallowing deepfakes.10 AWS shows FHE inference on SageMaker with Concrete-ML, so the cloud can now host ciphertext and call it a feature.11 [tl;dr sec] #332 - I've Joined OpenAI, fwd:cloudsec, AWS Well Architected Supply Chain Security tldrsec.comWhat did tl;dr sec #332 pick out this week? OpenAI hire, AWS supply-chain advice, OIDC/Lambda abuse, and AI threat notes.