16-year-old KVM flaw allows attackers to escape VMs and take over Linux servers
A critical vulnerability in the Kernel-based Virtual Machine (KVM) module of the Linux kernel allows attackers with root access in a guest VM to execute…
Category: CISOOnline
The modern CISO is becoming the next CFO
At some point, every security leader gets asked a version of the same question: Are we good? It tends to arrive when something is at…
Why The Gentlemen ransomware is a test of identity and recovery controls
The Picus report focuses on a Windows-targeting encryptor, but other researchers have reported broader Gentlemen tooling aimed at Linux and VMware ESXi environments. The group…
Zscaler finds autonomous agents succumb to IPI traps
“Every model provider will admit privately that the fundamental architecture of transformer-based reasoning cannot cleanly separate untrusted content from trusted instructions when both share the…
Identity: The operational control plane for agentic AI
Existing security controls weren’t designed for AI agents. Static credentials and standing privileges aren’t sufficient for an emerging model where organizations need to rapidly authorize,…
The agentic blind spots in your zero trust program
Stephen Wilson, field chief technology officer for HashiCorp, an IBM company, likens AI agents to “really smart kindergartners.” “They know how to do something, but…
This AI agent autonomously hacked a network, adapted on the fly, and demanded a ransom
Adaptive decision making is the biggest concern, he said. “Traditional detections assume attackers follow fairly predictable paths. An AI agent can quickly change tactics if…
7 cyber risk assessment gotchas to avoid
“As a result, it becomes difficult to communicate the real risks of breaches and other risks,” he states. “Worse yet, it gives security team members…
New CitrixBleed-like NetScaler flaw sees exploit attempts in the wild
Smaller leak but still dangerous Even though watchTowr was only able to leak bytes of data using this flaw, compared to kilobytes with previous CitrixBleed…
Microsoft 365 users fall victim to one-in-a-million password spray attack
The attacks all came from a single source, an IPv6 address range controlled by internet provider LSHIY LLC, Huntress said in a blog post. LSHIY…
Adobe premieres a second Patch Tuesday each month to deliver fixes faster
As an early indicator of the need for the faster rhythm, it issued two security advisories dealing with a number of critical vulnerabilities on June…
Argo CD flaw shows why GitOps infrastructure should be treated as tier zero
“CISOs should therefore evaluate which workloads can communicate with the Argo CD control plane, whether east-west traffic is appropriately segmented, and whether unnecessary trust relationships…