
Joe Weiss argues that network‑focused breach statistics, such as those in the 2025 Verizon Data Breach Report, do not capture the reality of control‑system cyber incidents. While IT and OT network teams track data loss, ransomware and malicious traffic, control‑system teams monitor physical impacts like equipment damage, environmental harm and safety threats. The two data sets are fundamentally incomparable—"apples and oranges"—because the definition of a cyber incident differs across domains. Weiss calls for a shared incident taxonomy and dedicated OT‑cyber training to bridge the gap.

Forescout Technologies and Netskope announced a strategic integration that unifies Zero Trust security across managed and unmanaged devices, including IT, OT, IoT, and IoMT assets. The solution merges Forescout’s real‑time device intelligence with Netskope’s AI‑driven cloud security to enforce consistent...

Black Duck's 2026 Open Source Security and Risk Analysis report finds open source vulnerabilities in commercial codebases have more than doubled year‑on‑year. The average application now contains 581 vulnerabilities, a 107% increase, with 98% of codebases using open source components....
FedRAMP, the federal cloud security authorization program, is becoming a critical benchmark for eDiscovery solutions as U.S. courts anticipate over 400,000 lawsuits this year. Legal teams must verify that their cloud‑based discovery tools meet FedRAMP standards to prevent security breaches,...

Caspia Technologies announced the general availability of CODAx V2026.1, an AI‑enhanced RTL security analyzer that checks over 150 insecure coding practices against more than 1,000 hardware vulnerability references. The tool can scan half‑million lines of RTL in under an hour,...

Dr Valerie Lyons, BH Consulting’s COO, will present at RSA 2026, focusing on the human‑rights‑centric "Dignity by Design" concept, after beating a 90% rejection rate. The European Commission unveiled a revamped Cybersecurity Act aimed at tightening ICT supply‑chain security and...

Ring’s new “Search Party” AI feature sparked privacy outrage after a Super Bowl ad, prompting a backlash against the company’s data‑sharing practices. In response, the nonprofit Fulu Foundation announced a $10,000 bounty for anyone who can modify Ring doorbells to...

DNSSEC adoption remains modest, with only 36 % of resolvers validating and 7 % of domains securely delegated in 2025, hampered by complex enrollment and manual key‑rollovers. Automation using authenticated CDS/CDNSKEY records can eliminate these hurdles, and several European ccTLDs have already...
Organizations using Azure Government Cloud struggle to balance automated security assessments with the nuanced architectural requirements of regulated environments. Third‑party compliance tools can scan thousands of resources against NIST, FedRAMP, and CIS benchmarks, delivering speed and broad visibility. However, these...

SolarWinds has issued patches for four critical Serv‑U vulnerabilities (CVE‑2025‑40538, 40539, 40540, 40541), each scoring 9.1 on the CVSS scale. The flaws—broken access control, two type‑confusion bugs, and an IDOR issue—enable remote code execution that can grant attackers full root...

Broadcom released security updates fixing three critical flaws in VMware Aria Operations, including a remote command injection (CVE-2026-22719) with a CVSS score of 8.1, a stored cross‑site scripting issue (CVE-2026-22720) rated 8.0, and a privilege‑escalation bug (CVE-2026-22721) scored 6.2. The...

Peruvian telecom regulator Osiptel announced a new phase of its anti‑fraud campaign, blocking an additional 100,000 handsets deemed high‑risk. The devices are not listed in the official Renteseg database and are associated with repeated use of invalid or cloned IMEIs....
The European Parliament commissioned a study to dissect the European Commission’s Digital Omnibus package released on 19 November 2025. The report separates administrative simplification from substantive changes to safeguards in data protection, privacy, cybersecurity and artificial intelligence. It flags three hot‑button issues...

Operation MacroMaze, a Russia‑linked APT28 campaign, targeted Western and Central European organizations from September 2025 to January 2026. The attackers embedded an INCLUDEPICTURE field in Word documents that fetched a JPG from webhook.site, creating a covert tracking pixel and confirming document opening....

GyroidOS, an open‑source multi‑architecture OS‑level virtualization platform maintained by Fraunhofer AISEC, isolates guest operating‑system stacks on a single Linux kernel using namespaces, cgroups and capabilities. The solution targets embedded devices and integrates hardware‑root‑of‑trust features such as secure boot, TPM‑linked disk...

