Author: Staff Writer

Summary Points Trellix, formed from the merger of McAfee Enterprise and FireEye, confirmed unauthorized access to part of its source code, claimed by the RansomHouse ransomware group. RansomHouse, known for targeting VMware ESXi and using sophisticated ransomware tools, publicly listed Trellix as compromised, pressuring for negotiations. The breach reportedly occurred on April 17, 2026, with no evidence yet of customer or corporate data beyond source code being affected or tampered with. The incident underscores the rising threat of ransomware groups targeting cybersecurity firms, risking widespread impacts on enterprise security. What’s the Problem? In May 2026, Trellix, a prominent cybersecurity firm…

Top Highlights QLNX malware targets developers’ Linux systems to harvest high-value credentials, enabling malicious package pushes and cloud infrastructure access. It employs advanced stealth techniques, including in-memory execution, kernel and userland rootkits, log wiping, and multiple persistence methods. The malware supports extensive command-and-control capabilities, including credential interception, system manipulation, and establishing covert communication channels. Threat, Attack Techniques, and Targets The Quasar Linux RAT (QLNX) is a new, advanced malware targeting developers’ systems. It is designed to stay hidden while collecting sensitive data. QLNX uses many techniques to avoid detection. It runs only in memory, without touching the disk. The malware…

Top Highlights Model Context Protocol (MCP) introduces significant security blind spots by enabling shadow AI, making environments more vulnerable through unmonitored integrations and dependencies. Incidents like the malicious npm package ‘postmark-mcp’ exemplify how attackers establish trust then exploit MCP vulnerabilities to exfiltrate data silently affecting hundreds of organizations. MCP’s reliance on static credentials and privileged AI agents heightens risks, including remote code execution and potential for severe damage if compromised. Implementing Continuous Threat Exposure Management (CTEM) tailored for MCP helps identify, prioritize, and validate risks, integrating AI security into proactive security programs before attackers exploit them. The Issue In 2025,…

Summary Points A criminal threat actor conducted a cybersecurity breach at Instructure, potentially exposing personal data such as names, emails, and student IDs. Multiple universities, including Harvard and Penn State, experienced severe disruptions, with some canceling exams and coursework deadlines. The incident caused widespread academic operational challenges, prompting institutions to implement alternative exam and assessment methods. Threat, Attack Techniques, and Targets On May 1, Instructure reported a cybersecurity incident caused by a criminal threat actor. The attacker accessed sensitive data from the ed-tech platform. By May 2, the company said the situation was contained, but some information may have been…

Fast Facts AI systems, especially large language models (LLMs), exhibit a significantly higher rate of high-risk vulnerabilities (32%)—nearly 2.5 times that of traditional enterprise security flaws. Prompt injection is now the top security concern for LLM applications, with a surge in related bug bounty reports over 540% year-over-year, risking data leaks, manipulation, and unintended behaviors. The remediation of AI vulnerabilities is hindered by the lack of established security playbooks and fragmented ownership across departments, resulting in a low fix rate of just 38% for high-risk issues. AI’s broader attack surfaces, combined with its implicit trust boundaries and unformed secure development…

Quick Takeaways Attackers can exploit CVE-2025-68670 by crafting oversized UTF-16 domain names, causing buffer overflow and arbitrary code execution on the xrdp server. The vulnerability allows remote initiation of code execution without valid credentials, potentially leading to server compromise or system control. Exploitation success depends on bypassing stack protections like canaries, but leak or guessing such defenses remains feasible for persistent attackers. Threat Overview and Attack Techniques CVE-2025-68670 is a remote code execution (RCE) vulnerability found in the xrdp server. The issue exists within the function xrdp_wm_parse_domain_information, which processes the domain name data sent by clients before authentication. An attacker…

IoT devices form a rapidly expanding and highly vulnerable part of enterprise attack surfaces, with hacking attempts increasing significantly and industries heavily reliant on IoT experiencing most security incidents. Securing IoT requires comprehensive asset inventories, network segmentation, firmware and credential hygiene, and continuous monitoring to prevent breaches and limit lateral movement. Effective IoT security involves integrating device telemetry into broader security operations, applying lifecycle risk management, and adopting proactive detection and response strategies. Organizations benefit from unified IoT security approaches, leveraging expert services like Arctic Wolf to enhance visibility, threat detection, and resilience across their entire device ecosystem. The Importance…

Quick Takeaways Traditional firewalls no longer provide full visibility into encrypted session activities, creating significant security gaps in modern enterprise environments. Security Service Edge (SSE) needs to be integrated onto existing firewall infrastructure through a firewall-native, agentless layer that extends session awareness without replacing hardware. Firewall-native SSE enables detailed inspection of SaaS, AI, and web traffic—empowering organizations to enforce policies on sensitive data inside sessions, especially crucial for GenAI security. This approach offers rapid deployment, minimizes disruption, and aligns with the industry’s shift toward extending existing security architectures rather than overhauling them. The Firewall’s Limitations in a Cloud-First World Decades…

Fast Facts Operational readiness—ensuring responders can act immediately—is more critical than having an incident response retainer. Core system access, especially identity, cloud, endpoint, and logs, must be pre-provisioned, tested, and ready to activate instantly during an incident. Establish secure, out-of-band communication channels, designate an incident manager, and define stakeholder notifications in advance to prevent breakdowns. Regularly test and validate response workflows, access procedures, and asset inventories to identify and close gaps before an actual breach occurs. Understanding the Gap Between Having a Plan and Being Prepared Many organizations believe that possessing an incident response plan and a retainer means they…

Top Highlights Attackers increasingly use stolen credentials and access tokens to infiltrate systems, making breaches harder to detect and more costly. Extended, unnoticed activity from compromised accounts can lead to severe damage including data theft, financial loss, and reputational harm. Effective detection must focus on understanding and responding to suspicious account activity directly within identity systems, especially in cloud and remote work environments. Threat Overview, Techniques, and Targets Hackers are increasingly using stolen passwords, usernames, and access tokens to infiltrate company systems. Unlike traditional malware attacks, these cybercriminals log in with legitimate credentials. This makes their activity harder to detect,…