The attack surface keeps finding new places to hide. |
Today’s stories feature browser bugs, hidden proxy networks, supply chain risks, deepfake defenses, and a warning that AI threats may be moving faster than organizations can respond. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Protobuf Bugs Open Door to RCE |
Six vulnerabilities in a popular JavaScript library could enable RCE, DoS attacks, and software supply chain compromise. Cyera researchers found the flaws in protobuf, a Google Protocol Buffers implementation with more than 50 million weekly downloads that often appears as a hidden transitive dependency. |
Attackers could abuse malicious schema data to inject code into CI/CD pipelines, crash services, or exploit prototype pollution across Google Cloud libraries.
Audit both direct and transitive dependencies, patch to the latest protobuf[.]js versions, and review CI/CD workflows that process externally sourced proto files or schema descriptors. |
Smart TVs Secretly Power AI Scraping |
Millions of smart TVs and mobile devices may be unknowingly supporting AI data collection through free apps that enroll them in residential proxy networks.
According to Include Security, Bright Data's software routes web-scraping traffic through users' devices, creating residential IP networks that can bypass anti-bot defenses. Connected TVs are often hard to monitor, and the SDK may relay traffic during use while bypassing some VPN visibility tools.
Review network logs for connections to *[.]brdtnet[.]com and *[.]luminatinet[.]com, and include smart TVs and streaming devices in asset inventories, monitoring, and incident response plans. | Microsoft Edge Flaw Enables Code Execution |
A Microsoft Edge vulnerability could allow attackers to execute code on a victim’s system by convincing them to open a malicious file or visit a specially crafted webpage.
The Microsoft Edge flaw stems from improper validation of user-supplied file paths during feedback log processing, potentially allowing attackers to manipulate file operations. Microsoft already released patches for this and two other Edge vulnerabilities.
Search EDR logs for unusual child processes spawned by Edge and apply the latest patches. |
|
|
|
Should Smart TVs Require Opt-In for Data Routing? |
|
|
|
Yesterday's Pulse Check Results |
A critical vendor ships compromised code tomorrow. What's your response? |
|
|
|
Security Tools You Can Use |
|
|
|
Social Platforms Battle Rising Deepfake Threats |
Social media platforms are struggling to combat deepfakes, AI scams, and synthetic identities as generative AI accelerates fraud at scale. Deepfakes and AI-generated content are fueling fraud, impersonation scams, and other online abuse at scale. |
According to Wizz COO Alexandra Ryabova, identity verification, AI moderation, and laws like the TAKE IT DOWN Act are becoming key safeguards against harmful content.
Evaluate whether your organization’s social media and collaboration platforms can verify user identities and detect AI-generated content before it reaches employees, customers, or brand channels. |
Report Flags Growing AI Security Risks |
The 2026 Digital Risk report found that 84% of organizations experienced a digital risk incident amid rising AI-driven threats. Only 7% of organizations consider their digital risk programs mature, while 44% cite AI-generated attacks as their biggest visibility challenge.
The report also found limited oversight of AI agents and fragmented monitoring across digital channels, making it harder for security teams to detect and respond to threats. Create a cross-functional digital risk ownership team now and inventory all AI agents, executive-facing accounts, and brand assets before attackers identify gaps first. |
|
|
|
Reducing the Risk of Data Theft |
Data theft protections help organizations detect and stop attackers before sensitive information is exposed or stolen. |
How to protect sensitive data |
- Protect accounts and access with MFA and privileged access management (PAM) to reduce the risk of credential theft and unauthorized access to sensitive systems.
-
Monitor endpoints and user activity with EDR/XDR tools and user activity monitoring to identify suspicious behavior, unusual downloads, and potential data exfiltration attempts.
-
Control sensitive data movement with data loss prevention (DLP) and cloud access security brokers (CASBs) to prevent unauthorized sharing across email, cloud applications, and endpoints.
|
Reducing data theft risk starts with controlling access, monitoring behavior, and limiting unnecessary data exposure. |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
