Planning Cloud Security Assessments with Third-Party Tools in Azure Government Cloud
Organizations using Azure Government Cloud struggle to balance automated security assessments with the nuanced architectural requirements of regulated environments. Third‑party compliance tools can scan thousands of resources against NIST, FedRAMP, and CIS benchmarks, delivering speed and broad visibility. However, these tools often overlook government‑specific configurations, leading to gaps between reported compliance and actual security posture. Jeff Christman’s experience with a large federal agency highlights the need for a hybrid approach that combines automation with targeted manual review.
SolarWinds Patches Four Critical Serv-U Flaws Enabling Root Access
SolarWinds has issued patches for four critical Serv‑U vulnerabilities (CVE‑2025‑40538, 40539, 40540, 40541), each scoring 9.1 on the CVSS scale. The flaws—broken access control, two type‑confusion bugs, and an IDOR issue—enable remote code execution that can grant attackers full root...
VMware Aria Operations Flaws Could Enable Remote Attacks
Broadcom released security updates fixing three critical flaws in VMware Aria Operations, including a remote command injection (CVE-2026-22719) with a CVSS score of 8.1, a stored cross‑site scripting issue (CVE-2026-22720) rated 8.0, and a privilege‑escalation bug (CVE-2026-22721) scored 6.2. The...
Peru Begins Campaign to Block Further 100K 'High-Risk' Handsets
Peruvian telecom regulator Osiptel announced a new phase of its anti‑fraud campaign, blocking an additional 100,000 handsets deemed high‑risk. The devices are not listed in the official Renteseg database and are associated with repeated use of invalid or cloned IMEIs....
A Digital Omnibus: Identifying Interlinks and Possible Overlaps Between Different Legal Acts in the Field of Digital Legislation to Streamline...
The European Parliament commissioned a study to dissect the European Commission’s Digital Omnibus package released on 19 November 2025. The report separates administrative simplification from substantive changes to safeguards in data protection, privacy, cybersecurity and artificial intelligence. It flags three hot‑button issues...
Operation MacroMaze: APT28 Exploits Webhooks for Covert Data Exfiltration
Operation MacroMaze, a Russia‑linked APT28 campaign, targeted Western and Central European organizations from September 2025 to January 2026. The attackers embedded an INCLUDEPICTURE field in Word documents that fetched a JPG from webhook.site, creating a covert tracking pixel and confirming document opening....
GyroidOS Virtualization Solution Aims to Secure Embedded Devices, Ease Cybersecurity Certification
GyroidOS, an open‑source multi‑architecture OS‑level virtualization platform maintained by Fraunhofer AISEC, isolates guest operating‑system stacks on a single Linux kernel using namespaces, cgroups and capabilities. The solution targets embedded devices and integrates hardware‑root‑of‑trust features such as secure boot, TPM‑linked disk...
Reliance Global Group Launches Scale51 with Acquisition of Quantum-Resilient Encryption Firm Enquantum
Reliance Global Group announced the acquisition of Enquantum Ltd., marking the first platform investment under its Scale51 operating model. Enquantum brings FPGA‑based, hardware‑accelerated quantum‑resilient encryption, including a 2025 patent for terabit‑scale communications. The deal aligns with a projected $300 billion annual...
Forescout Partners with E-ISAC to Bring Threat Intelligence and Research to North American Utilities
Forescout Technologies has become a vendor affiliate of the North American Electricity Information Sharing and Analysis Center (E‑ISAC), extending its threat‑intelligence sharing to U.S. utilities and grid operators. Through its Vedere Labs research unit, the company will feed cyber and...
Demand UK Digital Sovereignty
The Open Rights Group is urging the UK government to adopt a digital sovereignty strategy that reduces reliance on foreign tech giants such as Amazon, Microsoft, Google and Palantir. It argues that over‑dependence creates strategic fragility, citing the Trump‑ordered shutdown...
UIB to Strengthen Cyber Insurance Capabilities with CyberCube Partnership
United Insurance Brokers Limited (UIB) has partnered with cyber‑risk analytics firm CyberCube to bolster its cyber insurance offering. UIB will deploy CyberCube’s Broking Manager and Prep Module, giving its global practice data‑driven exposure insights. The collaboration targets accelerated growth in...
