Category: InfoSec

ServiceNow Data Breach: Gated Advisory Left Customers Unaware of Exploited Zero-Auth API

Source: Tech Times

Author: unknown

URL: https://www.techtimes.com/articles/318166/20260610/servicenow-data-breach-gated-advisory-left-customers-unaware-exploited-zero-auth-api.htm

ONE SENTENCE SUMMARY:

ServiceNow fixed an unauthenticated API data-query flaw after confirmed exploitation, drawing criticism for delayed, gated disclosure and urgent customer response actions.

MAIN POINTS:

  1. Attackers queried sensitive ServiceNow customer tables via an unauthenticated API endpoint.
  2. Misconfiguration set requires_authentication=false, bypassing identity and privilege checks entirely.
  3. Reported exploited path was /api/now/related_list_edit/create against instance tables.
  4. Suspicious requests often came from IP 51.159.98.241, about five per tenant.
  5. Confirmed activity occurred June 2–3, 2026; hosted instances patched June 5.
  6. ServiceNow published advisory June 9, but hid it behind support-portal authentication.
  7. Limited notification meant many customers lacked a trigger to start incident response.
  8. Potentially exposed data includes tickets, HR records, assets, incident reports, tokens, and secrets.
  9. Credential leakage can enable lateral movement into integrated enterprise systems without further exploits.
  10. This is ServiceNow’s third major auth-related issue in eight months; first with pre-patch data access.

TAKEAWAYS:

  1. Search transaction logs for /api/now/related_list_edit/create and IP 51.159.98.241 during June 2–5.
  2. Review all Scripted REST Resources for requires_authentication disabled, including custom endpoints.
  3. Rotate credentials embedded in tickets and integrations immediately, assuming potential exposure.
  4. Enable verbose REST/API logging to support future scoping and exfiltration assessment.
  5. Engage legal counsel early since “queried vs exfiltrated” affects GDPR, HIPAA, and SEC obligations.

NIST AI RMF: Where to Start with AI Governance

Source: Rivial Security Blog

Author: Randy Lindberg

URL: https://www.rivialsecurity.com/blog/nist-ai-rmf-where-to-start-with-ai-governance

ONE SENTENCE SUMMARY:

Start AI governance with NIST AI RMF Govern, integrate into cyber risk, add inventories/controls, use FS AI RMF, report quantified ROI.

MAIN POINTS:

  1. AI adoption is accelerating faster than prior technology waves, embedding into core operations.
  2. Governance must begin immediately because AI appears via tools, vendors, and silent updates.
  3. NIST AI RMF provides four functions: Govern, Map, Measure, Manage.
  4. Prioritize Govern by establishing AI policy, ownership, procurement, and AI-aware change management.
  5. Build and maintain an AI system inventory tied to approvals, evidence, monitoring, and reporting.
  6. Fold AI risk into existing cybersecurity risk program, avoiding parallel AI risk silos.
  7. Extend eight cyber-risk elements with AI-aware updates, including AI-specific KRIs and TEVV.
  8. Quantitative risk measurement (e.g., Monte Carlo) beats qualitative heat maps for decision-making.
  9. FS AI RMF adds concrete, auditable controls useful beyond financial services for implementation.
  10. Board reporting should use dollars, expected loss reduction, and ROI, not red-yellow-green visuals.

TAKEAWAYS:

  1. Publish a workable AI policy now, then iterate as AI capabilities rapidly change.
  2. Treat AI as a risk dimension on existing systems, keeping one risk register and methodology.
  3. Counter shadow AI by offering approved tools and a fast intake/approval path.
  4. Add “accuracy” to CIA impacts to capture drift, bias, and hallucinations (CIA+A).
  5. Use breach-per-record and downtime estimates as ranges to quantify AI risk financially.

VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks

Source: The Hacker News

Author: info@thehackernews.com (The Hacker News)

URL: https://thehackernews.com/2026/06/vs-code-adds-2-hour-extension-auto.html

ONE SENTENCE SUMMARY:

VS Code now delays most extension auto-updates by two hours to reduce exposure to newly published supply-chain attacks.

MAIN POINTS:

  1. Microsoft introduced a two-hour delay for automatic VS Code extension updates.
  2. The change aims to mitigate software supply chain threats from compromised releases.
  3. This protection activates when automatic extension updates are enabled.
  4. The feature is available beginning with Visual Studio Code version 1.123.
  5. Users can still manually install updates immediately via the “Update” button.
  6. Extension details show why an update is pending and when it will occur.
  7. Trusted publishers’ extensions bypass the delay and update immediately.
  8. RubyGems added an opt-in cooldown to Bundler 4.0.13 for delayed gem installs.
  9. Bun, npm, pnpm, and Yarn added minimum-release-age controls with specific settings.
  10. Minimum-age thresholds reduce the spread window before malicious packages are detected and removed.

TAKEAWAYS:

  1. Delayed updates are emerging as a standard defense across developer ecosystems.
  2. A short cooldown can meaningfully limit exposure to fast-moving malicious releases.
  3. Manual update options preserve developer flexibility despite automated delays.
  4. Trust-based exceptions prioritize speed for major publishers, but increase reliance on publisher integrity.
  5. Supply-chain risk is rising, making proactive installation and update gating increasingly important.

Cybersecurity Hygiene Reinforced by the 2026 Verizon DBIR

Source: Blog Feed – Center for Internet Security

Author: unknown

URL: https://www.cisecurity.org/insights/blog/cybersecurity-hygiene-reinforced-by-the-2026-verizon-dbir

ONE SENTENCE SUMMARY:

Verizon’s 2026 DBIR shows CIS Controls and Benchmarks improve cyber hygiene, reducing exposure and countering prevalent modern attack techniques effectively.

