Tag: data
-
Overly permissive ‘guest’ settings put Salesforce customers at risk
Why Salesforce environments make tempting targets: Salesforce deployments are particularly attractive because of the sensitive data they hold and the complexity of their access models.”Salesforce instances often contain highly sensitive customer data, including credentials and secrets that can be used for lateral movement,” said Vincenzo Lozzo, CEO and cofounder of SlashID. At the same time,…
-
Critical flaw in HPE Aruba CX switches lets attackers seize admin control without credentials
Tags: access, advisory, cisa, control, credentials, data, endpoint, exploit, firewall, flaw, infrastructure, kev, remote-code-execution, software, switch, update, vulnerabilityExposure spans campus to data center switching: The vulnerabilities affect AOS-CX software across four active version branches, spanning entry-level campus switches to data center-class hardware. Versions that reached the end of support before the advisory’s publication are also expected to be vulnerable, the advisory said. Organizations running AOS-CX 10.17.0001 and below, 10.16.1020 and below, 10.13.1160…
-
A 5-step approach to taming shadow AI
Tags: ai, api, business, communications, compliance, control, data, defense, finance, framework, governance, incident response, monitoring, network, nist, risk, risk-assessment, risk-management, service, strategy, technology, toolthought work happened and how it actually does today.Here’s a five-step approach to put a robust AI-risk management framework in place: Employees often use public model APIs, browser-based prompt tools and unsanctioned or ungoverned internal chatbots to boost productivity without considering the risk of exposing sensitive data.AI usage is not difficult to identify; you just need…
-
Cyber-Attacks on UK Firms Increase at Four Times Global Rate
Check Point data shows attack volumes are growing much faster in the UK than worldwide First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cyberattacks-uk-firms-increase/
-
Your Data Lake Is Turning Into a Junk Drawer? Here’s How to Clean It Up
Data lakes start organized but can turn into dumping grounds. Learn the signs of data lake clutter and simple steps to clean it up without rebuilding. First seen on hackread.com Jump to article: hackread.com/data-lake-turning-junk-drawer-how-to-clean-it-up/
-
Trojanized Red Alert App Targets Israeli Users in SMS Scam to Steal Sensitive Data
A mobile spyware campaign abusing a trojanized version of the Red Alert rocket warning Android app to target Israeli users via SMS smishing messages that impersonate official Home Front Command alerts. The fake app keeps full rocket alert functionality so it looks and behaves like the legitimate service while silently exfiltrating sensitive data in the…
-
Five Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets
Cybersecurity researchers have discovered five malicious Rust crates that masquerade as time-related utilities to transmit .env file data to the threat actors.The Rust packages, published to crates.io, are listed below -chrono_anchordnp3timestime_calibratortime_calibratorstime-syncThe crates, per Socket, impersonate timeapi.io and were published between late February and early March First seen on thehackernews.com Jump to article: thehackernews.com/2026/03/five-malicious-rust-crates-and-ai-bot.html
-
MCP Authentication and Authorization Patterns
6 min readIn MCP, every request comes from a nonhuman identity: an agent, server or tool. These identities don’t act under direct human oversight. They generate requests dynamically, chain operations and carry data across trust boundaries. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/mcp-authentication-and-authorization-patterns/
-
Middle East Conflict Highlights Cloud Resilience Gaps
Data centers, used by both governments and militaries for operations, are now fair game, not just for cyberattacks, but for kinetic attacks as well. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/middle-east-conflict-highlights-cloud-resilience-gaps
-
Can AI-driven cloud security fully protect data
How Can Non-Human Identities Transform AI-Driven Cloud Security? Have you ever pondered the pivotal role machine identities, or Non-Human Identities (NHIs), play in enhancing AI-driven cloud security and data protection? With technology evolves, the intersection between cybersecurity and artificial intelligence becomes increasingly critical. NHIs are often the unsung heroes in securing the cloud environment, ensuring……
-
Cal AI, New Owner of MyFitnessPal, Hit by Alleged Breach of 3 Million Users
Cal AI faces data breach claims after hackers post alleged data of 3 million users, including emails, health details, and subscriptions. First seen on hackread.com Jump to article: hackread.com/cal-ai-myfitnesspal-data-breach-3m-users/
