Author: Staff Writer

Quick Takeaways Enterprises are deploying AI agents with human-like privileges but lack proper management and visibility, creating security gaps. Cisco’s acquisitions of Astrix and WideField Security aim to turn identity into the primary control plane, integrating NHI management with existing security tools. Managing non-human identities (NHIs), including API keys and OAuth tokens, is critical for securing AI-driven enterprise environments. Industry experts see these moves as essential to closing gaps in identity security, supporting scalable, secure AI automation within a comprehensive security ecosystem. Cisco Focuses on Identity as the Hub for AI Security As AI agents are increasingly used by companies,…

Summary Points The Commonhaus Foundation’s OSSI aims to improve open-source software sustainability by managing end-of-life (EOL) projects and enhancing lifecycle transparency. Enterprises face escalating challenges tracking and patching vulnerabilities, with the rise in open-source components and regulatory demands complicating EOL management. AI is being used to identify vulnerabilities and assist in modernization, but it struggles with complex dependency management at the framework level and downstream libraries. Addressing EOL issues is crucial for security, compliance (e.g., PCI DSS, DORA), and reducing cyber risks, as industry standards tighten and tolerance for unpatched flaws diminishes. New Initiative Supports Software After Its End-of-Life Recently,…

Top Highlights Hackers gained access to active user login details and passwords, including those of IT professionals, risking critical network compromise. State actors are continuously compromising regional countries’ cyber defenses, indicating a widespread, persistent threat. The escalating threat environment complicates resource prioritization, endangering the security and management of critical infrastructure. Threat, Attack Techniques, and Targets The threat involves hackers gaining access to sensitive networks using stolen login details and passwords. These hackers, including those who target control systems, manage to access active users, such as IT professionals. They use techniques like password theft to break into networks. Australia’s cyber environment…

Quick Takeaways AI accelerates cyberattacks from months to hours, enabling rapid exploitation of vulnerabilities. Deepfakes and AI chatbots present risks of impersonation, data leakage, and bypassing security controls. AI agents can cause data leaks and unauthorized transactions, risking compliance violations and security breaches. Threats, Attack Techniques, and Targets Artificial intelligence (AI) is increasing cyber threats. Attackers use AI to speed up their actions. For example, threats that took months now happen within hours. The latest AI models can find and exploit security flaws quickly. Companies and governments are especially at risk. Critical digital infrastructure used by banks and authorities faces…

Top Highlights The Linux kernel vulnerability CVE-2026-46331 allows unprivileged users with open user namespaces to execute remote root exploits by corrupting shared page-cache memory during packet header modifications. Attackers can poison in-memory copies of setuid binaries like /bin/su without touching disk, enabling persistent root access and system compromise. Mitigation requires patching affected systems, blocking the act_pedit module, or disabling unprivileged user namespaces, as unpatched systems are vulnerable to immediate privilege escalation. Threat, Attack Techniques, and Targets This cybersecurity threat involves a new Linux kernel flaw called “pedit COW” (CVE-2026-46331). The flaw exists in the traffic-control subsystem of the Linux kernel.…

Summary Points Japan’s Ground Self-Defense Force unknowingly used counterfeit, malware-infected USB drives during relief efforts, exposing classified military networks for nearly a year without detection. The malware, linked to China-backed hacking groups, was designed to evade standard security scans, leading to over 50 computers, including those handling sensitive info, becoming compromised. The military concealed the incident, failing to disclose the breach despite its severity and the wider distribution of similar infected drives across Japan’s factories and research institutions. Experts advise strictly sourcing trusted storage devices, scanning all removable media in isolated systems, and enforcing rigorous procurement protocols to prevent future…

Top Highlights The application of zero trust in OT environments is challenging due to industry-specific priorities, equipment age, and regulatory pressures, requiring tailored approaches aligned with existing standards like NIST, CISA, TSA, and NERC CIP. Effective OT zero trust deployment involves focusing on identity verification, managing IT/OT convergence points (e.g., remote access, jump hosts), and aligning security measures with regulatory compliance, rather than solely adopting IT-centric architectures. A practical 90-day plan includes: mapping assets and identities (days 1–30), restricting and monitoring vendor remote access (days 31–60), and establishing a maturity scorecard with metrics for ongoing visibility and improvement (days 61–90).…

Summary Points AI advancements like Mythos do not create new risks but accelerate existing cybersecurity efforts, emphasizing the need to strengthen fundamental security measures. Most breaches still exploit known vulnerabilities—such as unpatched systems or misconfigured controls—highlighting the importance of consistent basic security practices. AI can enhance defenses by improving asset visibility, streamlining vulnerability prioritization, and identifying configuration risks, thus supporting existing security protocols rather than replacing practitioners. The key to leveraging AI like Mythos lies in shifting leadership conversations from fear to resilience—focusing on strengthening fundamental controls and aligning efforts to reduce security debt and operational gaps. Key Challenge The…

Essential Insights Attackers use sophisticated multi-hop email routes via Calendly and Google redirects to bypass email authentication checks and deliver malicious ZIP files. The payload executes PowerShell to decode URLs, download a Node.js environment, and deploy a custom backdoor (TonRAT) that communicates via the TON blockchain, evading static detection. Compromised hotel systems are at risk of persistent access through multiple entry points, with potential for prolonged, stealthy data theft, though the exact final payload remains unknown. Threat Overview, Attack Techniques, and Targets Microsoft has identified an active phishing campaign targeting hotels and hospitality organizations in Europe and Asia since April…

Essential Insights CISA added a critical SSRF vulnerability (CVE-2026-20230) in Cisco Unified Communications Manager to its KEV catalog, urging immediate patching due to active exploitation. The flaw allows unauthenticated attackers to perform server-side request forgery, write arbitrary files, and escalate privileges to root access without needing credentials. Exploitation could enable attackers to bypass network controls, manipulate internal systems, and establish persistent, high-privilege access, increasing breach risks. Organizations must apply vendor patches, conduct forensic analysis, audit logs, and consider discontinuing affected products if fixes aren’t implemented within the deadline. The Issue CISA has identified a critical server-side request forgery (SSRF) vulnerability…