MAIN POINTS:

  1. DBIR links common breach patterns to foundational security hygiene gaps across organizations.
  2. CIS Controls provide prioritized, actionable safeguards aligned to real-world attack paths.
  3. CIS Benchmarks harden system configurations, shrinking misconfiguration-driven compromise opportunities.
  4. Mapping DBIR top threats to CIS safeguards helps focus limited resources on highest risks.
  5. Strong identity, access management, and MFA reduce credential theft and account takeover impact.
  6. Vulnerability and patch management limit exploitation windows used by ransomware and initial access brokers.
  7. Secure configuration baselines improve consistency across cloud, endpoints, servers, and network devices.
  8. Continuous monitoring and logging support faster detection and response to prevalent intrusion techniques.
  9. Backup, recovery, and resilience controls blunt ransomware business impact and downtime.
  10. Governance and measurement using CIS frameworks enable repeatable hygiene improvements over time.

TAKEAWAYS:

  1. Prioritizing CIS Controls is a practical way to address the most frequent DBIR attack patterns.
  2. Implementing CIS Benchmarks reduces preventable breaches caused by insecure default configurations.
  3. Aligning security programs to evidence-based reports improves decision-making and investment justification.
  4. Standardized baselines and continuous verification are essential for sustaining cybersecurity hygiene.
  5. Combining prevention, detection, and recovery controls provides better defense against modern, multi-stage attacks.

Hackers Are After the Gaps in Your Vulnerability Program: Here’s Their Playbook

Source: BleepingComputer

Author: Sponsored by Flare

URL: https://www.bleepingcomputer.com/news/security/hackers-are-after-the-gaps-in-your-vulnerability-program-heres-their-playbook/

ONE SENTENCE SUMMARY:

Underground tutorial by “Hercules” teaches novices to find, validate, and monetize vulnerabilities, spreading widely and challenging defenders’ patching programs worldwide.

MAIN POINTS:

  1. Forum post presents a simple end-to-end workflow: scan, assess, exploit, monetize.
  2. Author emphasizes tracking newly disclosed high-impact flaws like RCE, auth bypass, ATO.
  3. Guidance includes locating exposed systems and verifying vulnerability status at scale.
  4. Nuclei framework and community templates are promoted for fast, automated discovery.
  5. Tutorial explicitly separates “legal” disclosure paths from “illegal” exploitation choices.
  6. Plain-language tone lowers barriers, framing hacking as learnable through practice, not theory.
  7. Responses show beginners seeking mentorship, private contact, and applied guidance.
  8. Method’s popularity led to reposts and discussion across four additional underground forums.
  9. Monetization options include paid disclosure, underground sales, or direct exploitation for access.
  10. Discussion highlights defender patching delays and the persistent risk of legacy vulnerabilities.

TAKEAWAYS:

  1. Simplified, repeatable playbooks can scale cybercrime more than novel techniques.
  2. Rapid patching and exposure management matter most for reachable critical vulnerabilities.
  3. Old, unmaintained platforms remain profitable targets because novices can exploit known CVEs.
  4. Well-designed paid disclosure programs can shift incentives toward reporting over exploitation.
  5. Threat intelligence should monitor tutorial传播 and recruitment behaviors, not just IOCs.

7 tabletop exercise mistakes that sabotage incident response

Source: 7 tabletop exercise mistakes that sabotage incident response | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4179644/7-tabletop-exercise-mistakes-that-sabotage-incident-response.html

ONE SENTENCE SUMMARY:

Effective cyber tabletop exercises require clear objectives, realistic ambiguity, business-specific detail, right stakeholders, and testing interdependent decisions—not compliance theater alone.

MAIN POINTS:

  1. Running tabletops without measurable objectives rewards improvisation and obscures plan effectiveness.
  2. Generic ransomware scripts cause exercises to drift into discussion rather than readiness testing.
  3. Practicing only familiar incidents leaves teams unprepared for ambiguous, conflicting real-world signals.
  4. Introducing incomplete information forces decision-making under uncertainty, mirroring actual breach conditions.
  5. Scenarios must reflect your environment, priorities, past incidents, and industry threats.
  6. Missing stakeholders—legal, communications, HR, operations, executives—creates gaps in ownership and escalation.
  7. Capturing stalls, unclear decision rights, and absent voices should drive iterative improvements.
  8. Technical implausibility erodes buy-in; attack chains must logically connect to real architecture.
  9. Overly theoretical prompts high-level answers, hiding tooling gaps, authority limits, and communication breakdowns.
  10. Stress-test handoffs and dependencies across teams and vendors using risks from the organization’s register.

TAKEAWAYS:

  1. Define success criteria around escalation, notification, decision rights, and recovery prioritization before the exercise.
  2. Design ambiguity deliberately so participants practice choosing actions with partial, conflicting data.
  3. Tailor scenarios to business realities and include all real incident stakeholders.
  4. Ground narratives in technically accurate details that match systems, logs, and likely attacker paths.
  5. Measure outcomes, document friction points, and update plans and future tabletops to close gaps.

Attackers exploit Palo Alto GlobalProtect flaw days after disclosure

Source: Attackers exploit Palo Alto GlobalProtect flaw days after disclosure | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4179847/attackers-exploit-palo-alto-globalprotect-flaw-days-after-disclosure.html

ONE SENTENCE SUMMARY:

Attackers exploit CVE-2026-0257 in Palo Alto GlobalProtect, bypassing authentication via forged cookies, accelerating patch urgency and zero-trust scrutiny.

