cybersecurity

CISA’s updated Cross‑Sector Cybersecurity Performance Goals — CPG 2.0 — mark a decisive shift from checklist-style guidance to measurable, governance‑backed outcomes for critical infrastructure owners and operators, placing accountability and enterprise risk management alongside technical...

Cybercriminals are increasingly bypassing technical perimeter defenses not by hacking in, but by being hired in—posing as legitimate remote employees, slipping through HR and onboarding, and then using hardware and identity tricks to gain persistent, trusted access to corporate systems...

Microsoft’s advisory language and public vulnerability metrics are often shorthand for two different concerns: what an attacker can achieve and how the vulnerable code is actually invoked. That distinction lies at the heart of the current public record around CVE-2025-62563 — a Microsoft Excel...

Microsoft’s MSRC entry for CVE-2024-57974 correctly states that Azure Linux includes the upstream open‑source component and is therefore potentially affected, but that wording is an inventory attestation — not proof that other Microsoft products cannot contain the same vulnerable code. Azure...

Cyber extortion has moved from episodic crisis to structural risk: in the months leading into 2026 we’re seeing a sustained surge in ransomware and extortion activity driven by a volatile mix of state‑aligned operators, opportunistic criminal syndicates, politically motivated hacktivists, and...

A newly disclosed vulnerability, tracked as CVE-2025-11731, affects libxslt and stems from a type confusion bug in the library’s EXSLT handling routine exsltFuncResultComp, allowing a specially crafted stylesheet to cause unexpected memory reads and application crashes—effectively a...

The “Windows Update” screen you trust has been weaponized: attackers are using a high-fidelity fake update pop-up to trick Windows users into pasting and executing a malicious command that boots a fileless, in‑memory infostealer — a fresh and dangerous iteration of the ClickFix...

Johnson Controls has warned that a certificate-handling flaw in several iSTAR door‑controller families can leave panels unable to restore host communication after the default TLS certificate expires — a failure that impacts availability rather than enabling obvious data theft, but which...

Advantech’s iView — a widely deployed industrial video monitoring and management platform — is the subject of a fresh, high‑priority coordinated advisory that catalogs multiple remote, authenticated and (in some cases) authenticated‑low‑privilege vulnerabilities that can lead to SQL injection...

CISA on March 20, 2025 published five new Industrial Control Systems (ICS) advisories that flag high‑risk flaws across multiple vendors — Schneider Electric (two advisories), Siemens, SMA Solar Technology, and Santesoft — and urge operators to apply patches and mitigations immediately...

The Indian government has issued a sweeping directive that will force app-based messaging services to remain tied to an active SIM card on the device where the app runs, and to implement periodic web‑session logout and re‑authentication — a move that reshapes how WhatsApp, Telegram, Signal...

Malaysia’s corporate sector is at a crossroads: headline adoption figures for data analytics and AI sparkle — but beneath the surface lies a set of structural weaknesses that threaten to turn short‑term gains into long‑term liabilities. Background / Overview The recent profile of CPA Australia’s...

Zenzero and Microsoft convened UK technology leaders this month to sound a clear warning: as organisations rush to adopt AI, the limiting factor — and the greatest risk — is not the model but the data that feeds it, and urgent investment in data resilience, governance and secure platforms must...

Cobalt Strike 4.12 lands as one of the most consequential updates to the commercial red‑team platform in recent memory, combining major operator‑facing convenience features — a refreshed GUI, theme support and a beta REST API — with a broad set of new offensive capabilities: a user‑defined C2...

Microsoft has pushed a high-priority November cumulative update for Windows that closes dozens of security holes — including a Windows kernel flaw Microsoft says was being actively exploited in the wild — and users and administrators are being urged to install the patch without delay. Background...

Sophos’ decision to surface its Intelix threat intelligence inside Microsoft’s Copilot ecosystem marks a practical inflection point: high-fidelity telemetry and sandbox analysis that once lived behind SOC consoles are now available inside Microsoft Security Copilot and Microsoft 365 Copilot...

The industry just reached a new inflection point: Anthropic, Microsoft, and NVIDIA unveiled a tightly coordinated set of partnerships that stitch model development, chip co‑engineering, and hyperscale cloud capacity into a single commercial fabric — Anthropic has committed to purchase roughly...

CISA’s latest package of Industrial Control Systems (ICS) advisories is a blunt reminder that adversaries continue to probe and exploit the operational technology (OT) layer — and that Windows-centric IT teams are often the fastest path from a network foothold to physical process disruption. The...

Embee Software’s latest strategic pivot—doubling down on AI-led productivity, cloud optimisation and managed cybersecurity—signals an aggressive move to convert decades of channel experience into a scalable services business focused on Microsoft platforms and recurring revenue. In an exclusive...

Roman Kepczyk’s annual technology forecast for accounting firms lays out a tight, practitioner-focused set of predictions that should be on every firm leader’s 2026 strategic radar: cloud engagement binder stagnation, change management as a competitive moat, vendor‑led adoption of agentic AI...