Tag: risk
-
The Cyber Express Weekly Roundup: Five Eyes AI Warning, KDDI Data Breach, Garfield AI Legal Milestone, and Iranian Hacker Arrest
Tags: ai, automation, breach, cyber, cybersecurity, data, data-breach, hacker, infrastructure, intelligence, international, iran, risk, service, threatThis week’s weekly roundup of cybersecurity developments highlights a rapid shift in global cyber risk conditions driven by artificial intelligence acceleration, large-scale data breaches, and expanding international enforcement actions. Across infrastructure, enterprise systems, public services, and regulated AI applications, organizations are increasingly exposed to faster-moving threats where traditional security assumptions are being challenged by automation…
-
The Cyber Express Weekly Roundup: Five Eyes AI Warning, KDDI Data Breach, Garfield AI Legal Milestone, and Iranian Hacker Arrest
Tags: ai, automation, breach, cyber, cybersecurity, data, data-breach, hacker, infrastructure, intelligence, international, iran, risk, service, threatThis week’s weekly roundup of cybersecurity developments highlights a rapid shift in global cyber risk conditions driven by artificial intelligence acceleration, large-scale data breaches, and expanding international enforcement actions. Across infrastructure, enterprise systems, public services, and regulated AI applications, organizations are increasingly exposed to faster-moving threats where traditional security assumptions are being challenged by automation…
-
CMC Releases Analysis and Guidance for Education Sector After Canvas Data Breach
The UK Cyber Monitoring Centre reviews the Canvas breach affecting 160 UK universities, highlighting data theft risks and financial impacts of cyber incidents First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cmc-analysis-education-canvas-data/
-
Windows Secure Boot Certificate Expiry Exposes Billions of PCs to Bootkit and Firmware Security Risks
Microsoft’s long-planned Secure Boot certificate rollover has reached a critical milestone, impacting more than just routine updates. The Microsoft Corporation KEK CA 2011 expired on June 24, 2026, the Microsoft UEFI CA 2011 expires on June 27, 2026, and the Microsoft Windows Production PCA 2011 is scheduled to expire on October 19, 2026. This requires…
-
CISA Adds Actively Exploited Cisco Unified CM Flaws to KEV Catalog
Tags: cisa, cisco, communications, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, risk, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting Cisco Unified Communications Manager (Unified CM) to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting active exploitation risks in enterprise communication environments. The newly listed flaw, tracked as CVE-2026-20230, involves a server-side request forgery (SSRF) vulnerability in Cisco Unified CM and Unified…
-
Was die Straße von Hormus über moderne Identity Security lehrt Das digitale Nadelöhr
Unternehmen unterschätzen das Risiko der digitalen Identitäten. KI-Identitäten greifen bereits auf Kernsysteme zu, jedoch hat nur ein Bruchteil der Organisationen klare Richtlinien, Kontrolle und Lifecycle Management dafür implementiert. Während Regulierungen wie NIS2, DORA und der EU AI Act strengere Nachvollziehbarkeit und Verantwortlichkeit fordern, bleibt die dringende Aufgabe, Identitäten transparent zu machen, Zugriffe in Echtzeit zu steuern…
-
Risk management firm Optro opens Singapore hub
The AI-powered governance, risk and compliance platform aims to disrupt the underserved Asia-Pacific market and help customers such as Singapore’s OCBC Bank modernise their audit functions First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366644968/Risk-management-firm-Optro-opens-Singapore-hub
-
Breach Roundup: How Hackers Exploited a Cisco SD-WAN Flaw
Also, Three Ubiquiti Flaws Under Exploitation. This week, Mandiant detailed a Cisco SD-WAN hack as attackers exploited Ubiquiti flaws. London Hydro disclosed a customer data breach, researchers flagged cross-cloud bucket hijacking risks an INC ransomware leak, Texas and Gravity SMTP incidents. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/breach-roundup-how-hackers-exploited-cisco-sd-wan-flaw-a-32080
-
Aryon Secures $29M to Thwart Cloud Risks Before Deployment
Series A Funds Back Enforcement Controls That Block Insecure Resources Instantly. Aryon Security raised $29 million in Series A funding to help enterprises enforce security policies at cloud deployment, preventing misconfigurations, excessive permissions and insecure resources from reaching production environments across AWS, Azure and Google Cloud. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/aryon-secures-29m-to-thwart-cloud-risks-before-deployment-a-32069
-
Your Board Is Using Shadow AI
Board Members Adopt GenAI Without Policies or Oversight. A new Diligent Institute survey finds 82% of U.S. public company directors are using generative AI for board work, yet 69% of boards have no formal AI policy in place. CIOs are being left out of the governance conversation, and the risks are mounting. First seen on…
-
Do CISOs Need a Code of Ethics?