MAIN POINTS:

  1. Active in-the-wild exploitation followed Palo Alto’s initial medium-severity disclosure within days.
  2. Rapid7 observed successful VPN access across customers, without confirmed lateral movement.
  3. CVE-2026-0257 impacts GlobalProtect remote-access VPN on PAN-OS devices.
  4. Exploitation reportedly began May 17, shortly after fixes and mitigations were published.
  5. Palo Alto raised CVSS to 7.8, marked “attacked,” and set highest urgency.
  6. Vulnerability enables credential-less authentication bypass by forging a trusted cookie.
  7. Sessions appear legitimate, complicating detection compared with typical intrusion methods.
  8. Root cause: decrypted cookie contents trusted without signature verification.
  9. Exposure requires specific configuration: override cookies enabled and shared certificate usage.
  10. CISA added it to KEV, ordering rapid remediation for federal agencies.

TAKEAWAYS:

  1. Treat auth-bypass flaws on remote-access gateways as critical, regardless of base scoring.
  2. Audit GlobalProtect configurations for authentication override cookies and certificate reuse.
  3. Patch immediately and apply mitigations; exploitation can start days after disclosure.
  4. Strengthen monitoring for suspicious “legitimate” VPN sessions that may be forged.
  5. Improve asset visibility and configuration governance to reduce edge-device exposure during zero-trust transitions.

Top 6 Claude Security Risks to Watch as AI Becomes Your Employees’ Operating System

Source: Cloud Security Alliance

Author: unknown

URL: https://www.akto.io/blog/claude-security-risks

ONE SENTENCE SUMMARY:

Claude’s expanding privileges create shadow AI, connector, skills, and code risks requiring comprehensive discovery, governance, IAM, SDLC controls, and monitoring.

MAIN POINTS:

  1. Unapproved Claude usage exposes proprietary, financial, and legal data without organizational visibility or guardrails.
  2. Missing SSO and acceptable-use policies prevents understanding data flows and regulatory compliance status.
  3. Claude Projects act as unmanaged repositories for sensitive documents, access sharing, and connectors.
  4. Organizations often cannot identify uploaded files, project access holders, or active connector activity.
  5. MCP connectors expand attack surface by enabling direct access to Slack, GitHub, Drive, Jira, Notion.
  6. OAuth scopes and authentication boundaries are frequently over-permissioned by users for convenience.
  7. Cowork introduces autonomous AI actions, complicating accountability, policy enforcement, and auditing requirements.
  8. Claude Code skills create supply-chain risks; plain-English prompts can drive data exfiltration.
  9. Studies found high vulnerability rates in Claude-generated code, increasing production security defects.
  10. Platform flaws in Claude Code enable malicious repositories to trigger command execution and key compromise.

TAKEAWAYS:

  1. Perform enterprise-wide asset discovery to inventory Claude usage across web, desktop, Code, and Cowork.
  2. Treat Projects as persistent data stores and enforce DLP with classification and real-time monitoring.
  3. Govern MCP/connector enablement with security review, least privilege, and token-usage visibility.
  4. Apply secure SDLC gates to AI-generated code, skills, extensions, and autonomous workflows.
  5. Build continuous audit trails for AI activity, access patterns, and sensitive-data exposure across all surfaces.

Grading on a curve: How to assess a pentest

Source: The Red Canary Blog: Information Security Insights

Author: Brian Donohue

URL: https://redcanary.com/blog/testing-and-validation/pentesting/

ONE SENTENCE SUMMARY:

Effective defense disrupts multi-stage attack chains by prioritizing high-fidelity, intent-rich behaviors, not exhaustive detection of every atomic action.

MAIN POINTS:

  1. Breaches result from campaigns of sequential actions, not single attacker successes.
  2. Detecting any critical step can hinder adversaries, evict threats, and prevent incidents.
  3. Depth and redundancy help, but complete coverage of all behaviors isn’t required.
  4. Testing is often misused as an exhaustive scorecard demanding alerts for every action.
  5. Real threats are adaptive, persistent campaigns; emulations are usually partial and constrained.
  6. Defensive focus should be “detect to disrupt” by breaking the attack chain early.
  7. Early or mid-chain detection can outperform noisy reconnaissance detection in outcomes.
  8. Isolated atomic events lack context; patterns reveal malicious intent and progression.
  9. High-fidelity TTPs like LSASS dumping and persistence provide reliable intervention points.
  10. Over-alerting to catch everything increases false positives and reduces analyst effectiveness.

TAKEAWAYS:

  1. Measure success by stopping attacker objectives, not by maximizing alert counts.
  2. Prioritize chokepoints and intent-rich techniques that reliably indicate malicious progression.
  3. Treat pentests and red teams as validation inputs, not comprehensive real-threat replicas.
  4. Use contextual correlation to distinguish benign activity from adversary behavior patterns.
  5. Expand coverage thoughtfully to scale, avoiding alert floodgates that bury true threats.

The Alert Firehose Finally Meets Its Match

Source: The Hacker News

Author: info@thehackernews.com (The Hacker News)

URL: https://thehackernews.com/2026/05/the-alert-firehose-finally-meets-its.html

ONE SENTENCE SUMMARY:

Agentic AI-enhanced NDR converts high-volume network telemetry into correlated, prioritized detections, reducing false positives and accelerating SOC response.