It Can Be Easier to Fall Victim to Fraud on Mobile than Desktop
Phishing emails that look authentic on a desktop become far harder to spot on mobile devices, increasing the chance of credential theft. The author received a Vanguard‑style phishing message where the sender’s email address was hidden and the link text...
Micrologic Partners with Cohesity to Become the Leading Sovereign Cloud Data Protection Solution in Canada
Micrologic, a Canadian sovereign‑cloud provider, has teamed with AI‑driven data‑security firm Cohesity to launch a fully Canadian‑jurisdictional data‑protection platform. The joint solution combines Micrologic’s Canada‑only cloud infrastructure with Cohesity’s backup, disaster‑recovery and isolated recovery environment technology. It promises recovery speeds...
Internet, Reinvented : Reticulum Networking Bridges Radios, Wi-Fi & Ethernet
Reticulum is an open‑source, decentralized networking protocol that operates without traditional internet infrastructure. It uses cryptographic identity‑based addressing and built‑in encryption to secure traffic across any medium, from LoRa radios to Wi‑Fi and Ethernet. Its hardware‑agnostic design lets users build...
DOJ Increasingly Wielding False Claims Act to Target Cybersecurity Misrepresentations | Law.com
The U.S. Department of Justice is intensifying its use of the False Claims Act to pursue cybersecurity misrepresentations, noting a “significant upward trajectory” in such cases. In the past year, the DOJ secured $52 million through nine FCA settlements involving cyber‑related...
Labour MP Warns UK Exposed to Subsea Cable Threat
Labour MP Graeme Downie warned that the UK is dangerously exposed to disruption of its undersea cable network. He cited the Joint Committee on the National Security Strategy, noting that about 98% of internet traffic travels through these cables, making...
Cybersecurity Is the New Food Safety: How Restaurants Can Protect Their Digital Kitchens
Restaurants are evolving into digital ecosystems, relying on cloud POS, loyalty apps, and third‑party delivery platforms. This shift creates a broader attack surface, making cybersecurity as vital as food safety for protecting brand trust. Leaders are adopting defense‑in‑depth strategies, unified...
UK Government-Backed Cyber Security Programme Alumni Raise £47.4m in Follow-On Investment
Innovate UK’s Cyber Security Academic Startup Accelerator (CyberASAP) alumni have attracted £47.4 million in post‑programme funding over the past nine years, with private capital accounting for 68% of that amount. The accelerator, funded by the Department for Science, Innovation and Technology,...
Don’t Overlook Low-Tech Crime in Healthcare
Healthcare organizations focus on high‑tech defenses, yet physical and procedural gaps remain a major source of breaches. Low‑tech incidents such as tailgating, unattended devices, and badge sharing contributed to over 51 million compromised records in 2022. The article outlines practical controls—including...
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 85
The Security Affairs Malware Newsletter Round 85 aggregates the latest research and incident reports on global malware threats. Highlights include new Android threats like Ninja Browser, Lumma Infostealer, PromptSpy and Phantom Trojans, a surge in ATM jackpotting across the U.S., and...
Things Are Getting Wild: Re-Tool Everything for Speed
The author warns that AI is reshaping cybersecurity, creating a tidal wave of new software‑generated vulnerabilities while simultaneously giving attackers tools to industrialize exploits. Simultaneously, AI‑generated content erodes trust, making authenticity a critical challenge. Enterprises must build a robust agentic...
U.S. CISA Adds RoundCube Webmail Flaws to Its Known Exploited Vulnerabilities Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical RoundCube Webmail vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The flaws—CVE-2025-49113, a deserialization bug with a 9.9 CVSS score, and CVE-2025-68461, an SVG‑based XSS issue scoring 7.2—target...
WordPress, AI, Plugins, Future of Software Engineering
The post outlines how AI is reshaping the WordPress ecosystem, from a flood of AI‑generated plugins that introduce new security risks to the need for large‑scale audit infrastructure. It advises agencies to pivot from billable hours to outcome‑based pricing, leveraging...
Update: rtfdump.py Version 0.0.15
Didier Stevens announced on 21 February 2026 the release of rtfdump.py version 0.0.15. The update specifically fixes a bug in the –yarastrings option, restoring reliable extraction of YARA strings from RTF files. The release package is available for download and...