Reliance Global Group announced the acquisition of Enquantum Ltd., marking the first platform investment under its Scale51 operating model. Enquantum brings FPGA‑based, hardware‑accelerated quantum‑resilient encryption, including a 2025 patent for terabit‑scale communications. The deal aligns with a projected $300 billion annual...

Forescout Technologies has become a vendor affiliate of the North American Electricity Information Sharing and Analysis Center (E‑ISAC), extending its threat‑intelligence sharing to U.S. utilities and grid operators. Through its Vedere Labs research unit, the company will feed cyber and...

The Open Rights Group is urging the UK government to adopt a digital sovereignty strategy that reduces reliance on foreign tech giants such as Amazon, Microsoft, Google and Palantir. It argues that over‑dependence creates strategic fragility, citing the Trump‑ordered shutdown...

United Insurance Brokers Limited (UIB) has partnered with cyber‑risk analytics firm CyberCube to bolster its cyber insurance offering. UIB will deploy CyberCube’s Broking Manager and Prep Module, giving its global practice data‑driven exposure insights. The collaboration targets accelerated growth in...
Phishing emails that look authentic on a desktop become far harder to spot on mobile devices, increasing the chance of credential theft. The author received a Vanguard‑style phishing message where the sender’s email address was hidden and the link text...

Micrologic, a Canadian sovereign‑cloud provider, has teamed with AI‑driven data‑security firm Cohesity to launch a fully Canadian‑jurisdictional data‑protection platform. The joint solution combines Micrologic’s Canada‑only cloud infrastructure with Cohesity’s backup, disaster‑recovery and isolated recovery environment technology. It promises recovery speeds...

Reticulum is an open‑source, decentralized networking protocol that operates without traditional internet infrastructure. It uses cryptographic identity‑based addressing and built‑in encryption to secure traffic across any medium, from LoRa radios to Wi‑Fi and Ethernet. Its hardware‑agnostic design lets users build...
The U.S. Department of Justice is intensifying its use of the False Claims Act to pursue cybersecurity misrepresentations, noting a “significant upward trajectory” in such cases. In the past year, the DOJ secured $52 million through nine FCA settlements involving cyber‑related...

Labour MP Graeme Downie warned that the UK is dangerously exposed to disruption of its undersea cable network. He cited the Joint Committee on the National Security Strategy, noting that about 98% of internet traffic travels through these cables, making...

Restaurants are evolving into digital ecosystems, relying on cloud POS, loyalty apps, and third‑party delivery platforms. This shift creates a broader attack surface, making cybersecurity as vital as food safety for protecting brand trust. Leaders are adopting defense‑in‑depth strategies, unified...

Innovate UK’s Cyber Security Academic Startup Accelerator (CyberASAP) alumni have attracted £47.4 million in post‑programme funding over the past nine years, with private capital accounting for 68% of that amount. The accelerator, funded by the Department for Science, Innovation and Technology,...

Healthcare organizations focus on high‑tech defenses, yet physical and procedural gaps remain a major source of breaches. Low‑tech incidents such as tailgating, unattended devices, and badge sharing contributed to over 51 million compromised records in 2022. The article outlines practical controls—including...

The Security Affairs Malware Newsletter Round 85 aggregates the latest research and incident reports on global malware threats. Highlights include new Android threats like Ninja Browser, Lumma Infostealer, PromptSpy and Phantom Trojans, a surge in ATM jackpotting across the U.S., and...
The author warns that AI is reshaping cybersecurity, creating a tidal wave of new software‑generated vulnerabilities while simultaneously giving attackers tools to industrialize exploits. Simultaneously, AI‑generated content erodes trust, making authenticity a critical challenge. Enterprises must build a robust agentic...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical RoundCube Webmail vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The flaws—CVE-2025-49113, a deserialization bug with a 9.9 CVSS score, and CVE-2025-68461, an SVG‑based XSS issue scoring 7.2—target...
The post outlines how AI is reshaping the WordPress ecosystem, from a flood of AI‑generated plugins that introduce new security risks to the need for large‑scale audit infrastructure. It advises agencies to pivot from billable hours to outcome‑based pricing, leveraging...

Didier Stevens announced on 21 February 2026 the release of rtfdump.py version 0.0.15. The update specifically fixes a bug in the –yarastrings option, restoring reliable extraction of YARA strings from RTF files. The release package is available for download and...

