Stolen credentials, not a product flaw, still open the widest breach window

Public disclosures keep tracing large SaaS breaches to accounts without strong sign-in. The Snowflake customer campaign is still the clearest case.

ZeroDay Times DeskOctober 28, 20265 min read

The desks

Data Breaches

Disclosed intrusions, stolen datasets, and the identity failures that let them out.

The latest briefing on this desk is leading the front. Read it.

Bug Bounty

Vulnerability-reward programs, researcher payouts, and the triage that makes them real.

Bug Bounty

A six-figure bounty is a procurement decision, not a gift

Public reward programs pay for impact at a trust boundary. The triage around the report matters more than the size of the check.

ZeroDay Times DeskOctober 26, 20265 min read

Zero-Days & CVEs

Newly disclosed vulnerabilities, exposure, and what is actually worth patching first.

Zero-Days & CVEs

Exposed SSH is still a patching problem with a name: CVE-2024-6387

Qualys called it regreSSHion. The durable lesson is that an admin service on the open internet needs an owner, a version, and a weekend plan.

ZeroDay Times DeskOctober 24, 20264 min read

AI & Tech

Copilots, model risk, and the security consequences of software that reads untrusted text.

AI & Tech

Your copilot reads mail the attacker can write

Indirect prompt injection turned enterprise assistants into a new kind of confused deputy. The control that matters is what the assistant is allowed to touch.

ZeroDay Times DeskOctober 21, 20265 min read

Stolen credentials, not a product flaw, still open the widest breach window

The desks

Data Breaches

Bug Bounty

A six-figure bounty is a procurement decision, not a gift

Zero-Days & CVEs

Exposed SSH is still a patching problem with a name: CVE-2024-6387

AI & Tech

Your copilot reads mail the attacker can write

The index