General cybersecurity news and analysis
The rise of AI is revolutionizing cybersecurity, creating a blank canvas for women to chart new career paths and make their mark in this rapidly evolving field. With AI shaking up the defender-attacker dynamic, new role definitions and threat approaches are emerging, offering a fresh opportunity for women to reskill and thrive.
Despite having a robust arsenal of edge controls, security teams are still flying blind to hidden risks lurking in legitimate traffic, leaving them vulnerable to potential threats. The issue lies in the lack of context around underlying infrastructure, causing standard defenses to miss high-risk sessions.
The alarming number of cyber incident reports from water providers - 27 in just seven states - has prompted a swift response from the White House and Texas officials with the launch of Project Watershed 250, a six-month pilot aimed at bolstering water infrastructure cybersecurity. This innovative program will deploy top-notch cyber-defense resources to water and wastewater utilities at no cost, starting with a test run in Texas.
Thousands of Microsoft Exchange servers remain vulnerable to a high-severity flaw, leaving 21,899 internet-facing systems open to hijack attacks that could give attackers control of every mailbox. This unpatched authentication-bypass vulnerability, CVE-2026-62911, was fixed by Microsoft in August, but many servers still haven't been updated.
When Optus went down in 2023, the inconvenience was clear - no coffee, no lunch, no Uber - but what Australians laughed off as a minor annoyance actually exposed a much deeper vulnerability: the alarming dependence of Australia's economy on digital systems. The real issue wasn't just payments, but the entire economic exchange process, from ordering to delivery to settlement.
More than 200 companies, including tech giants like Microsoft and Google, have joined forces to supercharge cyber defense capabilities and shield against AI-enabled attacks. They're calling for a united front to share threat intel, track progress, and swiftly contain attacks.
The Financial Stability Board warns that advanced artificial intelligence could revolutionize cyber threats, potentially shaking market confidence and posing a systemic risk, especially with highly concentrated third-party service providers. Its chair, Andrew Bailey, is urging the sector and authorities to prepare for this emerging threat.
Insiders pose a uniquely potent threat because they already have the keys to the kingdom - and traditional defenses often miss the mark by relying on alerts that don't account for the devastating impact of trusted accounts gone rogue. To stay ahead, defenders must validate their readiness against insider threats by asking tough questions about access, escalation, and lateral movement.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
The US has launched Project Watershed 250, a game-changing initiative that brings together top cyber and AI experts to safeguard America's water systems from growing cyber threats. This six-month pilot in Texas marks a major step forward in the nation's cybersecurity strategy, uniting state, industry, and federal efforts to put America's safety first.
Federal agencies are shaking up their security approach with continuous authorization, recognizing that a system's security can't be judged by its paperwork alone. By treating compliance as a stepping stone to mission success, agencies can deliver secure outcomes faster, without sacrificing speed for security.
There's a shocking disconnect between organizations' confidence in their AI security and the reality: while 94% of organizations believe their AI agents have only the access they need, a mere 33% actually have the least privileged access in place. This gap isn't about awareness, but about turning policy into practice.
Many organizations still rely on file servers for storage due to rising cloud costs, data ownership concerns, regulatory requirements, and legacy compatibility issues. Despite the cloud-dominated era, on-premises file servers remain a practical solution for abundant and inexpensive local storage.
If you've customized your Windows 11 mouse settings, beware: the latest update, KB5120998, may be reverting them to default, causing frustrating losses in personalization. Microsoft is investigating the issue and asking affected users to report their experiences through the Feedback Hub.
If you've recently updated Microsoft Defender Antivirus, you might be seeing annoying false alarms claiming it's turned off - but don't worry, it's still working hard to protect you. These pesky alerts are affecting all supported Windows versions, including Windows 11 26H1 and Windows Server 2025.
An overwhelming 93% of British adults believe they have a right to keep their online conversations private, with 89% agreeing that their personal messages should be off-limits without a court order.
Protect your inbox from data breaches and tracking with Brave's new Email Aliases feature, which lets you generate disposable email addresses to keep your real inbox private. This game-changing update in Brave browser 1.94 helps prevent your personal info from being leaked or sold to data brokers.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Join our weekend open discussion, a relaxed space to chat about anything that caught your attention this week - from the news we didn't cover to topics that are on your mind. Share your thoughts, ask questions, and engage with our community in a friendly and respectful conversation.
A security researcher has uncovered a vulnerability in Anthropic's Claude Code, demonstrating a clever exploit that tricks the AI into executing malicious code, highlighting the risks of prompt injection attacks. This alarming discovery was made by Johann Rehberger, who shared a step-by-step breakdown of the exploit, revealing a surprisingly simple path to remote code execution.
Android 17 just got a major boost to online privacy with OS-wide Encrypted Client Hello support, making it harder for snoops to see which websites you're visiting. This new standard teams up with private DNS to keep your browsing habits private, shielding the domain names you visit from prying eyes.
Researchers have uncovered a vulnerability in PaperCut that allows an unauthenticated attacker to gain remote control, enabling them to execute arbitrary Java code within the application's process. This flaw can be exploited through a clever two-step chaining technique, putting unpatched PaperCut NG and MF instances at risk.
A 68-year-old UK man, Milan Ibrahim, has been sentenced to over six years in prison for running a massive $1.3 million IPTV piracy ring that sold stolen broadcasts from top brands like the BBC, ITV, and Sky. His illicit operation raked in nearly £1 million over just three years, authorities say.
As AI-driven cyber threats escalate, 100 top tech firms, including OpenAI, Google, and Microsoft, are sounding the alarm, calling for collective action to bolster cyber defenses. It's a wake-up call: defenders must adapt and become AI-native to protect against rapidly advancing threats.
The National Vulnerability Database (NVD) is undergoing a major overhaul as it struggles to keep up with a staggering 30,000 reclassified vulnerabilities, now marked as "Not Scheduled" for further analysis, amid a surge in AI-driven discoveries. This change aims to help manage the overwhelming backlog through selective processing and automation.
Meet Kibu, an encryption app designed with military-grade security in mind, solving a pressing problem for government execs who rely on personal devices for sensitive conversations. Its cutting-edge verification features combine biometric authentication with organizational identity controls to ensure you're talking to the right person - or entity.