-
AI Startup Jazz Secures $61M to Rethink Data Loss Prevention
Startup Exits Stealth Targeting Insider Risk, Shadow AI and GenAI Data Exposure. Cybersecurity startup Jazz has raised $61 million with an AI-driven approach to data loss prevention. Its platform deploys agent investigators that analyze data context, users, systems and processes to detect insider threats and risky AI usage more accurately than legacy rule-based tools. First…
-
Microsoft’s March 2026 Patch Tuesday Addresses 83 CVEs (CVE-2026-21262, CVE-2026-26127)
8Critical 75Important 0Moderate 0Low Microsoft addresses 83 CVEs including two vulnerabilities that were publicly disclosed prior to a patch being released. Microsoft patched 83 CVEs in its March 2026 Patch Tuesday release, with eight rated critical and 75 rated as important. Our counts omitted one CVE (CVE-2026-26030) assigned by GitHub. This month’s update includes patches…
-
Critical Microsoft Excel bug weaponizes Copilot Agent for zero-click information disclosure attack
Could steal sensitive personal and financial data First seen on theregister.com Jump to article: www.theregister.com/2026/03/10/zeroclick_microsoft_info_disclosure_bug/
-
DOGE employee stole Social Security data and put it on a thumb drive, report says
Tags: dataA whistleblower is accusing a former DOGE member of stealing a large number of Americans’ personal data while he was working at the Social Security Administration, with the plan of using it at his new job. First seen on techcrunch.com Jump to article: techcrunch.com/2026/03/10/doge-employee-stole-social-security-data-and-put-it-on-a-thumb-drive-report-says/
-
Attackers exploit FortiGate devices to access sensitive network information
Attackers are exploiting FortiGate devices to breach networks and steal configuration data containing service account credentials and network details. SentinelOne researchers warn that attackers are exploiting vulnerabilities or weak credentials in FortiGate devices to gain initial access to corporate networks. Once inside, they extract configuration files that may contain service account credentials and information about…
-
Salesforce Sounds Alarm Over Fresh Data Extortion Campaign
CRM-Obsessed ShinyHunters Gang Exploits Misconfigured Customer Experience Portals. A prolific and noisy cybercrime gang with a penchant for stealing Salesforce customers’ data and holding it ransom is taking advantage of misconfigured guest accounts meant to provide public access to services meant to remain private, using a Google scanning tool to identify vulnerable accounts. First seen…
-
ShinyHunters Hackers Threaten 400 Firms Over Stolen Salesforce Data
ShinyHunters claims to have stolen data from 400 firms via Salesforce portals and is threatening to leak the information unless ransom demands are paid. First seen on hackread.com Jump to article: hackread.com/shinyhunters-hackers-threat-stolen-salesforce-data/
-
Data Diodes Have Become Essential to Modern OT Cybersecurity
Segmentation Mandates Make One-Way Data-Flow Architectures Essential Data diodes are re-emerging as a preferred control as IT-OT convergence expands the industrial attack surface and regulators tighten segmentation mandates. Hardware-enforced, one-way data flow offers provable isolation for critical infrastructure and growing executive accountability. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/blogs/data-diodes-have-become-essential-to-modern-ot-cybersecurity-p-4063
-
OpenAI Acquires Security Startup Promptfoo to Fortify AI Agents
OpenAI has snapped up Promptfoo, a specialized artificial intelligence (AI) security startup, to bolster the safety of autonomous digital workers and convince enterprise clients that AI co-workers are ready for high-stakes business environments. OpenAI did not disclose financial terms of the transaction. PitchBook data indicates Promptfoo was valued at $119 million following a $22 million..…
-
‘BlackSanta’ EDR Killer Targets HR Workflows
A campaign by Russian-speaking cyberattackers hijacks workflows to deliver security-busting malware, allowing attackers to steal data without detection. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/blacksanta-edr-killer-hr-workflows
-
Ericsson Breach Exposes Data of 15k Employees and Customers
Ericsson data breach affects 15k employees/customers after third-party service provider compromise First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ericsson-breach-exposes-data-15k/
-
Inference protection for LLMs: Keeping sensitive data out of AI workflows
Inference protection is a preventive approach to LLM privacy that stops sensitive data from ever reaching AI models. Learn how de-identification enables secure, compliant AI workflows with unstructured text. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/inference-protection-for-llms-keeping-sensitive-data-out-of-ai-workflows/