Dark Reading Confidential Episode 19: Kickbacks, no-show jobs, dirty VCs, and shelf ware, industry expert Robert RSnake Hansen explains why he thinks its time for a CISO code of ethics to ensure cybersecurity bosses aren’t engaged in self-dealing that could risk enterprise, and even national, security. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/ciso-code-of-ethics
-
Orbit: Warum die Satelliten Infrastruktur zur kritischen Angriffsfläche für Unternehmen wird
Satelliten werden zur neuen Cyberangriffsfläche: Wer ihre Risiken unterschätzt, gefährdet Kommunikation, Lieferketten und kritische Infrastrukturen auf der Erde. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/orbit-warum-die-satelliteninfrastruktur-zur-kritischen-angriffsflaeche-fuer-unternehmen-wird/a45601/
-
Das stille Compliance-Risiko Wie unkontrollierte Tracker auf Unternehmenswebsites zur DSGVO-Schwachstelle werden
Wann wurden die Tracker das letzte Mal auf der Unternehmenswebsite geprüft? Vermutlich nicht so oft wie die Firewall-Regeln oder die Endpoint-Security-Richtlinien. IT-Sicherheitsteams investieren Millionen in Netzwerkmonitoring und Schwachstellenscans, doch die eigene Website bleibt oft ein blinder Fleck ein ‘ungepatchtes Leck”, das klassische Sicherheitstools gar nicht sehen. Marketingabteilungen betreiben Tracking meist ohne tiefe IT-Abstimmung, Sicherheitsteams haben […]…
-
Closing the ‘risk window’: Why real-time remediation is the new security standard
Tags: riskFirst seen on scworld.com Jump to article: www.scworld.com/perspective/closing-the-risk-window-why-real-time-remediation-is-the-new-security-standard
-
New Forescout Data Reveals Slow Progress Toward Quantum-Safe Security
Despite growing awareness of quantum computing risks and increasing pressure on organisations to prepare for the transition to post-quantum cryptography (PQC), most internet-facing systems remain unprepared for a quantum-safe future, according to new research from Forescout Research Vedere Labs. The report, published today, reveals that while adoption of PQC-capable technologies has accelerated over the The…
-
KnowBe4 awarded in the email security industry
KnowBe4, the human risk management platform, today announced it has been awarded ‘2026 Global Customer Value Leadership’ in the email security industry as part of Frost & Sullivan’s Best Practices recognition. Best Practices awards companies for their superior leadership and innovation. Frost & Sullivan recognised KnowBe4 for: Its continued protection of the human element of…
-
PoC Released for Microsoft Exchange Server EWS InstallApp SSRF Vulnerability
A proof-of-concept exploit has been released for CVE-2026-45502, a server-side request forgery (SSRF) vulnerability in the Microsoft Exchange Server’s Exchange Web Services (EWS) InstallApp operation. This vulnerability poses risks to organisations that have not yet deployed the security updates from June 2026. The flaw affects Exchange Server versions 2016 CU23, 2019 CU14 and CU15, and…
-
UK Museums Face Cybersecurity Risks, MPs Warn
Public Accounts Committee (PAC) warns that museums and galleries aren’t getting enough government support on cyber First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/mps-criticize-government-museum/
-
Samsung KNOX Kernel Flaw Exposes Galaxy Devices to Memory Corruption Attacks
Samsung has addressed a critical kernel vulnerability in its KNOX security framework that puts millions of Galaxy devices at risk of memory-corruption attacks, potentially allowing full device compromise. This issue, tracked as CVE-2026-20971, was discovered by LucidBit Labs and affects a wide range of Samsung smartphones released over the past eight years, including devices from…
-
CISA Adds Ubiquiti UniFi OS Flaws to KEV Catalog
Tags: cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, network, office, risk, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three critical vulnerabilities affecting Ubiquiti UniFi OS to its Known Exploited Vulnerabilities (KEV) catalog. This highlights the increasing risk to both enterprise and small-office network environments that rely on this popular network management platform. The newly identified flaws, CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, affect UniFi OS…
-
MSSPs need to stop risk before it hits the SOC
First seen on scworld.com Jump to article: www.scworld.com/perspective/mssps-need-to-stop-risk-before-it-hits-the-soc
-
F5 targets shadow AI risk with new AI security platform and SurePath acquisition
First seen on scworld.com Jump to article: www.scworld.com/brief/f5-targets-shadow-ai-risk-with-new-ai-security-platform-and-surepath-acquisition
-
AI can write code. MSPs still own the risk
First seen on scworld.com Jump to article: www.scworld.com/perspective/ai-can-write-code-msps-still-own-the-risk
-
Signal president warns about AI chatbot privacy risks
First seen on scworld.com Jump to article: www.scworld.com/brief/signal-president-warns-about-ai-chatbot-privacy-risks
-
White House drastically shortens deadline for dropping quantum-vulnerable crypto
Order warns of national security risks if post-quantum cryptography isn’t adopted in time. First seen on arstechnica.com Jump to article: arstechnica.com/information-technology/2026/06/executive-order-bumps-up-deadline-to-move-off-quantum-vulnerable-crypto/
-
Xsolis Hack Affecting 1.4M Raises AI Vendor Risk Concerns
Experts Urge Health Sector Organizations to Strengthen AI Governance, Oversight. A Tennessee-based vendor of AI-powered business decision support software for healthcare providers and insurers is notifying nearly 1.4 million people that their information was compromised in a recent hack. Experts said the incident spotlights growing risks to healthcare by AI-tech vendors. First seen on govinfosecurity.com…
-
DifyTap: Four Bugs Put over 1 million AI Apps at Risk
Four flaws in Dify exposed cross-tenant data, documents and AI conversations. Two critical bugs enabled unauthenticated access and data theft. Zafran Labs researchers disclosed four vulnerabilities in Dify, the open-source AI platform used by major companies like Volvo and Maersk to run over a million applications across over 60 industries. Two vulnerabilities are of critical…
-
HR must have a say in AI policy to forestall legal risks
In this Q&A, employment attorney Deepa Menon explains the legal risks of using AI for workforce decisions and why lawyers, HR and IT must agree on a framework before implementing AI. First seen on techtarget.com Jump to article: www.techtarget.com/searchhrsoftware/news/366644954/HR-must-have-a-say-in-AI-policy-to-forestall-legal-risks
-
DifyTap Flaws Expose AI Data Across Tenants on Platform Powering 1M+ Apps
A series of critical vulnerabilities in the widely used open-source LLMOps platform Dify, which powers over one million AI applications. These vulnerabilities, collectively referred to as “DifyTap,” include four flaws, two rated as critical and two that require no authentication. They expose cross-tenant data leakage risks, allowing attackers to access private AI conversations, preview sensitive…