The HackWednesday archive
Security analysis, incident lessons, and practical guides for teams working with AI. Search the archive or choose a topic.
AI in Security
NIST's May 18, 2026 summary of AI agent security feedback makes one point hard to ignore: enterprises will not scale agents safely without stronger identity, authorization, and audit controls.
AI-assisted Awaiting editor review
AI in Security
Microsoft's May 14, 2026 research on exploitable AI app misconfigurations shows that many near-term AI security failures will come from exposed services, weak authentication, and overpowered control planes rather than novel model exploits.
AI-assisted Awaiting editor review
Cloud
wolfSSL support for Secure Socket Funneling shows why defenders need to track the cryptographic libraries beneath tunneling tools. Recent wolfSSL findings are a reminder that a tunnel is only as trustworthy as its certificate validation, build options, and patch path.
AI-assisted Awaiting editor review
AI in Security
NIST's May 18, 2026 analysis suggests security teams already understand AI agent risk; what they still lack is concrete guidance for identity, authorization, monitoring, and measurable controls.
AI-assisted Awaiting editor review
Incident Response
MiniPlasma is a newly published Windows privilege-escalation proof of concept that reportedly revives the old CVE-2020-17103 path and turns a standard user foothold into SYSTEM access. The bigger lesson is about patch confidence, regression risk, and why defenders need validation beyond release notes.
AI-assisted Awaiting editor review
AI in Security
AWS used mid-May 2026 guidance to make a useful point for defenders: secure AI programs start with identity, access, and guardrails in the prototype phase rather than after agents reach production.
AI-assisted Awaiting editor review
AI in Security
Microsoft's May 12, 2026 MDASH release matters because it ties agentic AI directly to 16 Patch Tuesday vulnerabilities, shifting the conversation from demos to measurable defensive outcomes.
AI-assisted Awaiting editor review
AI in Security
OpenAI's new Daybreak initiative reframes cyber defense around resilient-by-design software, Codex-powered remediation workflows, and a tiered trusted-access model for increasingly cyber-capable AI.
AI-assisted Awaiting editor review
AI in Security
OpenAI's May 7 GPT-5.5-Cyber rollout, new phishing-resistant access requirements, and parallel NIST testing agreements all point to the same shift: advanced AI security capability is being governed more like privileged infrastructure.
AI-assisted Awaiting editor review
AI in Security
Fresh NIST and Microsoft updates point to the same operational reality: security teams need ways to evaluate, inventory, and govern AI agents before trust in them can scale.
AI-assisted Awaiting editor review
AI in Security
LiteLLM is now dealing with a different kind of security problem than the March supply-chain incident: active exploitation of a critical pre-auth SQL injection that puts upstream model-provider credentials and environment secrets at risk.
AI in Security
OpenAI's April 29 cyber action plan argues that AI-powered defense should be distributed broadly, and recent Microsoft and Google moves suggest the industry is starting to build the operational infrastructure to do it.
AI-assisted Awaiting editor review
