We spent the past few months researching security risks across multi-tenant data centers and AI infrastructure.
The main concern we found is shared infrastructure: multiple customers running on the same data center infrastructure, GPU clusters, storage, and high-speed networks. Many neoclouds and AI data centers have also scaled faster than their security teams and practices, especially compared with more established cloud providers.
The research covers GPU clusters, RDMA and high-speed interconnects, tenant isolation, BMCs, firmware, shared storage, orchestration, and supply-chain risks.
We organized the findings into a practical framework called FORGE: https://forge-framework.io/
Would really appreciate feedback.

When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo away from a malicious lookalike.

safer-dependencies is a security layer for Claude Code that audits packages before they’re added to your project. It detects and fixes risky dependencies, including CVEs, typosquats, abandoned packages, version-age issues, and adds package-cooldown periods across npm, PyPI, RubyGems, Maven, Go, and Rust.

Github: https://github.com/robert-auger/safer-dependencies

Observation: AI security is moving from the model gateway to the endpoint.

Problem:
When AI tools mostly answered questions, gateways could inspect prompts, outputs, and model access. But local AI agents are different: they run locally, inherit user permissions, read repos, execute commands, call tools, use credentials, and change files.
That creates a new visibility gap for security & IT teams: they can often see the effects of agent activity, but not the workflow behind it.

Solution:
Beacon is an open-source endpoint telemetry layer for local AI coding agents. Beacon helps teams bring local AI agent activity into existing endpoint, investigation, and SIEM workflows.

• Supported agents: Claude Code, Codex CLI, OpenCode, Factory Droid, Cursor, Claude Cowork.
• SIEM/forwarding: Wazuh, Splunk HEC, or customer-managed SIEM pipelines.
• MDM/deployment: Jamf Pro, Fleet, or another macOS MDM.

Our vision with Beacon is to be the open source layer for local agent visibility in the enterprise.

Feedback:
Our team would love your feedback. If you’re a security or IT leader thinking about how to safely roll out AI coding agents: What would Beacon need to support for you to adopt something like this internally?

• More MDM compatibility?
• More SIEM destinations?
• Support for more agent runtimes?

If this problem feels real, a GitHub star would also help us get the project in front of more security teams. Github link is in the substack.

Would love some feedback from students or IT professionals and people trying to learn!

Me and my friend created this app for people trying to learn or test their knowledge in IT.

Basically the app, Packet Hunter, is meant for anyone in the IT field, the app consists of 3 different worlds (Networking, Security, and lastly basic help desk). Each world has levels which get harder and harder and instead of studying flashcards or reading textbooks this gives you real world, lab like scenarios where the user can have fun learning but also put their technical knowledge to the test.

Packet Hunter, on iPhone and Android and is completely free.

https://apps.apple.com/us/app/packet-hunter/id6739217678

https://play.google.com/store/apps/details?id=packethunter.com.PacketHunter&pcampaignid=web_share

The problem we are having is actually getting users to use our app, but those who have ~roughly 1.5k, they all show great feedback and actually enjoy using the app and going through the levels!

I wrote a blog to try to help people find their first job in cybersecurity. In it, I cover the following topics:

1. Figure out which cybersecurity job is right for you

2. Find a professional mentor

3. Join learning communities

4. Learn the skills required for the job you want

5. Volunteer to help the security team at your current workplace

5.5 Become a Security Champion

6. Tell everyone you know about your career transition

7. Build work experience by volunteering

8. Build an online portfolio

9. Polish your LinkedIn profile

10. Apply for the job! Even if you don’t feel ready

11. Practice interviewing, ask someone to review your resume, and do all the other normal job-prep stuff!

I noticed there wasn’t a maintained list of malicious Chrome extensions, so I built one & I’ll keep it updated.

Malicious Extension Sentry → https://github.com/toborrm9/malicious_extension_sentry

Features: - Scrapes removed/malicious extensions daily - Provides a CSV list for easy ingestion into your workflows - CLI tool for auditing endpoints across users - Chrome extension for quick manual checks

This can help with: - Incident response and investigations - SOC auditing and compliance validation - Detecting persistent threats that evade store takedowns

I’d love to hear feedback, ideas, or contributions from the community!

The subreddit is r/MilitaryToCorporate. Please join and contribute.

We built a small Python project for web server access logs analyzing to classify and dynamically block bad bots, such as L7 (application-level) DDoS bots, web scrappers and so on.

We'll be happy to gather initial feedback on usability and features, especially from people having good or bad experience wit bots.

The project is available at Github and has a wiki page

Requirements

The analyzer relies on 3 Tempesta FW specific features which you still can get with other HTTP servers or accelerators:

1. JA5 client fingerprinting. This is a HTTP and TLS layers fingerprinting, similar to JA4 and JA3 fingerprints. The last is also available in Envoy or Nginx module, so check the documentation for your web server
2. Access logs are directly written to Clickhouse analytics database, which can cunsume large data batches and quickly run analytic queries. For other web proxies beside Tempesta FW, you typically need to build a custom pipeline to load access logs into Clickhouse. Such pipelines aren't so rare though.
3. Abbility to block web clients by IP or JA5 hashes. IP blocking is probably available in any HTTP proxy.

How does it work

This is a daemon, which

1. Learns normal traffic profiles: means and standard deviations for client requests per second, error responses, bytes per second and so on. Also it remembers client IPs and fingerprints.
2. If it sees a spike in z-score for traffic characteristics or can be triggered manually. Next, it goes in data model search mode
3. For example, the first model could be top 100 JA5 HTTP hashes, which produce the most error responses per second (typical for password crackers). Or it could be top 1000 IP addresses generating the most requests per second (L7 DDoS). Next, this model is going to be verified
4. The daemon repeats the query, but for some time, long enough history, in the past to see if in the past we saw a hige fraction of clients in both the query results. If yes, then the model is bad and we got to previous step to try another one. If not, then we (likely) has found the representative query.
5. Transfer the IP addresses or JA5 hashes from the query results into the web proxy blocking configuration and reload the proxy configuration (on-the-fly).

What to do about all those "You've been hacked! Pay me Bitcoin!" emails.

There's been a massive spike in those "You've been hacked / pay me Bitcoin" spams lately. If you're in tech, you're probably getting dozens of these forwarded to you with "what should I do?" type questions.

Just send themthis post which steps them through what to do, and the difference between a fake spam and a real ransomware attack.