MAIN POINTS:

  1. Legacy NDR earned a “noisy” reputation from raw visibility and SIEM-overloading alerts.
  2. Manual tuning demands during deployment often determined whether NDR became actionable or overwhelming.
  3. Agentic AI autonomously gathers context, triages alerts, and correlates evidence across events.
  4. High data volume shifts from burden to advantage when AI can analyze thousands of signals.
  5. Correlation links low-severity activities into threat narratives humans typically miss.
  6. AI produces prioritized detections with supporting network evidence for immediate analyst context.
  7. Automation reduces dependency on extensive manual tuning by learning detection improvements.
  8. Example scenario: hundreds of anomalies collapse into four actionable detections after AI triage.
  9. Effective operations still require baselining, ongoing tuning, and SOC workflow integration.
  10. Data quality drives AI security outcomes more than model choice, improving accuracy and findings.

TAKEAWAYS:

  1. Reputational “noise” issues reflect earlier operational realities, not modern AI-enabled NDR performance.
  2. Correlation at scale is the differentiator that turns telemetry into actionable threat stories.
  3. Maintaining an updated baseline prevents environmental changes from becoming false-positive generators.
  4. Feeding other SOC tools with pre-correlated NDR outputs reduces downstream alert fatigue.
  5. Success depends on deployment discipline plus high-fidelity network data powering AI-driven analysis.

FBI warns of Kali Oauth stealers

Source: FBI warns of Kali Oauth stealers | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4176464/fbi-warns-of-kali-oauth-stealers.html

ONE SENTENCE SUMMARY:

FBI warns Kali365 phishing steals Microsoft 365 OAuth tokens, bypasses MFA via device authorization, urging conditional access blocks and transfer restrictions.

MAIN POINTS:

  1. FBI alerted organizations about a new Kali365-enabled phishing wave targeting Microsoft 365 accounts.
  2. Kali365 captures OAuth access tokens rather than stealing usernames or passwords.
  3. Bypassing multi-factor authentication occurs because valid tokens authenticate without credential interception.
  4. Attackers impersonate trusted cloud document-sharing services in convincing phishing emails.
  5. Victims are instructed to enter a specific code on a legitimate Microsoft website.
  6. Entered code authorizes the attacker’s device to access the victim’s Microsoft account.
  7. Mitigation includes conditional access policies blocking device code flow for most users.
  8. Exceptions should be narrowly granted only for essential business processes needing code flow.
  9. Blocking authentication transfer policies prevents rights handoff from corporate PCs to mobile devices.
  10. World Economic Forum data shows phishing is CEOs’ top concern and growing across organizations.

TAKEAWAYS:

  1. Token-based phishing can defeat MFA without ever capturing user credentials.
  2. Legitimate login pages don’t guarantee safety when attackers abuse device authorization workflows.
  3. Conditional access controls are central to reducing exposure to device code phishing.
  4. Preventing authentication transfers limits attackers’ ability to persist across devices.
  5. Rising phishing volume makes rapid policy hardening and user awareness critical.

Critical vulnerability in Cisco Secure Workload rated at maximum severity

Source: Critical vulnerability in Cisco Secure Workload rated at maximum severity | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4175913/critical-vulnerability-in-cisco-secure-workload-rated-at-maximum-severity.html

ONE SENTENCE SUMMARY:

Cisco Secure Workload on-prem has a CVSS 10 auth-bypass REST API flaw granting site-admin control, requiring immediate patching.

MAIN POINTS:

  1. Vulnerability enables attackers to gain site admin privileges and compromise endpoints.
  2. Cisco Secure Workload controls zero trust, micro-segmentation, and network visibility across enterprises.
  3. Threat actors likely will scan aggressively for exposed, unpatched internal API endpoints.
  4. Site-admin access could modify or dismantle security policies, opening previously restricted pathways.
  5. Multi-tenant deployments face cross-tenant impact, expanding potential exposure across business units or customers.
  6. CVE-2026-20223 has CVSS 10.0, allowing unauthenticated remote authentication bypass.
  7. Crafted HTTP requests to internal REST APIs instantly confer site admin privileges.
  8. Root cause is insufficient validation and authentication on REST API endpoint access.
  9. No workarounds exist; only software updates remediate the issue.
  10. SaaS is already patched, while on-prem customers must upgrade to fixed releases.

TAKEAWAYS:

  1. Prioritize emergency patching for on-prem Secure Workload as if responding to an active incident.
  2. Upgrade targets: 4.0→4.0.3.17, 3.10→3.10.8.3, 3.9 and earlier→migrate forward.
  3. Focus assessment on internal REST API exposure rather than the web management interface.
  4. Treat multi-tenant environments as higher-risk due to potential cross-tenant “blast radius.”
  5. Verify patch status promptly despite no known exploitation reported at disclosure time.

Microsoft patches two zero-day flaws in Defender

Source: Microsoft patches two zero-day flaws in Defender | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4175970/microsoft-patches-two-zero-day-flaws-in-defender.html

ONE SENTENCE SUMMARY:

Microsoft patched two exploited Microsoft Defender zero-days enabling privilege escalation or protection disruption, urging updates to specific engine/platform versions.

MAIN POINTS:

  1. Emergency fixes address two zero-day flaws in Microsoft Defender malware protection components.
  2. Local attackers can obtain SYSTEM privileges or break antimalware service functionality.
  3. Either outcome helps malware evade detection and increases attacker control.
  4. CISA added CVE-2026-41091 and CVE-2026-45498 to the KEV catalog.
  5. Inclusion in KEV indicates exploitation was observed in the wild.
  6. Researchers link issues to RedSun and UnDefend GitHub exploits by “Nightmare Eclipse.”
  7. CVE-2026-41091 resides in mpengine.dll within the Microsoft Malware Protection Engine.
  8. Improper link resolution before file access underlies CVE-2026-41091; CVSS 7.8 high severity.
  9. CVE-2026-45498 affects MsMpEng.exe, central to real-time monitoring with kernel drivers.
  10. Recommended minimum versions: MPE 1.1.26040.8+ and platform 4.18.26040.7+.

