Latest

Governance & Risk Management

The MFA Illusion: Rethinking Identity for Non-Human Agents

Suparna Goswami  •  July 21, 2025

The explosion of agentic AI and autonomous bots to orchestrate cross-system tasks is turning MFA into a brittle defense. Non-human identities often bypass human-centric security controls, operating with static credentials and undefined ownership, creating exploitable identity risks.

Cyberwarfare / Nation-State Attacks

Cyberattacks Surging Across Indo-Pacific, Researchers Warn

Chris Riotta  •  July 21, 2025

A Center for a New American Security study found China and North Korea are accelerating cyberattacks, influence operations and infrastructure breaches across the Indo-Pacific, as researchers urge the U.S. to help develop a regional cyber shield, and deploy forward cyber teams.

3rd Party Risk Management

File Transfer Flaw Blamed in Health Breach Affecting 233,000

Marianne Kolbasuk McGee  •  July 21, 2025

A Connecticut-based firm that provides print and electronic document management services to health plans has reported to regulators that an exploit of a vulnerability in file transfer software from third-party vendor Cleo has resulted in a health data compromise affecting nearly 233,000 people.

Cyberwarfare / Nation-State Attacks

UK Sanctions 3 Russian Military Cyber Units

Akshaya Asokan  •  July 21, 2025

The U.K. government on Friday sanctioned three Russian Military Intelligence Service units 29155, 26165 and 74455 in the United Kingdom and Ukraine. The sanctions also targeted 18 Russian officials for their role in GRU cyber operations dating back to 2013.

Data Security

Hackers Target Zero-Day Vulnerability to Exploit CrushFTP

Mathew J. Schwartz  •  July 21, 2025

Managed file-transfer software developer CrushFTP said a zero-day vulnerability in its tool's web interface is being actively exploited to gain admin-level access to servers. The company urged immediate updating, saying all versions of its software released since July 1 are patched.

Artificial Intelligence & Machine Learning

AI Needs a Firewall and Cloud Needs a Rethink

Rahul Neel Mani  •  July 21, 2025

The cloud was meant to be cheaper, but it's not. A bold new vision is emerging: one that slashes costs, decentralizes AI and secures APIs at the edge. From inference to firewalls, a reimagined internet is challenging hyperscaler dominance.

Governance & Risk Management

Attackers Exploit Zero-Day Flaws in On-Premises SharePoint

Prajeet Nair , Mathew J. Schwartz  •  July 21, 2025

Hackers have been exploiting two zero-day vulnerabilities in on-premises installations of Microsoft SharePoint to gain remote access, and steal cryptographic keys and data. As Microsoft rolls out patches against "ToolShell," experts warn administrators to also rotate keys, to help eject attackers.

Access Management

Identity and Access Management (IAM) Market Guide 2025

Dan Verton  •  July 21, 2025

The Identity and Access Management (IAM) Market Guide 2025 provides an essential industry briefing on the evolving identity security ecosystem - offering unparalleled insights into the trends, technologies and market forces reshaping IAM this year.

Cybercrime

Hackers Exploit FIDO MFA With Novel Phishing Technique

Prajeet Nair  •  July 19, 2025

Expel researchers have found a novel adversary-in-the-middle phishing technique used by PoisonSeed, a cybercrime group previously tied to large-scale cryptocurrency thefts, to sidestep one of the most secure forms of multifactor authentication - FIDO2 physical keys.

Artificial Intelligence & Machine Learning

UK Creative Community, Big Tech Resume AI Copyright Talks

Akshaya Asokan  •  July 18, 2025

The U.K. government on Wednesday began its latest round of talks between creative owners and the artificial intelligence sector to work out a potential deal on the use of copyrighted content to train AI models. The discussions follow two previous failed attempts.

Application Security

Botnet Abuses GitHub Repositories to Spread Malware

Prajeet Nair  •  July 18, 2025

Threat actors are using public GitHub repositories to host and distribute malware through the Amadey botnet in an ongoing campaign linked to a broader malware-as-a-service operation, Cisco Talos said in a report published Thursday.

Artificial Intelligence & Machine Learning

Security, AI Oversight Are Flashpoints in Draft Defense Bill

Chris Riotta  •  July 18, 2025

Washington is wagering that future conflicts will unfold as much in cyberspace as on the battlefield, with House and Senate lawmakers unveiling dueling drafts of a nearly $900 billion defense bill that spotlights needs for cybersecurity and artificial intelligence technology.