Read Time: 8 minutes

Brought to you by:

Howdy friends!

Hope we’re all winding down on a great week. I don’t usually go for these things but I enjoyed some of the mindset language in this one. For some reason it resonated. So I wanted to pass along in case it hits any of you the way it hit me. - Take a few days off letting yourself feel overwhelmed, or saying things like "I just have so much to do”

This actually felt good to speak out loud. Had this conversation with my family, since we’ve been doing a whole lot of listing all the crap we have to get done this week in exasperated tones while exclaiming our exhaust. It was nice to reframe it as, well no actually we live a life of abundance and ease. Even if it doesn’t feel true to you at the moment of reading it - try talking it out.

I also asked my family if we could hold ourselves to one of the behavior changes. We all decided we’d like to replace phone scrolling. I’m replacing with reading or creating and gave everyone permission to call me out on it.

Idk, like I said - this kind of manifesting or “reset challenges” are not usually my jam, but the phrasing on this one worked on me at the moment. Let me know if it resonates.

ICYMI

🖊️ Something I think you’ll find cool: Ummm.. I’m keynoting a conference?! - Everyone say congrats. - Descent Cyber is in its second year and it’s a bunch of CISOs and security leaders who like to scuba getting together to talk. I’m going to keynote on current state of AI in cyber. I also apparently need to go get scuba certified first… There are a few spots left so if you’re into this kind of thing register on their site.

🎧️ Something I heard: Watched this wifi router get reverse engineered and hacked

🎤 Something I said: I ran through Unit 42’s 2026 Incident Response data report. It’s full of absolute gold.

🔖 Something I read: Introducing GPT 5.4 - (Important to stay on top of these capability changes)

Vulnerable News

FBI Investigating ‘Suspicious’ Cyber Activities on Critical Surveillance Network

Excuse me, what? The FBI says it detected suspicious cyber activity on a sensitive internal network used to manage wiretaps and intelligence surveillance warrants. Officials say they’ve identified and addressed the activity, but so far there are almost no technical details about what actually happened. Because the system is tied to surveillance infrastructure, the report is already prompting speculation about whether it could be related to past espionage campaigns like China’s Salt Typhoon telecom intrusions or broader geopolitical tensions.

Right now, though, we simply don’t have enough information to draw conclusions. When attackers target systems tied to surveillance operations, it’s often about figuring out what law enforcement knows about them, whether they’re being watched and what evidence might exist. And now I’m speculating. Given the sensitivity of the systems involved, this is definitely a spicy meatball worth watching. (read more)

Are you paying a 1000% interest rate on security debt?*

"Shift left" was supposed to save us time and money, but for most teams, it just shifted the friction. Today, 85% of organizations say security is disrupting delivery, creating a pipeline that generates vulnerabilities faster than you can fix them. The economics are brutal: security debt doesn’t just sit there; it gets exponentially more expensive the closer it gets to production.

Download The Economic Case for Prevention-First AppSec to learn how to:

• Stop paying the 1,000% on security debt.

• Restore engineering capacity by stopping risks before they reach the backlog.

• Transform AppSec from a cost center into a competitive advantage.

*Sponsored

Iran Fallout: Data Centers Hit, Misinformation Spreads

Several days into the conflict with Iran, a couple things stand out: The line between physical and cyber disruption continues to disappear, and misinformation can cause confusion even among those trained to be careful about the information they act on.

Reports that an AWS data center in the Middle East was hit by “objects that struck the data center creating sparks and fire” highlight a reality security teams rarely plan for: geopolitical conflict can take cloud infrastructure offline in ways no outage playbook anticipates. If an availability zone disappears because of a missile strike, recovery isn’t minutes or hours, it’s a physical rebuilding.

Meanwhile, confusion around viral claims that U.S. service members were warned to disable location services and uninstall apps like Uber and Snapchat shows how quickly misinformation spreads during conflict, and how real the risks of digital signals revealing physical operations can be. (read more here and here)

Look What You Made Us Patch: 2025 Zero-Days in Review

Google’s threat intelligence team tracked 90 zero-day vulnerabilities exploited in the wild in 2025, which puts us right back in the range we’ve been seeing for the past few years. That’s down from the record 100 zero-days exploited in 2023, but still within the broader 60–100 range we’ve been seeing annually. This report isn’t counting every vulnerability disclosed during the year, it’s specifically tracking zero-days attackers actually used before patches were available.