TAKEAWAYS:

  1. Rapid patching is critical because active exploitation against endpoints has been detected.
  2. Verifying component versions matters since platform binaries update less frequently than signatures.
  3. Endpoint fleets using Defender or related products share exposure due to common code components.
  4. Local privilege escalation plus defense disruption creates a powerful combination for malware operations.
  5. Deploying the engine update also remediates an additional RCE, CVE-2026-45584.

Microsoft shares mitigation for YellowKey Windows zero-day

Source: BleepingComputer

Author: Sergiu Gatlan

URL: https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-mitigation-for-yellowkey-windows-zero-day/

ONE SENTENCE SUMMARY:

Microsoft issued mitigations for YellowKey BitLocker zero-day, detailing registry, WinRE, and TPM+PIN changes to reduce exploitation risk.

MAIN POINTS:

  1. YellowKey is a Windows BitLocker zero-day enabling access to protected drives.
  2. Anonymous researcher “Nightmare Eclipse” disclosed it and released a proof-of-concept exploit.
  3. Exploitation uses crafted FsTx files on USB/EFI, booting into WinRE.
  4. Holding CTRL reportedly triggers an unrestricted shell against BitLocker-protected volumes.
  5. Microsoft tracks YellowKey as CVE-2026-45585 and published interim mitigations.
  6. Guidance includes removing autofstx.exe from Session Manager BootExecute registry value.
  7. Mitigation requires reestablishing BitLocker trust for WinRE using CVE-2026-33825 procedures.
  8. Analyst explanation: blocking autofstx.exe stops NTFS replay deleting winpeshl.ini.
  9. Microsoft recommends switching encrypted devices from TPM-only to TPM+PIN pre-boot authentication.
  10. For unencrypted devices, enforce additional startup authentication via Intune/Group Policy settings.

TAKEAWAYS:

  1. Treat WinRE and boot-time paths as critical attack surfaces for BitLocker bypasses.
  2. Implement registry and WinRE trust hardening immediately while awaiting a security update.
  3. Enforcing TPM+PIN materially raises the bar against pre-boot local bypass techniques.
  4. Public PoCs increase likelihood of real-world exploitation, demanding rapid configuration changes.
  5. Validate security controls beyond pentest “reachability,” including detection and configuration effectiveness.

Inside the 2026 Verizon DBIR: What One Billion Records Revealed About Vulnerability Remediation

Source: Vulnerabilities and Threat Research – Qualys Security Blog

Author: Saeed Abbasi

URL: https://blog.qualys.com/vulnerabilities-threat-research/2026/05/19/inside-the-2026-verizon-dbir-what-one-billion-records-revealed-about-vulnerability-remediation

ONE SENTENCE SUMMARY:

Verizon’s 2026 DBIR shows remediation capacity hitting a human-speed limit as KEV workload explodes, demanding autonomous, machine-speed risk operations.

MAIN POINTS:

  1. Qualys contributed analysis of over one billion anonymized vulnerability remediation records to DBIR.
  2. DBIR uses survival analysis to track KEV remediation over time, not year-end snapshots.
  3. Remediation performance improved across 2022–2024 DBIR cycles at multiple curve milestones.
  4. The 2025 cycle reversed gains: 35% open at Day 28 versus 27% prior.
  5. Long-tail exposure hardened at 9%, equating to roughly 47 million lingering instances.
  6. Median detection-to-closure stayed at nine days, indicating defender effort didn’t decline.
  7. KEV-linked instances increased 7.7x in four years, from 68.7M to 527.3M.
  8. Day-28 open backlog surged from 31M to 184M instances, overwhelming built capacity.
  9. Top performers patch before KEV listing using risk prioritization and threat-context scoring.
  10. Proposed solution shifts to autonomous remediation via machine-speed “Risk Operations Center” pipelines.

TAKEAWAYS:

  1. Measuring vulnerability lifecycles with survival curves reveals systemic backlog dynamics obscured by snapshots.
  2. Scaling volume, not weaker execution, is driving defenders behind despite stable closure speed.
  3. Proactive remediation improved in output but fell in rate because workload grew faster.
  4. Human-gated remediation appears capped by a practical “speed of light” limit.
  5. Closing the structural gap requires architectural automation, not incremental staffing or tooling.

Cybercrime service disrupted for abusing Microsoft platform to sign malware

Source: BleepingComputer

Author: Lawrence Abrams

URL: https://www.bleepingcomputer.com/news/security/cybercrime-service-disrupted-for-abusing-microsoft-platform-to-sign-malware/

ONE SENTENCE SUMMARY:

Microsoft disrupted Fox Tempest’s malware-signing service abusing Azure Artifact Signing, revoking certificates, seizing infrastructure, and aiding ransomware campaigns worldwide operations.

MAIN POINTS:

  1. Azure Artifact Signing lets developers obtain Microsoft-backed signatures for released software.
  2. Fox Tempest exploited the service to issue short-lived code-signing certificates for malware.
  3. Over 1,000 certificates and hundreds of Azure tenants/subscriptions supported the MSaaS business.
  4. A U.S. Southern District of New York lawsuit underpinned the disruption action.
  5. Microsoft seized signspace[.]cloud, blocked hosting, and took hundreds of related VMs offline.
  6. Signed binaries impersonated Teams, AnyDesk, PuTTY, and Webex to appear legitimate.
  7. Oyster loaders installed signed malware that enabled Rhysida ransomware deployment on victims.
  8. Threat actors including Vanilla Tempest, Storm-0501, Storm-2561, and Storm-0249 used the service.
  9. Operators likely used stolen U.S./Canada identities to pass Artifact Signing verification.
  10. Telegram marketing offered access for 5,000–9,000 USD-equivalent bitcoin, generating millions in profit.

