Latest

Governance & Risk Management

The MFA Illusion: Rethinking Identity for Non-Human Agents

Suparna Goswami  •  July 21, 2025

The explosion of agentic AI and autonomous bots to orchestrate cross-system tasks is turning MFA into a brittle defense. Non-human identities often bypass human-centric security controls, operating with static credentials and undefined ownership, creating exploitable identity risks.

Cyberwarfare / Nation-State Attacks

Cyberattacks Surging Across Indo-Pacific, Researchers Warn

Chris Riotta  •  July 21, 2025

A Center for a New American Security study found China and North Korea are accelerating cyberattacks, influence operations and infrastructure breaches across the Indo-Pacific, as researchers urge the U.S. to help develop a regional cyber shield, and deploy forward cyber teams.

Data Security

Hackers Target Zero-Day Vulnerability to Exploit CrushFTP

Mathew J. Schwartz  •  July 21, 2025

Managed file-transfer software developer CrushFTP said a zero-day vulnerability in its tool's web interface is being actively exploited to gain admin-level access to servers. The company urged immediate updating, saying all versions of its software released since July 1 are patched.

Artificial Intelligence & Machine Learning

AI Needs a Firewall and Cloud Needs a Rethink

Rahul Neel Mani  •  July 21, 2025

The cloud was meant to be cheaper, but it's not. A bold new vision is emerging: one that slashes costs, decentralizes AI and secures APIs at the edge. From inference to firewalls, a reimagined internet is challenging hyperscaler dominance.

Access Management

Identity and Access Management (IAM) Market Guide 2025

Dan Verton  •  July 21, 2025

The Identity and Access Management (IAM) Market Guide 2025 provides an essential industry briefing on the evolving identity security ecosystem - offering unparalleled insights into the trends, technologies and market forces reshaping IAM this year.

Cybercrime

Hackers Exploit FIDO MFA With Novel Phishing Technique

Prajeet Nair  •  July 19, 2025

Expel researchers have found a novel adversary-in-the-middle phishing technique used by PoisonSeed, a cybercrime group previously tied to large-scale cryptocurrency thefts, to sidestep one of the most secure forms of multifactor authentication - FIDO2 physical keys.

Application Security

Botnet Abuses GitHub Repositories to Spread Malware

Prajeet Nair  •  July 18, 2025

Threat actors are using public GitHub repositories to host and distribute malware through the Amadey botnet in an ongoing campaign linked to a broader malware-as-a-service operation, Cisco Talos said in a report published Thursday.

Artificial Intelligence & Machine Learning

Security, AI Oversight Are Flashpoints in Draft Defense Bill

Chris Riotta  •  July 18, 2025

Washington is wagering that future conflicts will unfold as much in cyberspace as on the battlefield, with House and Senate lawmakers unveiling dueling drafts of a nearly $900 billion defense bill that spotlights needs for cybersecurity and artificial intelligence technology.

Artificial Intelligence & Machine Learning

Why the ROI of Enterprise AI Still Eludes Many Firms

Rashmi Ramesh  •  July 18, 2025

As enterprises pour billions into generative AI, many struggle to translate hype into measurable returns on investment. From data prep costs and hallucination risk to poor implementation and organizational inertia, experts say the real payoff may still be years away.

Fraud Management & Cybercrime

Attackers Target Legacy Code in TeleMessage's Signal Clone

Mathew J. Schwartz  •  July 18, 2025

Attackers are actively attempting to exploit a vulnerability that exists in older versions of the Signal message app clone TeleMessage TM SGNL, built by Smarsh to keep copies of all communications, including the ability to comply with federal record-keeping requirements.

Anti-Phishing, DMARC

China-Backed Hackers Intensify Attacks on Taiwan Chipmakers

Prajeet Nair  •  July 17, 2025

Chinese state-aligned hackers have ramped up espionage efforts against Taiwan's semiconductor ecosystem through spear-phishing campaigns. Three distinct threat actors targeted chipmakers, packaging and testing firms, equipment suppliers and financial analysts.

Governance & Risk Management

Golden dMSA Flaw Exposes Firms to Major Credential Theft

Prajeet Nair  •  July 17, 2025

A critical cryptographic flaw in Windows Server 2025's delegated Managed Service Accounts, or dMSAs, allows attackers to generate passwords for every managed service account across an Active Directory forest and create a backdoor, Semperis researchers found.