Showing 25–48 of 53 reports
AI Agent Swarms Turn Security Basics Into Cost Controls
Cisco Talos warns that agentic attacks can compress reconnaissance, probing, social engineering, and exploitation. The practical defense is to make every attacker step more expensive through identity hardening, telemetry, throttling, and rehearsed response.
Q3 Attack Trends Show Trusted Paths Are Becoming the Real Target
ASEC’s Q3 2026 attack-techniques report shows attackers chaining perimeter devices, supply-chain paths, and identity workflows. Defenders should map and monitor trusted paths, not just patch isolated CVEs.
FortiBleed Shows Why VPN Credential Compromise Needs Full Incident Response
The FBI and Secret Service warn that FortiBleed remains active against Fortinet firewall and VPN environments. The key lesson: exposed edge-device credentials require incident response, not just patching and password resets.
GitHub Enterprise SSRF Shows Why Secret Scanning Needs Network Guardrails
GitHub patched CVE-2026-96890, a high-severity GitHub Enterprise Server SSRF in secret-scanning validity checks that could potentially lead to appliance RCE. Defenders should patch GHES and restrict appliance egress.
Blinder Tunnel Shows How Developer Trust Becomes Critical Infrastructure Risk
Unit 42 reports an Iran-nexus campaign using fake Dubai Airports recruitment lures, weaponized Visual Studio projects, GitHub-based command-and-control, and tunneling tools against Iraqi critical infrastructure. The lesson for SMBs and government contractors: developer workflows need the same identi
Browser Detection and Response Shows Why the Browser Is Now a Security Blind Spot
Zscaler argues that browser-based attacks increasingly evade traditional endpoint and network controls because key behavior happens inside the browser. Defenders should treat browser telemetry, extension control, clipboard/file movement, identity flows, and isolation policy as part of the detection-
Apache Struts REST Plugin Flaws Show Why Legacy Java Apps Need Exposure Review
Apache disclosed four Struts vulnerabilities on October 5, including an important REST plugin issue that can exhaust Java heap memory and an OGNL injection path in the legacy RESTful action mapper. Defenders should inventory exposed Struts apps, patch to 6.12.0 or 7.4.0, and verify mapper/plugin usa
Apache Thrift 61-CVE Patch Shows Why RPC Frameworks Need Inventory
Apache Thrift 0.25.0 fixes 61 vulnerabilities across multiple language bindings. Defenders should treat this as an RPC exposure and software-inventory problem, not just another library bump.
NIST OT Zero Trust Guidance Shows Segmentation Must Reach Below Level 3
NIST SP 800-82r4 brings zero trust into OT guidance, but defenders need local segmentation and access controls below Purdue Level 3 where controllers, HMIs, and engineering authority live.
Milk Dragon Shows Social Commerce Phishing Needs Identity and Payment Controls
Group-IB’s Milk Dragon research shows how shopping-discount lures on social media can become adversary-in-the-middle phishing and payment-card theft. SMBs and government contractors should treat social commerce fraud as an identity, brand, and payment-risk problem — not just user awareness.
Cisco SD-WAN Auth Bypass Shows Edge Control Planes Need Emergency Review
Cisco says CVE-2026-76504 is being actively exploited against Catalyst SD-WAN Manager, giving unauthenticated attackers admin-level API access. Edge management systems need emergency patching, exposure reduction, and compromise review.
Ransomware Data Theft Surge Shows Why Exfiltration Defense Comes First
Zscaler ThreatLabz reports ransomware data theft surged 275.8% year over year, with government, healthcare, education, and utilities facing larger exfiltration events. Defenders need controls that stop data movement before encryption begins.
Live Exposed Credentials Show Why Secret Scanning Must End in Revocation
Truffle Security found more than half a million live credentials in public GitHub repositories. For SMBs and government contractors, the lesson is clear: secret scanning is not remediation until access is revoked and verified.
Antino Backdoor Shows Why Microsoft 365 C2 Needs Cloud-Aware Detection
Cisco Talos reports China-nexus UAT-11587 used the Antino backdoor with Outlook and OneDrive as command-and-control channels. Here is what SMB and government-contractor defenders should monitor.
Session Cookie Bypass Shows Why SSO Is Not the Whole Trust Boundary
Resecurity found an application where predictable session-cookie signing bypassed Entra ID SSO and MFA. Here is what SMB and government-contractor defenders should check.
Warlock Ransomware Shows SharePoint Is Still Critical Infrastructure Risk
Recorded Future News and Symantec report China-nexus Warlock ransomware attacks against water, telecom, government, and university targets. Here is what SMB and government-contractor defenders should do about exposed SharePoint risk.
FortiMail Zero-Day Shows Email Security Appliances Need Incident Response
Fortinet says CVE-2026-104286 is being exploited against FortiMail. Here is how SMB and government-contractor defenders should respond beyond patching.
DragonForce TURN and MQTT Backdoors Show Why Ransomware Defense Needs Egress Visibility
Lab52 reports DragonForce-linked backdoors abusing TURN relays and MQTT for resilient command-and-control. Here is what SMBs and government contractors should monitor now.
AI Is Turning Vulnerability Triage Into a Threat-Intel Problem
Google Threat Intelligence Group says AI is increasing vulnerability discovery and n-day weaponization pressure. For SMBs and government contractors, the answer is not panic-patching everything—it is exposure-aware, intelligence-led triage.
2CLoader Shows Why Malware Loader Alerts Need Identity Response
Zscaler ThreatLabz detailed 2CLoader delivering Vidar, Remus, and XWorm. Here is why SMB and government-contractor defenders should treat loader detections as credential and identity incidents.
Zimbra CVE-2026-73570 Shows Mail Servers Need Full Incident Review
Microsoft tracked exploitation of an unauthenticated Zimbra command injection flaw. For defenders, this is a patch-and-investigate mail-server incident, not just a routine update.
Apache MINA SSHD Auth Bypasses Show Why Embedded SSH Needs Inventory
Apache disclosed critical MINA SSHD authentication-bypass flaws affecting certain Java SSH server implementations. Here is what SMB and government-contractor defenders should check first.
NeedyMantis Shows Why Post-Compromise Malware Needs Full Intrusion Review
Microsoft’s NeedyMantis analysis shows why targeted malware found after initial access should trigger full intrusion review, not a simple cleanup ticket.
NetScaler KEV RCEs Show Why Edge Devices Need Emergency Playbooks
Citrix and CISA confirmed active exploitation of two critical NetScaler ADC/Gateway flaws. Here is how SMB and government-contractor defenders should patch, verify exposure, and hunt for compromise.