Author: Staff Writer

Summary Points CISA and NSA Guidance: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and NSA, with partners from Australia and Canada, have issued guidance to fortify on-premise Microsoft Exchange Servers against exploitation. Best Practices for Security: Key recommendations include enabling multi-factor authentication, restricting administrative access, disabling remote PowerShell, and ensuring applications like antivirus and anti-malware are active. Exploitation of CVE-2025-59287: A newly patched vulnerability in Windows Server Update Services (WSUS) is under active attack, allowing threat actors to harvest sensitive data from various sectors. Heightened Vigilance Recommended: Organizations are urged to apply security updates, monitor for suspicious activity, and…

Fast Facts Overlooking Non-Human Identities (NHIs) in cloud infrastructure creates significant security vulnerabilities, including unauthorized access, data breaches, and operational disruptions. Effective NHI lifecycle management—discovery, classification, automation, and continuous monitoring—is essential for reducing risks, ensuring compliance, and lowering operational costs. Security misconfigurations, such as excessive permissions or poor secrets management, can cascade into broader vulnerabilities, emphasizing the need for regular audits and least privilege principles. Continuous improvement through automation, staff training, and proactive security practices is critical to adapting to evolving cyber threats and safeguarding organizational assets. Key Challenge The story reveals the critical importance of managing Non-Human Identities (NHIs),…

Essential Insights Rise of Surveillance: The Pegasus spyware, discovered nearly a decade ago, has catalyzed global concerns about commercial spyware and the surge of digital authoritarianism, particularly affecting dissidents and civil society. Mixed Progress: While the awareness and advocacy surrounding spyware have increased, regulatory measures and the demand from governments for surveillance technologies have intensified, leading to a paradoxical situation of both advancement and regression in digital rights. Accountability Gaps: The lack of comprehensive data privacy regulations and the prioritization of profit over user protection by tech companies continues to magnify risks, making robust governance and corporate responsibility essential in…

Top Highlights CISA added a high-severity vulnerability (CVE-2025-41244) affecting Broadcom VMware Tools and VMware Aria Operations to its KEV list due to active exploitation, allowing attackers to escalate privileges to root on vulnerable systems. The flaw, exploited since mid-October 2024 by a China-linked threat actor (UNC5174), was patched by VMware last month but was exploited as a zero-day prior to the fix. The vulnerability enables local actors with non-administrative privileges to escalate to root, with exploitation being described as trivial to carry out. Additionally, a critical remote code execution flaw in XWiki allows arbitrary code execution by guest users, with…

Fast Facts Managing Non-Human Identities (NHIs), or machine identities, is critical for cloud security, involving lifecycle processes like discovery, classification, threat detection, and policy enforcement to prevent breaches and ensure compliance. Automating NHI management—such as creation, rotation, and decommissioning—reduces human error, enhances security, and improves operational efficiency. A comprehensive NHI strategy requires continuous monitoring, strict access controls, governance, and regular audits to tackle challenges like credential proliferation and dynamic cloud environments. Future NHI management will increasingly rely on AI and machine learning for predictive security, enhancing proactive threat mitigation and strengthening the overall cloud security posture. The Issue The article…

Essential Insights Conduent’s 2024 data breach exposed sensitive information of over 10.5 million individuals, primarily affecting the Oregon population, with potentially larger impacts across other states. The breach involved theft of personal data including Social Security Numbers, full DOB, health insurance details, and medical information, though no misuse has been confirmed as of October 2025. The attack was linked to a cybersecurity incident earlier in the year, with the Safepay ransomware gang claiming responsibility and revealing that the breach environment was compromised since October 2024. Affected individuals are advised to review credit reports and consider security measures, but no official…

Essential Insights Ribbon Communications, a key provider of telecom and cloud services, was breached by nation-state hackers as early as December 2024, with detection of unauthorized access only in September 2025. The breach involved access to customer files stored externally, but the company has yet to find evidence of material data theft or compromise of its core network. The incident is reminiscent of previous telecom breaches linked to China’s Salt Typhoon cyber-espionage group, suggesting possible attribution, though no definitive group has been identified. Ribbon is collaborating with cybersecurity experts and law enforcement, expecting additional costs but no material impact from…

Fast Facts Vulnerability Exploitation: A hacker is actively exploiting a critical vulnerability (CVE-2025-59287) in Windows Server Update Service (WSUS), with increased threat activity following the release of a proof of concept. Data Exfiltration: The attacker, identified as UNC6512, has successfully gained access to multiple systems, conducting reconnaissance and exfiltrating sensitive data. Ineffective Patch: Microsoft’s patch for the vulnerability, issued earlier, was ineffective; researchers have noted at least two different adversaries targeting the flaw. Urgent Response Needed: The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging immediate action from WSUS users to…

Summary Points 1. Security now prioritizes resilience—focusing on response and recovery over solely threat detection. 2. Metrics like recovery time (e.g., restoring operations within four hours post-attack) are more impactful for boards than volume of blocked threats. 3. Resilience directly supports business continuity, trust, and long-term value, aligning cybersecurity with organizational goals. 4. Regulatory pressures (DORA, NIS2) increase board-level accountability, emphasizing resilience as a critical governance focus. The Issue The story highlights a significant shift in how organizations approach cybersecurity and operational preparedness. It emphasizes that simply reporting the number of blocked threats, such as 1,200 phishing attempts, is insufficient;…

Essential Insights Corsha and Dragos have partnered to integrate machine identity verification with advanced threat detection, aiming to establish Zero Trust security in OT environments. The combined platform ensures continuous authentication of devices, enhanced visibility, and risk-based microsegmentation to prevent unauthorized machine activity. This integration strengthens OT defenses by enabling real-time enforcement of trusted communications, reducing lateral movement and supply chain vulnerabilities. The partnership aligns with industry standards like the SANS ICS Critical Controls, promoting resilient, auditable, and industry-compliant layered security for industrial systems. What’s the Problem? Corsha, a provider of machine identity solutions, has partnered with Dragos, a cybersecurity…