Texas Sues Temu for Allegedly Functioning as Chinese Spyware
Texas Attorney General Ken Paxton sued Temu, alleging the discount marketplace operates as Chinese Communist spyware that harvests user data for the Chinese government. The lawsuit targets PDD Holdings, accusing it of deceptive marketing and seeking substantial civil penalties. It...
Check Point Software Earns Leader & Fast Mover Position in GigaOm Radar for Cloud Network Security
Check Point Software has been named a Leader and Fast Mover in the GigaOm Radar for Cloud Network Security 2025, marking its third consecutive year at the top. GigaOm highlighted the company’s prevention‑first Infinity architecture, unified cloud security platform, and...
Q&A: Organisations Are Spending Millions on Cybersecurity and Still Getting It Wrong
Organizations are pouring billions into cybersecurity yet continue to suffer breaches because they treat security as a purely technical issue. Senior cyber leader Purvi Kay argues that weak governance, poor communication, and unclear accountability are the primary failures. She emphasizes...
Firewalla Orange Review: A Pocket-Sized Firewall That Followed Me to Tokyo
The Firewalla Orange is a 244‑gram, pocket‑sized firewall that turns any untrusted Wi‑Fi into a protected network in about ten minutes. In real‑world tests it delivered 1.72 Gbps wired throughput and 151 Mbps hotel Wi‑Fi speed while applying IPS, ad‑blocking and VPN...
AI Risk Tool
AI Risk tool, a browser‑only privacy layer, anonymises sensitive data before it reaches any generative AI model. The solution runs entirely client‑side, ensuring no text is transmitted, stored, or tracked on external servers. By eliminating the need for accounts, it...
How to Back Up Your WordPress Website Effectively
Law firms rely on WordPress sites for client intake, branding, and confidential communications, making website continuity critical. The article outlines a practical backup strategy, recommending daily off‑site backups using plugins such as UpdraftPlus, BackupBuddy or BlogVault, and storing copies in...
Auto Draft
Veteran CISOs are urged to abandon technical dashboards and become business risk leaders who speak the board’s language. By translating security concepts into revenue‑impact terms, aligning initiatives with corporate growth plans, and quantifying cyber risk in monetary values, they secure...
Best Western Nordic Hit By Data Breach: Cybercriminals Targeting Guests Via WhatsApp & SMS
Best Western hotels in Sweden, Denmark and Norway suffered a data breach that exposed guest names, check‑in dates, email addresses and phone numbers. Cybercriminals are now using the stolen details to launch phishing attacks via WhatsApp and SMS, directing victims...
Markel Expands Cybersecurity Support for Policyholders Through Upfort Partnership
Markel announced a partnership with cyber‑security firm Upfort to extend AI‑driven protection tools to eligible U.S. cyber‑insurance policyholders. The collaboration introduces the Upfort Shield platform and an endpoint detection and response (EDR) solution with behavioural analytics. Markel says the offering...
CISA Alerts to Critical Auth Bypass CVE-2026-1670 in Honeywell CCTVs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert for a critical authentication‑bypass vulnerability (CVE‑2026‑1670) in several Honeywell CCTV models, receiving a CVSS score of 9.8. The flaw lets unauthenticated attackers change the recovery email address, enabling...
Cyber Risk Management In Remote-First Environments
Executive-led cyber risk management has shifted from traditional IT‑centric frameworks to a leadership‑first model that aligns digital hygiene with corporate governance. In remote‑first environments, the loss of a centralized perimeter expands the attack surface, making every executive login a potential...
Smashing Security Podcast #455: Face Off: Meta’s Glasses and America’s Internet Kill Switch
In episode 455 of the Smashing Security podcast, host Graham Cluley and journalist James Ball examine the growing threat of tech sovereignty, questioning whether the United States could effectively shut down Europe’s internet by leveraging Gmail, cloud services, and critical infrastructure. They also...
Josh Aaron: The Hidden Technology Risk Law Firms Can No Longer Treat as Background Noise
Law firms are increasingly confronted with demanding security questionnaires from Fortune 500 clients, requiring verifiable endpoint protection within tight deadlines. Many firms still rely on manual or semi‑automated processes, leaving gaps in device visibility and patch compliance. This lack of...
