patch
Three questions a hospital CISO should ask a healthcare fintech vendor
A cybersecurity expert has outlined key questions hospital CISOs should pose to healthcare fintech vendors to assess their security posture, particularly concerning patient data and financial transactions. Drew McCombs, who holds both CTO and CISO roles at Cylerity, emphasizes that security should be an integral part of development processes, not an afterthought, especially when patient data…
ai
The legal questions raised by agentic AI hacks
The recent surge in "agentic hacks," where AI models autonomously breach organizations, has prompted a widespread call among policymakers, regulators, and legal experts for accountability from AI developers. While there is broad consensus that action is necessary, the application of existing laws and regulations to these incidents remains largely unclear.
cloud security
Introducing Cloudflare Traces: follow requests through our entire platform
Cloudflare has confirmed that it was targeted by a nation-state attacker in November 2023, with the incident involving a highly sophisticated attempt to gain persistent access to its systems. The company disclosed that the attacker, identified as a nation-state actor, exploited a zero-day vulnerability in Atlassian Confluence Data Center and Server to breach its self-hosted Atlassian server.…
CVE-2026-85706
GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours
GitLab has confirmed that a critical path traversal vulnerability, identified as CVE-2026-85706, is being actively exploited in the wild, with initial probes detected within 24 hours of its public disclosure. The flaw, which carries a CVSS score of 10.0, affects the repository commits API in GitLab Community Edition and Enterprise Edition.
patch
The Collective Cyber Defense letter wrote your next vendor questionnaire
A recent report highlights a letter, signed by over 200 companies, that outlines key metrics for enhancing cyber defenses, particularly in the context of artificial intelligence. The letter, dated August 27, reportedly includes specific criteria that signatories are endorsing under their respective corporate logos. These criteria are presented as potential benchmarks for evaluating vendor…
security
ReliaQuest Rejects Compromise Claims After ShinyHunters Incident
ReliaQuest, a threat intelligence firm, has publicly refuted claims by the ShinyHunters threat group that its systems were compromised or subjected to a ransomware attack. The company confirmed it was targeted by a social engineering scheme on August 22, which briefly exposed its identity dashboard, but maintains that no applications, systems, or customer data were accessed.
breach
ReliaQuest confirms failed data-theft attack after ShinyHunters breach
ReliaQuest, a cybersecurity firm, has confirmed that one of its employees was targeted in a social engineering attack that resulted in temporary, view-only access to an internal identity dashboard. The incident, which occurred after an attacker impersonated a security team member, was subsequently claimed by the ShinyHunters data extortion group.
breachcritical
Frequently asked questions about the active threat to Siemens S7 Series PLCs
Multiple U.S. government agencies have issued a joint cybersecurity advisory warning of active threats targeting Siemens S7 Series programmable logic controllers (PLCs) across critical infrastructure sectors. The advisory, designated AA26-231A, was released on August 19, 2026, by the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau…
