Security & Supply Chain — Latest Signals

The most consequential security story today is not a CVE. It is that targeted advertising has been used as a delivery channel for zero-click exploits and mercenary spyware, reported independently by several outlets in the same news cycle.

If that holds up, it reframes ad tech from a privacy nuisance into an active attack surface carrying nation-state-grade payloads — and every ad-funded product inherits a threat model it never signed up for.

Two quieter items deserve equal weight. A study found that LLM-native IDEs leak secrets, which is unsurprising in hindsight: we handed context-hungry assistants broad repository access long before anyone defined what they should be allowed to read. Separately, a project moved between organisations left its old API keys still valid — a reminder that credential lifecycle, not cryptographic strength, is where most breaches actually live.

Meanwhile commercial terms that permit news scraping round out the week. The policy layer is degrading at the same moment the technical layer hardens.