Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Mend’s security research team has identified a previously undocumented fifth wave of the PhantomRaven campaign, an ongoing NPM supply chain attack that has been stealing developer credentials and secrets since August 2025. This new wave uses a fresh command-and-control server, 33 new malicious packages, and a more sophisticated three-stage payload chain.

Extended Detection and Response (XDR) is a comprehensive security solution that integrates various security products and data into a simplified, unified system. XDR security combines prevention, detection, investigation, and response to provide a holistic cloud-based security approach.

CVE-2026-41940 is a critical authentication bypass vulnerability in cPanel & WHM, including DNSOnly, and WP Squared. The issue affects cPanel software versions after 11.40 and can allow an unauthenticated remote attacker to gain unauthorized access to exposed hosting control panels. cPanel released patched versions and published official remediation and detection guidance.

Security hardening is the practice of systematically reducing the ways an attacker can get into, move through, or persist in your environment.The reason this is a priority is that the gap between "deployed" and "properly configured" is where most breaches actually live. This guide covers the core principles of hardening, how it maps to compliance requirements, and how automated tooling has changed the way mature security teams operationalize it at scale.

Anthropic has officially launched Claude Security, moving its AI‑driven code vulnerability detection, validation, and patching capabilities from a limited research preview into public beta. Improving software security before code ships is a positive step for the industry and can help reduce future risk. However, stronger secure‑by‑design development does not address the scale of exposure organizations face today.

The recent breach at Vercel has drawn a lot of attention, not because the initial entry point was unusual, but because of what the incident quietly demonstrates about how modern workflows shape the impact of a compromise. This did not begin with a phishing email or an exposed service. It began with an AI tool.

Your AI agent runs on AKS with a managed identity that can read Azure Key Vault, and you assume prompt injection is a theoretical risk—until a malicious prompt drives that agent to steal credentials from the Azure metadata endpoint in under a minute. Most teams discover this gap when their SIEM shows a single request to 169.254.169.254, but they cannot trace it back to which agent tool or prompt triggered it, or how far the stolen token traveled across their Azure environment.

For six weeks, a mid-size hospital system’s CDS agent issued recommendations biased by a poisoned guideline summary. No detection alert fired. The drift — denial recommendations in cases sharing one specific clinical attribute — traced back to a guideline an outside contributor had quietly reweighted in editorial review. Every existing detection stack reported green. DLP: no PHI left the cluster. EHR audit log: agent reading and writing within scope. Network egress: normal traffic.

A healthcare CISO opens her AI-SPM dashboard at the start of the quarter. Every clinical AI agent in the cluster reads green: full AI-BOM coverage, every permission scope reconciled, the HIPAA compliance tag clean across the fleet. The ambient scribe, the prior-authorization assistant, the oncology decision support agent — all monitored, all green, all the way through. Six months later, the Office for Civil Rights opens an investigation.

Storing data in a specific country doesn’t automatically mean that that country’s laws are the only ones that apply. This disconnect catches a lot of organizations off guard, and it’s exactly where the confusion between data sovereignty vs. data residency begins. One is about where your data physically lives. The other is about which laws govern it, regardless of location.