Security · Infrastructure · Automation · AI
Security · Infrastructure · Automation · AI
Google’s new AI Threat Defense portfolio aims to connect threat intelligence, exposure context and code repair. Its value will depend on whether organisations can govern the decisions between those stages. Google announced AI Threat Defense on 27 May, presenting a…
Microsoft’s multi-model agentic security system offers a credible glimpse of faster vulnerability discovery—but its strongest lesson is the combination of specialised agents, tools and human validation. Microsoft has presented a multi-model agentic security system that uses more than 100 specialised…
A coordinated compromise of npm and PyPI packages shows how trusted publishing, CI caches and maintainer identities can combine into an automated supply-chain attack. Security researchers reported a new “Mini Shai-Hulud” campaign on 11 May involving trojanised packages in the…
Two intrusions into Instructure’s Canvas platform show why a shared education service needs tenant-level visibility, tested fallbacks and careful treatment of attacker claims. Instructure detected unauthorised activity in Canvas on 29 April. On 7 May, the same actor obtained access…
Poland’s amended National Cybersecurity System Act is now in force. Its scale, registration timetable and management duties turn NIS2 into a board-level implementation programme. Poland’s amendment to the National Cybersecurity System Act took effect on 3 April 2026. The Act…
Vercel’s April incident began with a compromised third-party AI application and ended inside internal systems. OAuth consent deserves the same scrutiny as a privileged integration. Vercel disclosed that an attacker gained unauthorised access to certain internal systems after compromising Context.ai,…
A joint US advisory on attacks against internet-connected controllers shows how weak OT exposure management can turn a basic intrusion into operational disruption. US agencies warned on 7 April that Iranian-affiliated cyber actors were exploiting internet-connected operational-technology devices across several…
A breach of an FBI system used for court-authorised surveillance is a reminder that “metadata” can reveal operations, targets and methods even when message content remains untouched. The FBI has acknowledged suspicious activity involving an unclassified internal system used to…
The European Commission used a compromised version of a trusted security scanner. The resulting breach shows that build tools can become credential-harvesting infrastructure inside the systems they are meant to protect. CERT-EU published its investigation into a European Commission cloud…
Paraguay’s first comprehensive personal-data law creates a regulator, reaches some overseas processing and gives organisations 24 months from official publication before the regime takes effect. Paraguay’s Law No. 7.593/2025 represents a major change from a privacy landscape previously centred on…