EDR Killers Are Getting Smarter: 54 Tools Now Using Signed Drivers to Bypass Security

I’ve been tracking some concerning developments in the security space this week, and there’s one story that really caught my attention. We’re seeing a significant evolution in how attackers are dismantling our defenses, particularly when it comes to endpoint detection and response systems.

The BYOVD Problem Just Got Worse

A new analysis shows that 54 different EDR killer tools are now using the “bring your own vulnerable driver” (BYOVD) technique, exploiting a total of 34 signed but vulnerable drivers to disable security software. If you’re not familiar with BYOVD, it’s essentially attackers bringing legitimate, digitally signed drivers that happen to have security flaws, then exploiting those flaws to gain kernel-level access.

The Perfect Storm: When Zero-Days Meet AI and Critical Infrastructure

Well, this has been quite the week for security professionals. While we were all settling into our Tuesday routines, threat actors were apparently having a field day with some pretty serious vulnerabilities. Let me walk you through what caught my attention – and why you should care about each of these developments.

The Cisco FMC Nightmare That’s Already Being Exploited

First up, and probably the most urgent item on today’s agenda: Interlock ransomware is actively exploiting a critical Cisco Secure Firewall Management Center vulnerability. CVE-2026-20131 scored a perfect 10.0 on the CVSS scale – and for good reason.

Even Cybersecurity Firms Aren’t Safe: Lessons from This Week’s Attack Trends

I’ve been digging through this week’s security incidents, and there’s a pattern emerging that should make all of us pause and reassess our defenses. The most telling story? Hackers successfully targeted Outpost24, a cybersecurity firm, with a sophisticated seven-stage phishing campaign aimed at their C-suite executive.

Let me walk you through what happened and why it matters for all of us defending our organizations.

Supply Chain Attacks Are Getting Smarter While Ransomware Groups Adapt to Shrinking Profits

This week brought some sobering reminders about how creative attackers are getting with their methods. Between a sophisticated supply chain campaign hitting developer tools and ransomware groups pivoting their tactics due to declining profits, it’s clear that threat actors are adapting faster than many of us would like.

GlassWorm Returns with a Vengeance

The GlassWorm supply-chain campaign is back, and this time they’ve cast a much wider net. We’re talking about a coordinated attack that hit over 400 packages and repositories across GitHub, npm, and even VSCode/OpenVSX extensions.

Apple’s Background Security Updates and the Shift Toward Stealth Attacks

Last week brought some fascinating developments in our field, and I wanted to share what caught my attention. We’re seeing a clear pattern emerge: attackers are getting more sophisticated about staying hidden, while defenders are finally building systems that can respond without disrupting users.

Apple’s Game-Changing Background Updates

The biggest news might be Apple’s first Background Security Improvements update. They patched CVE-2026-20643, a WebKit vulnerability, across iPhones, iPads, and Macs without requiring a full OS upgrade. This is huge for us in the enterprise space.

Shadow AI and Social Engineering: Why This Week’s Attacks Should Change How We Think About User Education

I’ve been watching the security headlines this week, and there’s a troubling pattern emerging that I think deserves our attention. We’re seeing a perfect storm of shadow IT adoption and increasingly sophisticated social engineering attacks that’s creating some serious blind spots in our defenses.

The Shadow AI Problem Is Real

Let’s start with something that’s probably happening in your organization right now: Shadow AI is everywhere. Employees are spinning up AI tools faster than we can track them, and honestly, I don’t blame them. These tools are genuinely useful for getting work done.

When AI Sandboxes Leak and Exchange Goes Dark: This Week’s Security Reality Check

You know those weeks where everything seems to happen at once? This is one of them. While Microsoft users were locked out of their mailboxes yesterday, researchers discovered that AWS’s AI tools have a data exfiltration problem, and somewhere in Asia, state-sponsored hackers are playing the longest game imaginable.

Let me walk you through what caught my attention this week and why these incidents matter more than the usual security news cycle suggests.

Olympic Cybersecurity Lessons and This Week’s Linux Privilege Escalation Mess

You know those weeks where the security news feels like someone’s playing whack-a-mole with vulnerabilities? This week definitely hit that vibe. Between some fascinating insights from the Paris Olympics security team and a fresh batch of Linux privilege escalation flaws, there’s quite a bit to unpack.

What We Can Learn from Defending the Olympics

The most interesting piece this week came from Franz Regul, who served as CISO for the Paris 2024 Olympics. If you’ve ever wondered what it’s like to secure an event that literally has the world watching, his insights are worth your time.

When Even Security Pros Get Phished: A Week of Evolving Threats and Hard Truths

You know that uncomfortable feeling when you realize attackers are getting better faster than we are? This week’s security news hit that nerve pretty hard. From malware that’s learning to play hide-and-seek in our dependencies to phishing attacks so sophisticated they’re fooling security executives, we’re seeing some concerning trends that deserve our attention.

The Irony of Targeting Security Professionals

Let’s start with the elephant in the room: a security firm executive got successfully phished this week. Before anyone starts throwing stones, this wasn’t some amateur hour attack. The attackers brought their A-game with DKIM-signed emails, trusted redirect infrastructure, compromised servers, and Cloudflare-protected phishing pages.

Microsoft’s 84 Patches and the BlackSanta EDR Killer: Why March is Already a Nightmare for Defense Teams

Coffee hasn’t even kicked in yet and we’re already dealing with one of those weeks where everything seems to be on fire at once. Microsoft just dropped 84 patches in their March Patch Tuesday release, including two zero-days that were already public knowledge, while a new Russian campaign called “BlackSanta” is specifically targeting our endpoint detection tools. Oh, and if you thought your patch management was already overwhelming, Apple just pushed emergency updates for older devices against something called the Coruna exploit kit.