TAKEAWAYS:

  1. Code-signing trust can be operationalized as a criminal “service” when onboarding controls are bypassed.
  2. Short validity certificates still meaningfully increase malware success by suppressing OS and user suspicion.
  3. Rapid revocation and infrastructure takedowns reduce blast radius, but abuse can scale quickly in cloud ecosystems.
  4. Defenders should treat “signed” as a signal, not proof of safety, and validate publisher reputation.
  5. Cross-industry coordination plus legal action can effectively dismantle enabling platforms for ransomware affiliates.

Varonis: The Platform Advantage for Security

Source: Varonis Blog

Author: efeldman@varonis.com (Eugene Feldman)

URL: https://www.varonis.com/blog/platform-advantage

ONE SENTENCE SUMMARY:

Varonis argues unified data, AI, and email security platform reduces risk, stops cross-system attacks, and lowers costs versus siloed tools.

MAIN POINTS:

  1. Board-level data security is essential to sustain AI initiatives, innovation, and competitive advantage.
  2. Stitched-together point tools are costly, inefficient, and ineffective against modern multi-system attacks.
  3. Varonis offers one platform spanning data security, AI security, and email security capabilities.
  4. DSPM continuously finds sensitive data, access permissions, and usage across the data estate.
  5. DAM provides agentless database threat and policy-violation monitoring with fast deployment.
  6. DAG enforces least-privilege at scale to reduce overprivileged, exploitable access.
  7. DLP and DDR prevent exfiltration and detect ransomware/insiders using behavioral baselines.
  8. AI SPM, runtime guardrails, and AI governance secure agents/models, prompts, and compliance evidence.
  9. Email Social Engineering Defense blocks phishing/BEC and ties attempts to recipient blast radius.
  10. Unified telemetry, identity graph, and automated remediation improve outcomes and reduce MTTR and TCO.

TAKEAWAYS:

  1. Consolidating security into a single platform improves cross-domain visibility and actionable context.
  2. Correlation across SaaS, cloud, databases, and identities is critical for detecting OAuth abuse.
  3. Preventing AI-driven data exposure requires native sensitivity and permission awareness.
  4. Automated containment actions can minimize blast radius while supporting rollback and dependency checks.
  5. Replacing 5–8 tools can cut integration debt, analyst workload, and compliance reporting effort.

19 Cloud Security Challenges and How to Mitigate Risk | Huntress

Source: Huntress Blog

Author: unknown

URL: https://www.huntress.com/blog/cloud-security-challenges

ONE SENTENCE SUMMARY:

Modern businesses face cloud security challenges—misconfigurations, identity risks, data exposure, compliance gaps, and shared responsibility—impacting employees and operations daily significantly.

MAIN POINTS:

  1. Misconfigured storage, networks, and permissions are leading causes of cloud breaches.
  2. Weak identity and access management enables account takeover and privilege escalation.
  3. Insufficient visibility across multi-cloud and SaaS environments hampers threat detection.
  4. Data leakage occurs through insecure APIs, exposed secrets, and improper sharing.
  5. Compliance requirements demand continuous controls, logging, and evidence for audits.
  6. Shared responsibility confusion leaves gaps between provider controls and customer obligations.
  7. Insecure endpoints and remote work devices expand attack surface into cloud resources.
  8. Supply-chain and third-party integrations introduce vulnerabilities and risky permissions.
  9. Ransomware and destructive attacks target cloud backups, snapshots, and management consoles.
  10. Cost and speed pressures can bypass security reviews, increasing technical debt.

TAKEAWAYS:

  1. Prioritize strong IAM: MFA, least privilege, conditional access, and periodic access reviews.
  2. Automate configuration management with guardrails, policy-as-code, and continuous monitoring.
  3. Encrypt sensitive data in transit and at rest; manage keys and secrets securely.
  4. Train employees on phishing, safe sharing, and reporting incidents promptly.
  5. Establish incident response and backup strategies aligned to shared responsibility and compliance.

Why the best security investment a board can make in 2026 isn’t another tool

Source: Why the best security investment a board can make in 2026 isn’t another tool | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4171883/why-the-best-security-investment-a-board-can-make-in-2026-isnt-another-tool.html

ONE SENTENCE SUMMARY:

Security programs overinvest in tools while lacking unified visibility, leaving credential and system relationship blind spots attackers exploit.

MAIN POINTS:

  1. Boardroom cycles repeatedly approve new tools without closing underlying security gaps.
  2. Enterprises struggle answering basic questions about assets, access, and current activity.
  3. Risk reduction depends more on visibility than detection, prevention, or response tools.
  4. Tool stacks lack unified coverage mapping, creating dangerous unmonitored seams.
  5. Attackers exploit legitimate credentials and trust relationships to move between tool boundaries.
  6. Incident reconstruction often takes days because information exists but isn’t connected.
  7. Security marketing confuses data volume with true visibility and fast, trusted answers.
  8. Effective visibility requires pre-incident understanding of assets and cross-system relationships.
  9. Machine credentials now outnumber tracked assets, often unreviewed and unmonitored.
  10. Boards should prioritize inventory, gap ownership, and rapid end-to-end tracing over new tools.

TAKEAWAYS:

  1. Prioritize an accurate, current “map” of the environment before buying additional controls.
  2. Measure security maturity by speed and confidence answering access-and-activity questions.
  3. Treat gaps between tools as explicit risk areas with defined monitoring responsibility.
  4. Inventory and govern service accounts, API keys, integrations, and AI agents aggressively.
  5. Reframe board oversight from “Are we protected?” to “What can we see?”

