1,437 articles
Threat IntelCloudflare security advisory details a rule engine normalization defect enabling request smuggling and WAF inspection bypass.
Gov / DefenseCISA Advisory ICSA-26-280-01 details a critical authentication bypass in Rockwell Automation FactoryTalk VantagePoint manufacturing analytics servers.
Gov / DefenseCERT-In security advisory mandates multi-cloud redundancy, immutable backup vaults, and 6-hour incident disclosure across Indian financial institutions.
OT / SCADACISA Advisory ICSA-26-279-01 details a critical denial of service flaw in Siemens SIMATIC S7-1500 and ET 200SP programmable logic controllers.
Threat IntelNVIDIA Product Security advisory addresses a critical memory corruption defect in Triton Inference Server enabling code execution across enterprise AI clusters.
OT / SCADASEC Form 8-K disclosure details a nation-state intrusion targeting municipal water SCADA gateways and programmable logic controllers.
GoogleGoogle Cloud security bulletin resolves a filter evasion flaw in Vertex AI Prompt Armor allowing jailbreak payload delivery to enterprise RAG agents.
Gov / DefenseCISA Advisory ICSA-26-278-02 details a critical memory corruption vulnerability in Schneider Electric Modicon M580 and M340 industrial controllers.
Deep DiveEuropean Supervisory Authorities operationalize DORA TLPT frameworks, requiring banks and critical ICT providers to undergo advanced red-team audits.
Deep DiveContinuous zero-days in Citrix, Fortinet, and enterprise gateways demonstrate that reactive patching is failing. Only hardware MTE and Rust re-architectures offer an exit.
Deep DiveIndia activates Phase 2 of the Digital Personal Data Protection Act, introducing DPBI enforcement inquiries and penalties up to ₹250 Crore.
AWS CloudSEC Form 8-K disclosures reveal a surge in material cyber incidents driven by cloud identity theft and automated data lake exfiltration.
AWS CloudAWS Security Bulletin details an authorization validation defect in S3 Multi-Region Access Point endpoints permitting IAM privilege escalation.
Deep DiveDisparate incident reporting windows across the SEC, EU DORA, and India's RBI create a legal hazard for CISOs. Here is how enterprise response playbooks must adapt.
Agentic AIRecent CVEs in Ollama and AWS MCP reveal that semantic prompt filters cannot prevent tool injection. Engineering teams must isolate agent tools in ephemeral microVMs.
MicrosoftMicrosoft MSRC advisory documents a critical model-context-protocol tool injection flaw in Azure AI Foundry enabling indirect agentic tool hijacking.
Gov / DefenseCISA Advisory ICSA-26-274-05 details a critical authentication bypass flaw in Johnson Controls EasyIO Neo EC and CW series building automation controllers.
Deep DiveReserve Bank of India mandates strict IT governance, cloud outsourcing oversight, and 6-hour cyber incident disclosures across financial institutions.
Data BreachThe exfiltration of 8.8M Danish CPR records exposes the systemic risk of partner API queries. Security leaders must replace static trust with verifiable credentials.
VulnerabilityThe Reserve Bank of India mandates strict 6-hour incident disclosure via DAKSH and CERT-In, requiring board-level oversight and 180-day forensic log retention.
Data BreachDanish authorities confirmed an unauthorized entity abused legitimate commercial partner API credentials to exfiltrate 8.8 million CPR citizen identity records.
AWS CloudAWS resolved a fail-open defect in Python Lambda Powertools data masking (CVE-2026-104002) that emitted unmasked sensitive records to logs during masking errors.
AWS CloudAWS Security Bulletin 2026-121-AWS addresses an argument injection defect in security-agent-mcp-server diff scanning that permits arbitrary file modification.
Threat IntelA security defect in Ollama experimental agent mode allowed command chaining operators to bypass confirmation gates and execute arbitrary shell commands.