Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.

I've put up a blog on the DigiCert incident as well as the Microsoft definition false positive. This includes some analysis and VT links to samples that have actually been signed by the compromised certificates. airlockdigital.com/airlock-b…

Ambassador Gingrich is pleased to lead the delegation from Switzerland and Liechtenstein to the SelectUSA Investment Summit, May 3-6, in National Harbor, Maryland. Apply now: ow.ly/s4E950YOvTo

Happy Saturday! Exposed attack surface on the internet has been shifting from legacy appliances and Windows boxes directly on the internet into cloud for years now (Thanks Citrix, Fortinet, MoveIt, etc). The excitement around LLMs findin vulnerabilities and the incoming apocalypse is legitimate, however directly exposed attack surface has been decreasing(Thanks App proxy, zscaler, etc) and now you have more eyes on what was already a shrinking target. Bugs found on the cloud side have a shorter life and once identified, generally patched for everyone at once. Down the line from that you can certainly use LLMs to go after endpoint bugs in Microsoft where you generally lack source and it requires a higher level of human directed iteration, on top of dealing with EDR/AV if your target is enterprise. No doubt people can iterate faster and find more bugs, I've found a ton of these personally, but many bugs have limited to no real world impact. Configurations you won't see in the wild, code paths you can't reach without auth you don't have, features that are off by default. Overlooked in all of this is the ease at which you can reverse and dismantle security products, many of which are forced into design choices by the OS, or into exclusions to avoid drowning clients in false positives. Things like extracting the local ML models from products isn't a big leap these days. It certainly makes the case for application control being a bigger priority going forward, even if it doesn't make for a great funding pitch.