Upscale vs. Upskill: The Real Cybersecurity Gap

Source: BankInfoSecurity.com RSS Syndication

Author: unknown

URL: https://www.bankinfosecurity.com/blogs/upscale-vs-upskill-real-cybersecurity-gap-p-4119

ONE SENTENCE SUMMARY:

AI is rapidly upscaling enterprise technology, but insufficient upskilling and security mindset create widening gaps, increasing incidents, breaches, and unmet capability.

MAIN POINTS:

  1. Cybersecurity faces a divide between inevitable technology scaling and urgent capability building.
  2. AI embeds across enterprises, expanding attack surfaces regardless of organizational readiness.
  3. Competitive pressure drives AI adoption, often sidelining foundational security principles.
  4. “Need to know” and “need to do” access controls are eroding amid rapid deployments.
  5. Generative AI experimentation frequently outpaces governance, risk evaluation, and data-flow understanding.
  6. Stanford’s 2025 AI Index reports 56.4% incident growth, totaling 233 cases in 2024.
  7. Global cybersecurity workforce gap hit 4.8 million unfilled roles, up 19% year-over-year.
  8. SANS/GIAC found 52% of leaders see skill mismatch, not headcount shortage, as primary issue.
  9. In-demand skills increasingly include communication, collaboration, problem solving, and strategic thinking.
  10. Over 58% of organizations attribute breaches to insufficient skills and poor security awareness.

TAKEAWAYS:

  1. Prioritize capability-building to match AI-driven expansion of tools, platforms, and attack surfaces.
  2. Reinforce least-privilege principles before deploying AI systems and integrating new tools.
  3. Establish governance and risk assessment ahead of generative AI pilots and data sharing.
  4. Develop non-technical competencies to translate technical work into business risk decisions.
  5. Start security mindset formation early and sustain it organization-wide, not role-by-role.

Why patching SLAs should be the floor, not the strategy

Source: CISOs step into the AI spotlight | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4169623/why-patching-slas-should-be-the-floor-not-the-strategy.html

ONE SENTENCE SUMMARY:

Patching SLAs create compliance theater by rewarding easy fixes, while true cyber risk persists in hard-to-remediate legacy, architecture, and control gaps.

MAIN POINTS:

  1. CISOs often recite green SLA metrics while significant unresolved vulnerabilities remain.
  2. Quickly closed criticals are typically inexpensive, low-friction remediation tasks.
  3. Difficult issues linger: legacy systems, architectural flaws, identity misconfigurations, and unsupported platforms.
  4. Governance and reporting overemphasize SLA compliance, masking concentrated high-impact exposures.
  5. SLA performance indicates ticketing discipline, not actual security risk reduction.
  6. Fire-drill analogy: repeated success doesn’t prove resilience against unscripted incidents.
  7. Boards can be misled when the riskiest failures live inside the “small” noncompliant percentage.
  8. Expressing cyber risk in dollar terms changes executive prioritization and funding discussions.
  9. Exception processes often become paperwork, letting exposure disappear from dashboards without mitigation.
  10. Meaningful remediation needs capital/opex investment justified by quantified risk reduction.

TAKEAWAYS:

  1. Reframe SLAs as minimum hygiene requirements, not primary vulnerability program success metrics.
  2. Prioritize trending quantified residual risk by business service over raw closure percentages.
  3. Require risk acceptances to include loss exposure, review cadence, and funded remediation plans.
  4. Use attacker-speed evidence (e.g., DBIR, KEV) to challenge long patch timelines for hard changes.
  5. Accept imprecision in CRQ estimates because actionable dollars beat misleading green scorecards.

Microsoft and Adobe Patch Tuesday, May 2026 Security Update Review

Source: Vulnerabilities and Threat Research – Qualys Security Blog

Author: Diksha Ojha

URL: https://blog.qualys.com/vulnerabilities-threat-research/2026/05/12/microsoft-patch-tuesday-may-2026-security-update-review

ONE SENTENCE SUMMARY:

May 2026 Patch Tuesday fixes 137 Microsoft flaws plus 52 Adobe issues, emphasizing deployment, prioritization, and mitigations to reduce risk.

MAIN POINTS:

  1. Microsoft addressed 137 vulnerabilities: 30 critical and 103 important across its ecosystem.
  2. No publicly disclosed zero-day vulnerabilities were included in this month’s Microsoft fixes.
  3. Edge (Chromium-based) accounted for 128 vulnerabilities, patched earlier in the month.
  4. Updates span Hyper-V, .NET, M365 Copilot, Windows Kernel, RDP, MQ, Azure agents, and more.
  5. High-severity impacts include remote code execution, elevation of privilege, and denial-of-service.
  6. Category totals: 61 EoP, 31 RCE, 15 spoofing, 15 disclosure, 8 DoS, 6 bypass.
  7. Notable critical RCEs affect Word/Office, DNS Client, GDI, Netlogon, SharePoint, and WiFi driver.
  8. Azure and identity-related issues include spoofing, disclosure, SSRF, and privilege escalation paths.
  9. Adobe issued 10 advisories fixing 52 vulnerabilities, including 27 critical across creative products.
  10. Qualys guidance provides VMDR detection QQLs, one-click patching via QIDs, and TruRisk mitigations.

