Aggregator

Playbook Aims to Help Healthcare, Public Sector Manage AI Vendor Security Gaps
The Health Sector Coordinating Council released guidance to help the healthcare and public health sector better manage the explosion of third-party AI vendor cyber risk concerns they face, especially as the technology is embedded in all sorts of products.

Critics Call Foreign-Made Router Ban 'Industrial Policy Disguised As Cybersecurity'
Netgear obtained a temporary waiver from the Federal Communications Commission allowing it to continue importing consumer routers through most of 2027, making the networking hardware giant the first consumer brand to circumvent a ban on foreign-made hardware.

Felicis-Led Series A Backs Telemetry Correlation Across Cloud, Identity, Endpoints
Artemis, a New York startup led by former Amazon GuardDuty product leader Shachar Hirshberg, emerged from stealth with $70 million to build an AI-driven SIEM alternative that correlates telemetry across enterprise environments, tailors detections and speeds investigations.

Agencies Prioritizing Tracking Use Over Enforcing Immediate Cutoffs
Federal agency staffers tell ISMG they are still using Anthropic's AI tools weeks after U.S. President Donald Trump ordered an immediate halt, as officials prioritize mapping dependencies and evaluating alternatives over enforcing a rapid shutdown.

Cisco has released security updates to patch four critical vulnerabilities, including a fixed improper certificate validation flaw in the company's cloud-based Webex Services platform that requires further customer action. [...]

Positive Technologies обнаружила скрытую кибератаку во время установки системы защиты в январе 2026 года.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2026-34197 Apache ActiveMQ Improper Input Validation Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

Your biggest risk may be a vendor you trust. How can SMBs map their third-party blind spots and build operational resilience?

A NIST researcher has unveiled the results of a 10-year quest to measure the constant.

Hackers have targeted Ukrainian hospitals and local government bodies in a new espionage campaign using a malware tool dubbed AgingFly, researchers say.

伪造Zoom官网投递BlackSuit勒索软件：9天入

Two American nationals have been sentenced to federal prison for operating a sophisticated “laptop farm” scheme. The operation successfully infiltrated over 100 U.S. companies, generating more than $5 million in illicit revenue to fund the Democratic People’s Republic of Korea (DPRK) and its weapons programs. Kejia Wang, 42, received a 108-month prison sentence, while his […]

The post Two U.S. Nationals Sentenced for Running Laptop Farm for DPRK Remote Workers appeared first on Cyber Security News.

A threat cluster tracked as UAC-0247 has been running an active campaign since early 2026, targeting local governments and municipal healthcare institutions across Ukraine, including clinical hospitals and emergency ambulance services. The attackers are not only stealing sensitive data from internet browsers and WhatsApp but are also moving quietly through compromised networks to expand their […]

The post New UAC-0247 Campaign Steals Browser and WhatsApp Data From Hospitals and Governments appeared first on Cyber Security News.

Cisco has issued an urgent security advisory warning of multiple vulnerabilities in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). According to the official Cisco security advisory published on April 15, 2026, these flaws could allow an authenticated remote attacker to execute arbitrary commands on affected devices. They may also enable path […]

The post Critical Cisco ISE Vulnerabilities Let Remote Attackers Execute Malicious Code appeared first on Cyber Security News.

A vulnerability has been found in WSO2 Identity Server up to 5.2.0.34 and classified as problematic. The affected element is an unknown function of the component Access Token Handler. This manipulation causes session expiration. This vulnerability appears as CVE-2025-12624. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Завышенные ожидания, давление инвесторов и неспособность ИИ переносить код — к 2030 году рынок ждет встряска.

Cisco has announced patches to address four critical security flaws impacting Identity Services and Webex Services that could result in arbitrary code execution and allow an attacker to impersonate any user within the service. The details of the vulnerabilities are below - CVE-2026-20184 (CVSS score: 9.8) - An improper certificate validation in the integration of single sign-on (SSO)

世界自然保护联盟（IUCN）发布公报，南极洲两个最具代表性的物种——帝企鹅和南极毛皮海狮因数量快速、急剧减少，已被列入濒危物种红色名录濒危等级。IUCN 将物种生存状况划分为 9 个等级：灭绝、野外灭绝、极危、濒危、易危、近危、无危、数据缺乏、未予评估。IUCN 公报指出，根据卫星图像，2009 年至 2018 年间，帝企鹅种群数量减少了约 10%，相当于 2 万多只成年帝企鹅消失了。南极气候变化导致海冰发生变化，预测到 2180 年代，帝企鹅的数量将减半。南极毛皮海狮因食物短缺导致数量自 2000 年以来减少了 50%。气候变化致使海洋温度上升和海冰面积缩减，磷虾向更深、更冷的水域迁移，导致南极毛皮海狮的食物来源减少。

Virtual assistants boost productivity but add cybersecurity risks. Poor access control, weak devices, and credential sharing can expose sensitive business data.

Education publishing giant McGraw-Hill has confirmed a data breach following an extortion attempt, with more than 100GB of stolen data now publicly distributed online, exposing the personal information of approximately 13.5 million users. The breach, disclosed in April 2026, stems from a misconfiguration in McGraw-Hill’s Salesforce environment. According to the company, the incident exposed “a […]

The post McGraw Hill Confirms Data Breach Exposing 13.5 Million Users’ Personal Data appeared first on Cyber Security News.