What makes this data valuable is that it shows what attackers are actually doing, not just what vulnerabilities exist. What jumped out to me this year wasn’t just the number of zero-days but where attackers are using them. Nearly half of the exploited vulnerabilities in 2025 targeted enterprise technologies, which is the highest share we’ve seen yet. Browser exploitation dropped significantly while operating system vulnerabilities became a more common target again, suggesting attackers are shifting strategies as defensive technologies evolve. (read more)

New AirSnitch attack bypasses Wi-Fi encryption in homes, offices, and enterprises

When headlines started circulating about a new attack called AirSnitch that “breaks Wi-Fi encryption,” my first reaction was: are we really turning the clock back on Wi-Fi security by 15 years? If you’ve listened to me for any amount of time, you know I’ve been on a bit of a soapbox about public Wi-Fi. I’m famously pro public Wi-Fi and anti-VPN panic. The whole “never use public Wi-Fi, hackers are waiting to steal your banking password” advice has been outdated for years. HTTPS is everywhere now. Wi-Fi encryption is strong enough that the classic coffee-shop hacker narrative mostly died off a long time ago. I’ve logged into extremely sensitive accounts – banking, finance systems, you name it – from hotel networks, airport Wi-Fi, airplanes. It’s fine. 

The real risk today on public Wi-Fi usually isn’t network attacks. It’s social engineering, especially through captive portals where people get tricked into entering credentials.

AirSnitch is getting headlines claiming it “breaks Wi-Fi encryption.” The reality is a bit more nuanced: The research doesn’t actually break WPA encryption, it bypasses client isolation, a feature routers use to prevent devices on the same network from talking to each other. This does reopen questions about how much we trust network isolation and whether attackers already inside a Wi-Fi network could intercept traffic in ways many routers were supposed to prevent. (read more)

Stop Burning Your Team Out*

The hardest part of modern security isn’t lack of tooling; it’s asking people to do machine-scale work at human bandwidth. Alert budgets, tiered SOCs, nonstop on-call mask the scale mismatch, creating noise, context switching, fatigue, and burnout.

Cotool moves detection, investigation, and response into flexible agents. Teams set guardrails and the system executes, so operations scale without constant human intervention.

See how Cotool scales Detection & Response beyond headcount

*Sponsored

Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit

Google's threat intel details on "Coruna," an iOS exploit kit that's been making the rounds. Everyone who analyzed it is raving about how well-engineered it is. This thing packs 23 different exploits targeting iOS versions 13 through 17.2.1, complete with fancy JavaScript obfuscation and custom binary loaders. What's fascinating is how it traveled - started with some surveillance vendor's customers, then got picked up by Russian espionage groups hitting Ukrainian sites, and finally ended up with Chinese scammers running crypto theft operations on fake finance websites.

While the original version was probably built for surveillance, the final payload is all about stealing cryptocurrency wallets. The Chinese actors retrofitted it with modules targeting MetaMask, Trust Wallet, and a bunch of other crypto apps. (read more and more)

PerplexedBrowser: Perplexity’s Agent Browser Can Leak Your PC's Local Files

Perplexity’s agentic browser, Comet, just gave us a clean example of why “AI browser agents” and “the open internet” are a dangerous combo. Zenity Labs demonstrated a zero-click attack chain where a benign calendar invite becomes the delivery mechanism for indirect prompt injection. The moment the user asks Comet to accept the meeting (and help prep), Comet can be manipulated into browsing local directories, opening sensitive local files, reading them, and then exfiltrating the contents to an attacker-controlled site using normal browser navigation. 

This is the predictable outcome of treating everything an agent sees as actionable input, especially in workflows people already trust, like calendar content. Zenity disclosed the issue in October 2025, Perplexity classified it as critical, and the reported fix is a hard boundary blocking agent access to file:// paths (confirmed effective Feb. 13, 2026). The specific demo path is closed, but the broader class of attacks isn’t. (read more)

Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel

Now we don’t even need to use those AI company browsers, Google is shoving Gemini into Chrome everywhere. And wouldn’t ya know it! Full of vulns. This vulnerability (CVE-2026-0628) let malicious extensions with basic permissions hijack the Gemini panel and do all sorts of fun stuff - access your camera and mic without asking, grab local files, take screenshots of any HTTPS site, or run phishing attacks from what looks like a trusted browser component. The key issue was that Chrome treated requests to the Gemini app differently when loaded in the special AI panel versus a regular tab, but extensions could still mess with both.

Whether it’s prompt injection, or abusing malicious extensions/XSS - the AI agent power in a browser really ups the stakes of these attacks. Instead of normal AppSec issues, we’ve got these over-permissioned autonomous pieces of software that have easily bypassed guardrails and are completely nondeterministic. This is all going to get worse before it gets better. (read more)

Pixel Perfect: Sold Extension Injects Code Through Pixel

We all know about extension developers getting hacked or publishing vulnerable extensions but what about a SECRET THIRD WAY TO HACK US?? Thats what this research is all about - turns out extension devs can just list their app for sale, do no vetting on who buys it, and the buyer can inject any code they want that gets auto updated to all its users.

New research from Annex Security shows exactly how this works. A Chrome extension called Quick Lens, used by about 7,000 people and even featured by Google, was sold to a new owner who pushed an update that added command-and-control infrastructure, stripped browser security protections, and enabled a “pixel-perfect” technique that effectively gave the attacker man-in-the-browser control. (read more)

Miscellaneous mattjay

new favorite wrestling move:

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay