Software, security, and cloud news — summarized in plain language, with sources.
CISA's 'A Tale of Two SOCs' advisory compared simultaneous red team assessments of a government services organization and a water utility, finding one detected nothing while the other isolated the intrusion within 20 minutes.
The Justice Department and FBI seized domains behind QScan and QTRouter, two hacking platforms run by China-linked group QTFY that were used against NASA, the Federal Reserve, the DOJ, and the U.S. Senate.
AWS Lambda MicroVMs now supports AWS PrivateLink, letting financial services, healthcare, and government workloads connect to isolated Firecracker-based sandboxes without routing traffic over the public internet.
GitHub and Microsoft's Security AI team reduced false positives in secret-scanning alerts by more than 75% by treating LLM evaluation as ongoing integration testing rather than a one-time benchmark.
The U.S. Treasury sanctioned individuals linked to Iran's Mabna Institute as part of 'Operation Economic Outcast,' following breaches of U.S. energy, defense, healthcare, and financial-sector networks since late 2023.
Next.js shipped fixes for a critical AVIF image-processing flaw and a Windows-specific remote code execution bug; Vercel says hosted apps were automatically protected while self-hosted Windows deployments must upgrade immediately.
AWS Lambda is letting developers test upcoming Node.js 26 and Python 3.15 runtimes ahead of general availability, with functions automatically graduating to GA once each language version ships.
A phishing-as-a-service kit called Mirage2FA has targeted more than 9,400 email addresses across roughly 4,500 US and EU organizations, hijacking authenticated Microsoft 365 sessions to sidestep MFA.
Cloudflare migrated blog.cloudflare.com to EmDash, the Astro-based CMS it's building as a WordPress alternative, using the high-traffic blog as a live stress test before EmDash's 1.0 release.
Vercel expanded its Sandbox execution environment to Washington D.C., San Francisco, Cleveland, and Paris, with Pro and Enterprise teams able to configure automatic failover regions.
Cloudflare's new Bot Preference Sync automatically rewrites robots.txt to match your configured AI bot rules, as Amazon Bedrock cuts pricing on OpenAI's GPT-5.6 Sol by up to a third.
TikTok will pay the U.S. Department of Justice $400 million to resolve a COPPA lawsuit, as a new free tool called DecryptAds exposes who is actually tracking users across the web.
The HashWhales Dispatch follows cybersecurity incidents, software releases, artificial intelligence, cloud infrastructure, and the policy changes that affect modern organizations. Each brief links to its original sources and explains why the development matters, without turning a press release into a prediction. The goal is to help owners and technical leaders decide what deserves attention now, what can wait, and what should change in their systems.
For deeper implementation guidance, visit our engineering insights. If a story raises a question about your own website, network, backups, or security posture, request a free technology risk review for a practical, company-specific next step.