Why software delivery cannot depend on trust alone
Attackers turned the trusted AsyncAPI CI/CD publishing pipeline against its users, and the provenance checks all came back clean. more
Dateline Woonsocket
Latest writing from John P. Mello Jr.
Live Last read · last published · next check
Latest posts
Super Cool: IBM Links Quantum Fridges in Push to Scale Qubits
IBM on Wednesday announced that it has successfully joined and cooled two cryogenic quantum "fridges," demonstrating a modular architecture designed to eventually link hundreds of quantum chips into more powerful quantum computers. more
Retail Apps Face a Customer Retention Problem
Retail apps often have a short lifespan after customers download them, according to recent Adobe research. more
AI domain takeover takeaway: Focus on the harness not the model
Mention offensive AI and expect the discussion to focus on vulnerability discovery, malware creation, and exploit generation, but recent research by Cato Networks identified another — and very potent — application for offensive AI. more
OWASP Top 10 for LLM Apps 2026: Excessive agency risk on the rise
Prompt injection is still king, but “excessive agency” just jumped to #3 in OWASP’s Top 10 for LLM apps. Stop chasing unbreakable models—start containing fooled agents. more
AI Rules to Protect Kids Risk Repeating Social Media Mistakes
Policymakers risk repeating mistakes they made trying to govern social media in their rush to protect kids from potential harms posed by AI chatbots, according to a new report by a Washington, D.C. think tank. more
Zuckerberg Makes His Case for Superintelligence for All
In a sweeping 6,500-word online manifesto published Monday, Meta founder and CEO Mark Zuckerberg called for superintelligence to be widely available, arguing that putting advanced AI in the hands of individuals offers a better path than concentrating it among governments, companies, or a small group of experts. more
Why AI coding makes zero trust an AppSec requirement
Feeling comfortable about the safety of your software supply chain because your organization has invested in SBOMs, signing, and provenance? You shouldn’t. more
Billions of Stolen Browser Cookies Fuel Account Hijacking Risks
Online information thieves are stealing browser cookies on a massive scale, exposing users to risks ranging from identity theft to account hijacking, according to a report released Monday by a VPN service provider. more
FBI, EPA Warn of Cyberattacks Targeting Water Infrastructure
Following cyberattacks targeting more than 30 municipal water systems across Minnesota, the FBI and EPA have issued a warning to critical infrastructure asset owners and operators that malicious actors are targeting operational technology devices used in water and wastewater facilities. more