Policy Roast: The Citrix NetScaler Emergency Patch Cycle That Never Ends
Citrix just issued another 'patch immediately' advisory for NetScaler. When emergency patching becomes routine, the policy is the vulnerability.
Karla Ortiz-Flores
Exhibit A(I): If you self-host Langflow, update now. CVE-2026-33017 is unauthenticated RCE exploited in 20 hours. Attackers harvested API keys from live instances.
If you self-host Langflow, immediate updates are crucial.
Breach Autopsy: Trivy's Supply Chain Compromise Spreads Malware Across Docker Hub
The Trivy vulnerability scanner supply chain attack demonstrates how compromising a single trusted security tool cascades into widespread malware distribution.
Explain This: Microsoft's Agentic AI Security Strategy
Microsoft's new AI security controls address the unique risks of autonomous agents that make decisions without human approval.
Policy Roast: When Compliance Theater Becomes Fraud
Delve marketed SOC 2 and ISO compliance it didn't have. That's not a mistake—it's false advertising.
The Docket: FBI Links Signal Phishing Campaign to Russian Intelligence
Russian intelligence services are phishing for Signal contacts. The FBI just confirmed it.
Breach Autopsy: Quest KACE and the Education Sector's Vulnerability Management Problem
Critical Quest KACE vulnerability exploited in education attacks exposes patch management failures in K-12 systems.