ACTIVE THREATS: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers • AI-powered attack exploited PaperCut flaws to hack 395 organizations • Microsoft Excel KB5002914 update breaks copy and paste for some users • Surfshark VPN says hackers breached internal testing, proxy servers • PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances ACTIVE THREATS: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers • AI-powered attack exploited PaperCut flaws to hack 395 organizations • Microsoft Excel KB5002914 update breaks copy and paste for some users • Surfshark VPN says hackers breached internal testing, proxy servers • PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
Latest cybersecurity policy news, analysis, and intelligence.
Windows 11 is adding APIs letting apps verify user age without accessing birthdates. Driven by child-safety regulations, this shifts age verification from individual apps to the OS while preserving privacy.
Teams outages trigger shadow IT—employees shift to WhatsApp, Discord, and personal clouds, bypassing DLP and audits. The real risk isn't downtime; it's unmonitored data channels and compliance gaps left behind.
Google, Anthropic, and OpenAI announced AI security tools within a week—Google integrating Gemini into threat intelligence, Anthropic positioning Claude for compliance, OpenAI launching a cybersecurity grant program. The timing reflects competition for enterprise market legitimacy rather than planne
Anthropic's Compliance API logs Claude Code's file access and commands for security audits, helping regulated industries track AI agent activity. While useful for compliance, the logging doesn't solve the core problem: AI agents with unrestricted access to production credentials, SSH keys, and sensi
FBI disrupted QScan and QTRouter, Chinese tools used to map U.S. infrastructure networks. The platforms reveal Beijing's outsourcing model—hiring private contractors for state cyberattacks.
A networking flaw in OpenClaw allows attackers to inject malicious content into active LLM sessions through unauthenticated endpoints. This runtime poisoning can override system prompts and exfiltrate sensitive data—a new attack category distinct from traditional prompt injection or training-data co
Microsoft Teams introduces a new policy letting admins automatically block external bots from meetings. The update addresses a security gap where AI note-takers like Otter.ai were recording confidential calls without organizational oversight.
TikTok faces a $400M fine for violating child privacy rules despite a $5.7M 2019 settlement. The article argues small fines fail as deterrence, becoming just business expenses for tech giants rather than meaningful punishment.
Microsoft's "Classic" theme masks New Outlook's fundamental architectural change: it's a web-app wrapper that proxies third-party email through Microsoft's cloud servers, unlike the native Classic Outlook. Enterprises resisting this two-year migration cite data-residency and compliance concerns that
Modern surveillance isn't a centralized conspiracy but fragmented: companies, employers, criminals, and governments independently surveil for their own interests without needing coordination. This decentralization makes the surveillance ecosystem uniquely difficult to fight.
SilkParasite targets Central Asian organizations with spear-phishing RAT campaigns. The Chinese threat group seeks persistent access to Belt and Road infrastructure and government networks.
LexisNexis shut down three compliance services after detecting unusual activity on a vendor's servers, with no data theft confirmed yet. The offline platforms (Diligence, Metabase API, Newsdesk) have disrupted M&A checks and compliance workflows, marking the third security incident in 14 months.
Compliance is backward-looking security theater. Real security requires governance—assessing novel threats independently of standards. Most organizations mistake certifications for actual resilience.
AI browser agents can be hijacked via hidden prompts embedded in webpages. Designers built them to follow natural language instructions, making them vulnerable to remote code execution attacks that need no user interaction.
An $88.6M COLDCARD Bitcoin theft sparked a phishing follow-up: fake compliance audit emails staffed by live operators. The scam weaponized users' legitimate security concerns to steal remote access.
Chinese hackers deploy OctLurk and SilkLurk against Central Asian governments in Belt and Road corridors. The two-stage approach limits exposure by separating the initial breach from high-value intelligence collection.
CISA updated SBOM guidance to standardize field definitions across vendors. Critics argue the incremental changes improve consistency but fail to solve underlying risk-management problems.
USA Fencing automates identity verification via AI for competition integrity. But the move raises concerns about sports organizations' experience securing sensitive government-issued documents.
Compliance frameworks like SOC 2 create false security—certified organizations still suffer major breaches. These certifications have become liability shields and security theater, consuming budgets for audits and documentation instead of actual defense work.
30+ Minnesota water systems hit in coordinated OT attack July 26–27; one plant went offline, others switched to manual control. CISA/EPA/FBI investigating but attacker identity unknown.
CISA guidance emphasizes pre-positioning isolation capabilities for OT systems with documented procedures and trigger thresholds before cyberattacks occur, avoiding mid-incident improvisation. Most critical infrastructure lacks tested isolation procedures for real-time operational conditions.
CISA released CI Fortify guidance for critical infrastructure to operate during network isolation from cyber attacks. It emphasizes extended autonomous operation of industrial control systems.
Attackers now use real-time credential proxying to hijack insurance accounts while victims think they're on phishing pages. Insurance accounts are lucrative targets because they contain vehicle details, medical history, and payment info—enabling policy fraud and identity theft.
JadeProx, a China-nexus group, targets Asian hospitals and government ministries with TriBack Loader—a stealthy Windows malware using advanced EDR evasion and DLL sideloading to deliver post-exploitation tools via phishing.
StrongestLayer raised $4.1M to disrupt security awareness training, which traditional phishing-simulation models have failed to improve despite decades of use. The startup faces entrenched competitors but enters a market where buyers increasingly recognize that checkbox-compliance training doesn't r
A Trump EO extends supply chain audits to cloud providers serving defense contractors. It mandates "indentured Bill of Materials"—tracking not just software components but also supplier origins, locations, and foreign government ties.
Pentagon pauses CMMC Phase 2 audits citing auditor shortage and costs. Contractors still must self-attest compliance and meet DFARS requirements without third-party verification, creating legal and operational risk.
Nigeria mandates cyberattack disclosure to address surging cybercriminal activity targeting businesses and critical infrastructure. The regulation joins global standards like those in the US and EU for improved threat transparency.
Illinois, New York, and California enact frontier AI disclosure laws effective January 2027. Developers must submit transparency reports before deploying models—the first major state-level AI regulation affecting the advanced AI sector.
Russian FSB actors exploit poorly configured routers with default SNMP credentials to infiltrate critical infrastructure. The systematic campaign targets energy, finance, and government networks worldwide, prompting joint warnings from NSA, CISA, and 11 allied nations.