French Ministry Confirms Data Access to 1.2 Million Bank Accounts
The French Economy Ministry disclosed that a hacker used stolen government credentials to view data from 1.2 million bank accounts across the country. The breach, detected in late January, exposed personal details such as names, addresses, account numbers and, in some...
OMB Rescinds the “Common Form” Secure Software Attestation Requirement
On Jan. 23, 2026 the Office of Management and Budget issued Memorandum M‑26‑05, rescinding the Biden‑era mandate that all federal agencies obtain a CISA “Common Form” software attestation. The new memo replaces the one‑size‑fits‑all requirement with a risk‑based, agency‑specific approach while...
Aliro Raises $15M to Advance Physics-Based Network Security
Aliro announced a $15 million oversubscribed funding round led by Gutbrain Ventures, with participation from Cisco Investments, Argon Ventures, and Wonderstone Ventures. The Boston‑based startup is commercializing a physics‑based network security platform that uses quantum entanglement to replace cryptographic assumptions with...
Actionstep Completes SOC 2® Type 2 Examination, Reinforcing Commitment to Law Firm Security
Actionstep, a cloud‑based practice‑management platform used by nearly 5,000 law firms, announced completion of its SOC 2 Type 2 examination conducted by Prescient Assurance. The audit evaluated both the design and operating effectiveness of the company’s security controls over a defined period, providing...
EFF to Wisconsin Legislature: VPN Bans Are Still a Terrible Idea
The Electronic Frontier Foundation (EFF) has sent a letter to Wisconsin’s entire legislature urging a vote against S.B. 130 and A.B. 105, bills that would ban VPN use and impose invasive age‑verification on certain websites. The measures have cleared the...
Waymo Overseas Human Assist Wasn't Secret, But Is It Secure?
Waymo disclosed that a single remote‑assist operator supports roughly 40 autonomous vehicles, a ratio that underscores its reliance on human fallback. The company confirmed that many of these operators are based overseas, a fact previously hinted at but not widely...
CredShields Leads OWASP Smart Contract Top 10 2026 as Governance and Access Failures Drive Onchain Risk
In this episode, CredShields announces the release of the OWASP Smart Contract Top 10 2026, a risk prioritization framework built from a structured analysis of 2025 smart contract incidents that caused hundreds of millions in losses. The discussion highlights that governance and...
Poorly Crafted Phishing Campaign Leverages Bogus Security Incident Report
A phishing campaign leveraged a fake PDF security incident report hosted on Amazon S3 to intimidate MetaMask users into enabling two‑factor authentication. The PDF, created with ReportLab, contains no malicious code but mimics an official security alert. Researchers noted the...
Side-Channel Attacks Against LLMs
Recent research uncovers multiple side‑channel attacks that exploit timing, packet‑size, and speculative decoding characteristics of large language model (LLM) services. By monitoring encrypted network traffic, attackers can infer conversation topics with over 90 % precision, fingerprint specific prompts with up to...
Sovereignty-First ITSM: How Geopolitical Risk Is Reshaping Service Management in 2026
In 2026 enterprises are treating data location as a strategic risk rather than a compliance checkbox, prompting a shift toward sovereignty‑first IT service management (ITSM). Traditional cloud‑based ITSM platforms that store data in foreign jurisdictions expose organizations to sudden geopolitical...
Encrypted RCS Messaging Support Lands in Apple’s iOS 26.4 Developer Build
Apple introduced end‑to‑end encrypted Rich Communication Services (RCS) messaging in the iOS 26.4 developer beta, extending the feature to iPadOS, macOS and watchOS in future updates. The encryption is currently limited to iPhone‑to‑iPhone conversations and depends on carrier support, with a...
Strengthening Your Legal Practice Against Downtime
South African law firms face steep financial and reputational losses from IT downtime, with a single hour costing an average R360,000 for a 20‑person practice and up to R6.5 million for larger firms. The article distinguishes disaster recovery (DR) from simple...
Crypto-Procrastination: The Dangerous Delay in Preparing for Post-Quantum Data Security
A Citi Institute report warns that a quantum‑enabled cyberattack on a top U.S. bank could jeopardize $2‑3.3 trillion of GDP, turning quantum computing from theory into an operational emergency. The article highlights the “harvest now, decrypt later” (HNDL) threat, where adversaries...