The Latest

• 

  AI-fueled cybercrime may outpace traditional defenses, Check Point warns

  The security firm said in a new report that defenders should begin using AI to counter cyber criminals’ adoption of the technology.

  Vulnerability

• 

  Critical vulnerability in SAP NetWeaver Visual Composer leads to confirmed compromises

  Thousands are exposed and potentially vulnerable as researchers warn of widespread exploitation.   

  Updated April 30, 2025

  Vulnerability

• 

  Cyber experts urge Trump to abandon Chris Krebs investigation

  Dozens of cyber industry luminaries, many from the election security community, said the investigation could discourage important cyber work.

  Leadership & Careers

• 

  Zero-day exploitation drops slightly from last year, Google report finds

  Google’s threat intelligence team said software vendor security practices are making it harder for hackers to find flaws in some platforms.

  Breaches

• 

  JPMorgan Chase CISO warns software industry on supply chain security

  In an open letter, Patrick Opet said third-party vendors need to embrace secure development practices over speed to market. 

  Strategy

• 

  FBI seeks public tips about Salt Typhoon

  The bureau’s public alert follows months of conversations with the telecom industry about the far-reaching cyber espionage campaign by a Chinese nation-state threat actor.

  Breaches

• 

  Critical vulnerability in SAP NetWeaver under threat of active exploitation

  Attackers have been observed dropping webshell backdoors and researchers warn the application is popular among government agencies.

  Updated April 25, 2025

  Vulnerability

• 

  CISA gets a deputy director as it braces for major layoffs

  Madhu Gottumukkala, a state CIO, lacks the homeland security experience of his two predecessors.

  Leadership & Careers

• 

  Threat groups exploit resurgent vulnerabilities

  VPNs, routers and firewalls are being targeted via older CVEs, new GreyNoise research shows.

  Vulnerability

• 

  CISOs band together to urge world governments to harmonize cyber rules

  Policymakers have moved slowly to reduce regulatory overlap, but the new industry plea could help change that.

  Leadership & Careers

• 

  State Department reorganization could imperil cyber diplomacy

  Congress told the U.S. State Department how to approach global cyber challenges, but the administration’s plan would upend that strategy.

  Policy & Regulation

• 

  BEC scams, investment fraud accounted for biggest cybercrime losses in 2024

  Americans lost $16.6 billion to cyber fraud last year, according to an FBI report, with phishing, spoofing and extortion topping the list of complaints.

  Breaches

• 

  Financial gain still drives majority of cyber threat activity

  Stolen credentials are becoming a more prevalent form of initial access, a report from Mandiant shows.

  Strategy

• 

  AI impact on data breach outcomes remains ‘limited’: Verizon

  While AI-generated text in malicious emails has doubled, the rate of successful phishing breaches is stable.

  Strategy

• 

  CISA’s Secure by Design initiative in limbo after key leaders resign

  Companies have been urging CISA to scale back its software security pressure campaign. Two new resignations from the agency could accelerate that shift.

  Leadership & Careers

• 

  Conduent warns January breach impacted a ‘significant’ number of people

  The company incurred a material amount of nonrecurring expenses during Q1 related to potential notification requirements.

  Breaches

• 

  Banks gear up to boost cybersecurity, cloud and data spending

  In the race to scale generative AI capabilities, executives plan to increase foundational technology investments, according to Broadridge.

  Strategy

• 

  Microsoft strengthens in-house cyber governance, training

  The technology giant, as part of its Secure Future Initiative program, has overhauled security practices following a series of crippling nation-state-linked cyberattacks.

  Strategy

• 

  Researchers warn of critical flaw found in Erlang OTP SSH

  The CVE could allow unauthenticated attackers to gain full access to a device. Many of these devices are widely used in IoT and telecom platforms.

  Vulnerability

• 

  Opinion

  Gartner: How to build a secure enterprise cloud environment

  There are plenty of frameworks, tools and strategies to help map out a risk-resilient cloud infrastructure.

  Strategy

• 

  Ahold Delhaize confirms data stolen after threat group claims credit for November attack

  A highly active threat group says it will release stolen information, months after an attack disrupted e-commerce operations at the grocer’s U.S. business.

  Breaches

• 

  Lemonade says applicant driver’s license numbers exposed

  The company is notifying about 190,000 people after certain information used for car insurance quotes was left unencrypted.

  Breaches

• 

  CISA warns companies to secure credentials amid Oracle Cloud breach claims

  The agency is asking organizations to come forward if they detect suspicious activity or other evidence of a compromise.

  Breaches

• 

  Older SonicWall SMA100 vulnerability exploited in the wild

  CISA added the high-severity flaw, initially disclosed in 2021, to its known exploited vulnerabilities catalog this week.

  Vulnerability

• 

  Bill extends cyber threat info-sharing between public, private sector

  The Cybersecurity Information Sharing Act of 2015, set to expire in September, “moved the needle.”

  Threats

More stories