Oracle issues critical patches for Database Server, Fusion Middleware
Oracle’s July 2026 Critical Patch Update, its largest ever, contains 1,449 new security patches spanning 32 product families, from Oracle Database and E-Business Suite to…
Category: CISOOnline
Microsoft’s 3-day patching directive comes with added operational risk
“[Enterprises should focus on] identifying vulnerabilities with credible and functional PoCs, verified exploitation, or sustained attention from ransomware groups, threat actors, and botnets,” says Caitlin…
German law enforcement claims to have ‘dismantled’ mega phishing-as-a-service group Kratos
“This appears to be more than a routine website seizure. The reporting points to a PhaaS platform with centralized infrastructure, subscription-style customers, and Microsoft 365…
Critical Zimbra security update fixes 9 vulnerabilities
The release also fixes four cross-site scripting (XSS) vulnerabilities in the Classic Web Client that could allow attackers to execute malicious scripts when users view…
Cisco’s AI shrinks haystacks to help security teams hunt needles
“Antares outputs a ranked list of source files likely to contain a relevant vulnerability, along with the terminal exploration trace that led to that result,”…
AI, security operations and the new race against time
You don’t trust AI in the abstract. You trust that a system understands your tools, your telemetry and the edge cases that only exist in…
10 survival tips for CSOs who report to the CEO
We asked several current CSOs, CEOs, and IT staffing experts for advice on how security executives can best navigate a direct reporting relationship with their…
Claude Mythos FAQ: Capabilities, access, competitors, implications
Western intelligence agencies that form the Fives Eyes alliance issued a statement warning that frontier AI models such as Claude Mythos are “fundamentally transforming both…
Context bombing heralds a new AI era of deceptive defense
Furthermore, once one of these banned instructions make it into the context window, the whole session is poisoned, and the model will often refuse to…
AI agents can escape sandboxes without ever breaking them
Sandboxes have become a key security control for AI coding agents, but new research suggests they may not provide the isolation many organizations assume. Pillar…
White hat hacker Park Chan-am zeros in on the AI era’s key security challenges
The ever-widening blast radius of AI testing Local AI testing environments are becoming a dangerous security blind spot that information security leaders often overlook. Rapid…
New ACR Stealer campaigns use WebDAV, MSHTA to evade detection
The second chain uses MSHTA, heavily obfuscated PowerShell, stenography, and predominantly fileless, in-memory execution to minimize forensic trails. “The most troubling part of ACR Stealer…