Author: Staff Writer

Top Highlights CISA has urgently warned that a critical SQL injection vulnerability in Fortinet’s FortiClient EMS (CVE-2026-21643) is actively exploited, enabling attackers to execute remote code without authentication. The flaw allows threat actors to manipulate databases, access sensitive data, or deploy malware, with no user credentials required, posing a severe risk to organizations’ networks. Fortinet has issued patches, and organizations are urged to apply them immediately; if patching isn’t possible, systems should be taken offline to prevent exploitation. Federal agencies must address this vulnerability by April 16, 2026, and organizations should monitor for suspicious activity and implement security best practices…

Fast Facts Cybercriminals are shifting from traditional phishing to vishing (phone-based social engineering) to exploit organizations, especially targeting identity providers like Okta for easier access. Once Okta is compromised via vishing, attackers gain broad, trusted access to connected applications and data across cloud platforms, leading to extensive data theft and potential breaches. These attacks leverage detailed reconnaissance and pretexts like account lockouts or device changes, prompting help desks to bypass verification steps under pressure, facilitating quick breaches. Organizations are advised to enforce strict verification, adopt phishing-resistant MFA methods (e.g., security keys), and enhance monitoring and incident response protocols to mitigate…

Quick Takeaways APT41 has developed a sophisticated Linux-based backdoor targeting cloud servers across AWS, Google Cloud, Azure, and Alibaba Cloud, focusing on stealthy credential theft and long-term access. The malware exploits cloud metadata services and secret files, encrypts stolen data with AES-256, and exfiltrates via a covert SMTP C2 channel that mimics email traffic for undetectability. It employs unique command-and-control strategies, including SMTP-based communication with token authentication and peer-to-peer UDP broadcasts, enabling resilient lateral movement within infected cloud environments. Security experts advise tightening outbound SMTP controls, monitoring UDP traffic, auditing cloud access logs, and inspecting temporary ELF binaries to detect…

Fast Facts AI has shifted from experimentation to critical, measurable deployment in cybersecurity, emphasizing responsible and strategic implementation as an operating model decision. The threat landscape has accelerated, with AI-enabled attacks occurring at machine speed, challenging manual detection and response workflows. The Cyber AI Parity Window offers a limited opportunity for defenders to gain a technological advantage by operationalizing AI effectively before the window closes. Success depends on robust architecture, contextual integration, measurable production metrics, and a focus on elevating human expertise, not just technology adoption. What’s the Problem? The story highlights how AI has transitioned from a promising tool…

Top Highlights Rockstar Games confirmed a data breach where ShinyHunters exploited a third-party platform, Anodot, to access and leak over 78.6 million records related to GTA Online and Red Dead Online, with no direct attack on Rockstar’s core infrastructure. The breach was carried out by extracting authentication tokens from Anodot’s systems, allowing attackers to impersonate internal services and silently access Rockstar’s Snowflake data warehouse without exploiting Snowflake vulnerabilities. The leak contains extensive analytics data, including revenue figures and player activity metrics, but does not include sensitive personal information, passwords, or game development assets, and Rockstar states it has minimal impact…

Summary Points 34% of API test failures relate to security issues, with authentication and authorization flaws making up 38%, highlighting widespread development gaps. AI-driven testing covers 2.7x more security categories than manual tests and effectively identifies complex vulnerabilities like privilege escalation and cross-user access. Newly deployed APIs are 3.1x more prone to authentication failures, indicating a neglect of security measures during initial release stages. Most vulnerabilities are basic—such as data exposure and expired credentials—easily detected by automated testing, yet many organizations overlook this, underscoring the need for AI-native testing. Security Gaps in API Failures Are Widespread Recent findings reveal that…

NIST’s 2020 IR 8259 provides foundational cybersecurity guidance for IoT device manufacturers to reduce vulnerabilities and attacks, complemented by more detailed frameworks in IR 8259A and IR 8259B. The series has expanded into sector-specific guidance including federal applications, consumer products, routers, and product development, emphasizing the integration of cybersecurity into entire IoT ecosystems. NIST plans to revise IR 8259 to incorporate emerging concepts such as IoT product-wide considerations, threat modeling, AI, immersive tech, and balancing security with device support. The agency seeks public input through a December 4, 2024 workshop to refine guidance, emphasizing community collaboration to address evolving IoT…

Essential Insights AI-powered hacking tools like Claude Mythos are rapidly enhancing attack capabilities, enabling even less skilled hackers to solve complex cybersecurity challenges, thus increasing cybersecurity threats. The cost of exploiting vulnerabilities is dropping, with AI reducing the time from discovery to weaponization, creating an asymmetric advantage for resource-rich attackers. Current testing shows Mythos can autonomously execute multi-stage cyberattacks and solve most expert-level challenges, though real-world effectiveness may vary due to the lack of defensive measures in test environments. Both US and UK reports warn organizations to urgently adopt AI for defense and revise incident response strategies, as AI-driven threats…

Essential Insights Anthropic’s Claude Mythos can discover and exploit complex vulnerabilities rapidly, with capabilities akin to a turbocharged penetration testing tool, raising concerns about misuse by attackers. The CSA warns of an impending “AI vulnerability storm,” urging organizations to adopt proactive, Mythos-ready security strategies, including increased automation and resource allocation. Experts emphasize that AI accelerates vulnerability discovery and exploitation, necessitating fundamental security upgrades like segmentation, dependency management, and AI-integrated defenses to stay ahead. Industry leaders advocate for aggressive preparation, including increased staffing, automation, and adopting AI tools for security, to prevent being overwhelmed by the rapid surge of AI-discovered vulnerabilities.…

Top Highlights OpenAI updated its security certificates and requires macOS users to update due to a supply-chain attack that infected the Axios library via a North Korean hacking group, impacting over 100 million downloads weekly. The attack involved malware injection into Axios, but OpenAI states no user data or systems were compromised, and its own software remained unaffected. The breach was linked to a misconfiguration in OpenAI’s GitHub workflow, which has now been corrected, and the affected certificate has been revoked to prevent fraudulent app usage. Older versions of OpenAI’s macOS apps may lose functionality starting May 8, but the…