TAKEAWAYS:

  1. Prioritize patching RCE and SYSTEM-level EoP bugs to minimize compromise likelihood.
  2. Protect domain controllers by urgently addressing Windows Netlogon network-reachable overflow risk.
  3. Reduce document-based attack surface by accelerating Office/Word updates across endpoints and servers.
  4. Treat Azure, Entra ID, and Copilot-related fixes as critical for cloud identity and data exposure.
  5. When patching is delayed, apply compensating controls and mitigations to immediately lower risk.

AI Agent Security Starts with Scope Control

Source: Cloud Security Alliance

Author: unknown

URL: https://cloudsecurityalliance.org/blog/2026/05/12/ai-agent-security-starts-with-scope-control

ONE SENTENCE SUMMARY:

Enterprise AI agents increasingly cause operational scope violations, demanding runtime behavioral security controls, visibility, ownership, and traceability to prevent incidents.

MAIN POINTS:

  1. AI agents are moving from pilots into production across enterprise workflows.
  2. Scope violations occur when agents exceed intended tasks, authority, or access boundaries.
  3. Over-permissioned integrations and ambiguous prompts frequently drive unintended agent actions.
  4. Autonomy, task chaining, and context drift make agent behavior non-deterministic.
  5. Only 8% report agents never exceeding permissions; 53% see occasional overruns.
  6. Behavior becomes the primary security boundary, not just infrastructure or model protection.
  7. Risks mirror classic threats: privilege escalation, data exposure, unauthorized changes, insider-like activity.
  8. Cascading actions across connected systems amplify blast radius from a single mistake.
  9. 47% experienced an agent-related security incident; 58% needed five hours or longer to respond.
  10. Gaps in inventory, identity/ownership, runtime controls, and forensics hinder effective containment.

TAKEAWAYS:

  1. Treat scope violations as expected operational conditions requiring engineered controls.
  2. Establish complete agent discovery and inventory, including shadow AI deployments.
  3. Assign explicit owners and model agents as governed identities with defined permissions.
  4. Implement runtime authorization, least privilege, and Zero Trust-style continuous verification.
  5. Improve audit logging, session recording, and behavioral monitoring to enable faster investigations.

Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools

Source: Unit 42

Author: Stav Setty, Tom Fakterman and Shachar Roitman

URL: https://origin-unit42.paloaltonetworks.com/active-directory-certificate-services-exploitation/

ONE SENTENCE SUMMARY:

AD CS misconfigurations enable stealthy certificate-based privilege escalation and persistence, detectable through correlated telemetry, behavioral analytics, and targeted Windows event monitoring.

MAIN POINTS:

  1. AD CS underpins PKI authentication and encryption but often ships with insecure defaults.
  2. Misconfigured certificate templates can grant unintended, long-lived privileged authentication capabilities.
  3. Adversaries exploit native issuance workflows rather than zero-days or malware.
  4. Under-monitoring and configuration complexity create persistent blind spots for defenders.
  5. Attack lifecycle spans initial access, discovery, exploitation, escalation, lateral movement, and persistence.
  6. ESC1 abuses templates allowing low-privileged enrollment with SAN control and auth EKUs.
  7. Shadow credentials persist by adding attacker keys to msDS-KeyCredentialLink for passwordless access.
  8. PKINIT enables Kerberos ticket requests using certificates, facilitating impersonation and lateral movement.
  9. Tools like Certify, Certipy, Whisker, and PKINITtools industrialize AD CS exploitation.
  10. Detection requires correlating certificate events, LDAP reconnaissance, directory changes, and Kerberos activity.

TAKEAWAYS:

  1. Harden templates by removing broad enrollment rights and disabling ENROLLEE_SUPPLIES_SUBJECT where unnecessary.
  2. Investigate mismatches between requester identity and issued certificate subject as strong abuse indicators.
  3. Monitor Event IDs 4886/4887/4898/5136/4768/4769 plus LDAP client/server query logs.
  4. Treat unusual LDAP enumeration of pKICertificateTemplate and msDS-KeyCredentialLink as early warning.
  5. Combine posture management with behavior-based detection to catch stealthy, certificate-driven persistence.

TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack

Source: The Hacker News

Author: info@thehackernews.com (The Hacker News)

URL: https://thehackernews.com/2026/05/teampcp-compromises-checkmarx-jenkins.html

ONE SENTENCE SUMMARY:

Checkmarx confirmed a tampered Jenkins AST plugin publication, linked to TeamPCP, highlighting repeated supply-chain compromises and likely incomplete remediation.

MAIN POINTS:

  1. Checkmarx acknowledged a modified Jenkins AST plugin appeared in the Jenkins Marketplace.
  2. Users were told to keep versions 2.0.13-829.vc72453fa_1c16 or earlier.
  3. Checkmarx released version 2.0.13-848.v76e89de8a_053 on GitHub and Marketplace.
  4. Incident updates still suggested a new plugin version was being published.
  5. The company did not explain how the malicious version reached the Marketplace.
  6. TeamPCP was identified as the attacker targeting Checkmarx again.
  7. Earlier compromises included KICS Docker image, VS Code extensions, and GitHub Actions workflow.
  8. Bitwarden CLI npm package was briefly compromised to distribute credential-stealing malware.
  9. Researchers reported unauthorized access to the plugin’s GitHub repo and defacement/renaming.
  10. SOCRadar inferred unrotated credentials or an undetected foothold enabled rapid re-entry.

TAKEAWAYS:

  1. Verify Jenkins plugin versions immediately and rollback if beyond the known-safe build.
  2. Supply-chain trust is being exploited to distribute credential stealers through developer tooling.
  3. Secret rotation and credential hygiene appear central to preventing repeated intrusions.
  4. Monitor code repositories for defacement, renames, and unauthorized administrative actions.
  5. Treat rapid repeat incidents as evidence of incomplete remediation or persistent access.