Texas Attorney General Ken Paxton sued Temu, alleging the discount marketplace operates as Chinese Communist spyware that harvests user data for the Chinese government. The lawsuit targets PDD Holdings, accusing it of deceptive marketing and seeking substantial civil penalties. It...

Check Point Software has been named a Leader and Fast Mover in the GigaOm Radar for Cloud Network Security 2025, marking its third consecutive year at the top. GigaOm highlighted the company’s prevention‑first Infinity architecture, unified cloud security platform, and...

Organizations are pouring billions into cybersecurity yet continue to suffer breaches because they treat security as a purely technical issue. Senior cyber leader Purvi Kay argues that weak governance, poor communication, and unclear accountability are the primary failures. She emphasizes...

The Firewalla Orange is a 244‑gram, pocket‑sized firewall that turns any untrusted Wi‑Fi into a protected network in about ten minutes. In real‑world tests it delivered 1.72 Gbps wired throughput and 151 Mbps hotel Wi‑Fi speed while applying IPS, ad‑blocking and VPN...
AI Risk tool, a browser‑only privacy layer, anonymises sensitive data before it reaches any generative AI model. The solution runs entirely client‑side, ensuring no text is transmitted, stored, or tracked on external servers. By eliminating the need for accounts, it...

Law firms rely on WordPress sites for client intake, branding, and confidential communications, making website continuity critical. The article outlines a practical backup strategy, recommending daily off‑site backups using plugins such as UpdraftPlus, BackupBuddy or BlogVault, and storing copies in...
Veteran CISOs are urged to abandon technical dashboards and become business risk leaders who speak the board’s language. By translating security concepts into revenue‑impact terms, aligning initiatives with corporate growth plans, and quantifying cyber risk in monetary values, they secure...
Best Western hotels in Sweden, Denmark and Norway suffered a data breach that exposed guest names, check‑in dates, email addresses and phone numbers. Cybercriminals are now using the stolen details to launch phishing attacks via WhatsApp and SMS, directing victims...

Markel announced a partnership with cyber‑security firm Upfort to extend AI‑driven protection tools to eligible U.S. cyber‑insurance policyholders. The collaboration introduces the Upfort Shield platform and an endpoint detection and response (EDR) solution with behavioural analytics. Markel says the offering...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert for a critical authentication‑bypass vulnerability (CVE‑2026‑1670) in several Honeywell CCTV models, receiving a CVSS score of 9.8. The flaw lets unauthenticated attackers change the recovery email address, enabling...

Executive-led cyber risk management has shifted from traditional IT‑centric frameworks to a leadership‑first model that aligns digital hygiene with corporate governance. In remote‑first environments, the loss of a centralized perimeter expands the attack surface, making every executive login a potential...

In episode 455 of the Smashing Security podcast, host Graham Cluley and journalist James Ball examine the growing threat of tech sovereignty, questioning whether the United States could effectively shut down Europe’s internet by leveraging Gmail, cloud services, and critical infrastructure. They also...
Law firms are increasingly confronted with demanding security questionnaires from Fortune 500 clients, requiring verifiable endpoint protection within tight deadlines. Many firms still rely on manual or semi‑automated processes, leaving gaps in device visibility and patch compliance. This lack of...

The French Economy Ministry disclosed that a hacker used stolen government credentials to view data from 1.2 million bank accounts across the country. The breach, detected in late January, exposed personal details such as names, addresses, account numbers and, in some...

On Jan. 23, 2026 the Office of Management and Budget issued Memorandum M‑26‑05, rescinding the Biden‑era mandate that all federal agencies obtain a CISA “Common Form” software attestation. The new memo replaces the one‑size‑fits‑all requirement with a risk‑based, agency‑specific approach while...
Aliro announced a $15 million oversubscribed funding round led by Gutbrain Ventures, with participation from Cisco Investments, Argon Ventures, and Wonderstone Ventures. The Boston‑based startup is commercializing a physics‑based network security platform that uses quantum entanglement to replace cryptographic assumptions with...

Actionstep, a cloud‑based practice‑management platform used by nearly 5,000 law firms, announced completion of its SOC 2 Type 2 examination conducted by Prescient Assurance. The audit evaluated both the design and operating effectiveness of the company’s security controls over a defined period, providing...

The Electronic Frontier Foundation (EFF) has sent a letter to Wisconsin’s entire legislature urging a vote against S.B. 130 and A.B. 105, bills that would ban VPN use and impose invasive age‑verification on certain websites. The measures have cleared the...