The Signal
Must Know
Incident · Cyberscoop
What happened
CISA published “CISA 2030: Defend, Harden, Prevail,” a strategy focused on leading cyber defense, protecting critical infrastructure, and building resilience against attacks. [3]
The strategy’s objectives include integrating state, local, and industry cyber defense; protecting operational technology; improving software-security guidance; and assessing emerging technologies. [3]
Why it matters
CISA’s acting director said adversaries are becoming more sophisticated and that strong defenses do not guarantee intrusions will be eliminated; he emphasized rapid detection, eviction, and continuity of critical operations after compromise. [3]
Cloud · The Hacker News
What happened
An automated campaign uses stolen GitHub tokens to plant workflows that print repository secrets into GitHub Actions logs, downloads those logs, and then deletes the workflow runs. [1]
According to analysis by cloud security company Wiz, the attacks have succeeded in private repositories and GitHub Enterprise environments. [1]
Why it matters
Repository automation and log access create an operational boundary for secret handling that deserves the same scrutiny as source access. [1]
Exploitation · The Hacker News
What happened
Wasmtime maintainers say two critical flaws could allow a malicious WebAssembly module to escape the sandbox intended to contain it. [2]
Exploitation requires a vulnerable Wasmtime build and an attacker-controlled WebAssembly module; one flaw affects only ARM64 systems. [2]
Why it matters
Sandboxing is a meaningful boundary only when deployments also control untrusted modules and vulnerable runtime builds. [2]
AI & Agents · Helpnetsecurity
What happened
Forever Security found that an AGENTS.md file saved to a website’s Downloads folder without approval can lead AI coding agents to install a malicious npm package or disclose a user’s login token when the file is opened in that folder. [5]
Why it matters
AGENTS.md is a plain-text document that developers place in project folders to provide instructions to AI coding agents that can write and run code autonomously. [5]
Research · Theregister Security
What happened
Internet governance bodies, including ICANN and the IETF, have begun preliminary work to prepare DNSSEC for quantum computers that could challenge conventional encryption. [4]
ICANN’s CTO said predictions of quantum computers arriving around the turn of the decade changed his view: DNS quantum readiness may be needed in fewer than ten years, though he could not narrow the estimate beyond roughly three to five years. [4]
Why it matters
Quantum-proofing DNSSEC with larger keys could create larger zones, packets, and responses, potentially requiring DNS traffic to use multiple TCP packets rather than preferred single UDP messages. [4]
Also Worth Knowing
AI & Agents · Helpnetsecurity
What happened
Anthropic described security and privacy protections for Claude Duet, a proactive AI agent that can monitor connected accounts and complete tasks while users are away. [6]
AI & Agents · Helpnetsecurity
What happened
A Linux Foundation survey of 234 open-source contributors and maintainers found that people running projects with more than 50 contributors estimated that nearly one-third of code changes in their queues were low quality or AI-generated. [7]
AI & Agents · Helpnetsecurity
What happened
Arrakis Security’s 2026 Autonomous Agents Threat Report states that AI agents that have not run recently retain credentials and connections to company systems. [8]