Fixed Upstream, Still Vulnerable Downstream: How MCP Security Fixes Propagate
285 CVEs against 149 open-source MCP projects in nine months. We measured whether the fixes reached the catalogs, registries, forks
285 CVEs against 149 open-source MCP projects in nine months. We measured whether the fixes reached the catalogs, registries, forks

The arrangements made quickly during the shift to remote working became permanent architecture. Which of those decisions would survive scrutiny

The organizational version of SIM swapping is narrower and more serious than the consumer story: a phone number is the

A large share of extortion now involves no encryption at all. Backups answer encryption; they do not answer publication —
Attackers now proxy the login rather than harvest the password. Which controls still hold when an employee does everything right

Zero trust is an architectural commitment, not a product decision. Which parts of the estate justify the effort first, and