Hello, stay ahead with CISO Brief 🚀

Every day the cybersecurity world moves fast — new incidents, evolving AI risks, changing regulations, and critical vendor updates. We cut through the noise to deliver only what matters most for your business and security strategy.

CISO Brief brings you a daily digest of high-signal news: major breaches, hyperscaler security releases, AI and compliance shifts, and the latest threat intelligence — all in one concise update.

Built for CISOs, CTOs, and architects, our goal is to save you time, reduce distraction, and keep you always on pulse with the risks and opportunities that shape tomorrow.

👉 Join our Telegram channel for your daily update — stay informed, stay ready.

Cybersecurity News Digest — Daily Briefings

Latest News

all posts →

July 23, 2026

Cloudflare introduces post‑origin Cache Response Rules

🛠️ Cloudflare announced Cache Response Rules, a new rule type that runs after an origin response arrives but before Cloudflare caches it. These rules let you rewrite Cache-Control, manage cache-tags, and strip headers like Set-Cookie, ETag, and Last-Modified without changing the origin. The feature complements existing Cache Rules by giving the response phase final control over whether and how Cloudflare caches content.

Cloudflare Product Update

July 23, 2026

Amazon RDS adds MySQL 9.7 in Preview Environment

🆕 Amazon RDS for MySQL now supports community MySQL 9.7 in the Amazon RDS Database Preview Environment, enabling testing of the latest Long-Term Support release. The preview serves as a sandbox to evaluate new features, bug fixes, and security patches before general availability. Instances in the preview are retained up to 60 days and snapshots are limited to preview restores; pricing matches production RDS in the US East (Ohio) Region.

AWS RDS Product Update

July 23, 2026

Threat Source newsletter: Q2 2026 vulnerability trends

📈 This edition of the Threat Source newsletter reviews Q2 2026 vulnerability trends, noting a 49% YoY increase in tracked CVEs and roughly 200 CVEs per day by June. The author contrasts a shifting AI model landscape with slower real-world impact, highlights concerns about keyword-sensitive AI-CVE counts, and advocates prioritizing patches using EPSS rather than raw CVSS scores. Additional coverage includes Cisco Talos' discovery of the Rust-based msaRAT, new Antares SLMs for vulnerability localization, major incidents impacting land registries and WordPress sites, and tactical detection recommendations.

Threat Report Vulnerability Management CVSS Cisco

July 23, 2026

Co-operative time‑slicing for RL to boost GPU use

🧭 This post introduces co-operative time-slicing from the llm-d project to reduce accelerator idle time during reinforcement learning (RL) post-training for large language models. By treating sampling and training steps as schedulable phases, the platform interleaves independent RL jobs on shared hardware, increasing aggregate GPU duty cycles from ~40% to 70% without harming convergence. The system uses a client library, a cluster orchestrator, and a node-level snapshot agent to checkpoint and restore device state, enabling fast context switches and improved price-performance for RL workloads.

LLM Security AI Governance

July 23, 2026

Amazon Bedrock AgentCore adds unified observability

🔎 Amazon Bedrock AgentCore now sends traces, prompts, structured logs, and standard output to a single per-agent Amazon CloudWatch log group, consolidating previously separated telemetry. This removes the need to search across multiple log groups and enables scoping of IAM policies and CMK encryption at the agent level. New agents created from July 20, 2026 use this by default in supported regions; existing agents can enable it via an environment variable and ADOT 0.17.1+.

Amazon Bedrock Bedrock Agents Cloud Detection and Response

July 23, 2026

Claude Sonnet 5 now available in AWS GovCloud

🚀 AWS GovCloud (US) now offers Claude Sonnet 5 on Amazon Bedrock for inference across GovCloud regions. Claude Sonnet 5 balances capability, cost, and speed, improving coding, agentic workflows, and knowledge work with fewer correction cycles. The launch also brings Claude Opus 4.8 to Bedrock runtime and Bedrock Mantle endpoints, with AWS-managed features such as Guardrails and regional data residency.

Amazon Bedrock Claude

July 23, 2026

Preparing Infrastructure for the Agentic Data Cloud

🚀 In the agentic era, organizations must move from passive data stores to proactive systems of action by providing AI agents with trusted business context. Google introduces the Agentic Data Cloud to unify data, models, and operational databases on an AI-native stack, leveraging BigQuery, Spanner, and open standards like Apache Iceberg. The approach reduces latency, operational overhead, and integration gaps that hinder production-grade agentic AI.

Google Agentic AI BigQuery AI Agent Hijacking

July 23, 2026

Voicify and Google Cloud: AI Calling Transformation

🤖 Voicify partnered with Google Cloud to transform phone calls into reliable, AI-driven interactions for restaurants and healthcare. By adopting Gemini Enterprise and Vertex AI, the company improved latency, reduced costs, and achieved enterprise-grade security and compliance. Their orchestration platform validates orders against POS systems, handles traffic spikes with provisioned throughput and pay-as-you-go, and shortened client onboarding dramatically. The architecture emphasizes scalability, data integrity, and multicloud availability.

Google Cloud Vertex AI Gemini

July 23, 2026

XFS reflink race lets local unprivileged users gain root

🔒 Qualys TRU disclosed a decade-old race condition in the Linux XFS filesystem that allows an unprivileged local user to gain full root access on kernels 4.11+ when XFS reflink is enabled. The flaw, tracked as CVE-2026-64600 and dubbed RefluXFS, lets a race between concurrent writes corrupt the copy-on-write mechanism so the original file is modified directly on disk without kernel logs. Vendors merged a patch into upstream in July; affected organizations should apply vendor kernel updates and reboot to mitigate.

Race Condition Privilege Escalation

July 23, 2026

Microsoft 365 outage disrupts Teams and SharePoint

🔔 Microsoft Teams and several Microsoft 365 services experienced an outage on July 23, with users reporting access problems for Teams, SharePoint, Excel, and the Microsoft 365 Admin Center. Downdetector recorded 2,403 reports at 11:11 a.m. ET, well above the normal baseline. SharePoint drove most complaints (78%), followed by Excel (11%) and the Admin Center (6%). Microsoft acknowledged the disruption, citing incident MO1437424 and stating it is investigating.

Microsoft

July 23, 2026

AWS adds G7e instances to SageMaker AI in Seoul, London, Tokyo

🚀 Amazon SageMaker AI now supports EC2 G7e instances in Asia Pacific (Seoul), Europe (London), and Asia Pacific (Tokyo). These instances include up to 8 NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs (96 GB each), 5th Gen Intel Xeon processors, and up to 1,600 Gbps EFA networking, offering up to 2.3x inference performance versus G6e. G7e delivers up to 768 GB total GPU memory enabling single-node serving of medium-to-large LLMs up to 70B with FP8 precision and is suited for LLM inference, image/video generation, spatial and scientific computing.

Amazon Bedrock Nvidia

July 23, 2026

Weekly ThreatsDay Bulletin: Multifaceted Cyber Risks

🛡️ This week's ThreatsDay Bulletin catalogs varied, evolving threats that masquerade as useful software or ordinary files. Highlights include npm and PyPI supply-chain risks, a rogue VS Code extension, a fake Claude app delivering SectopRAT, and Android apps posing as civil-defense tools that instead enable surveillance. The report also details PLC-targeting activity linked to Iranian-affiliated actors and new AI-related exploitation techniques.

Supply Chain Vulnerability Malware Threat Report

July 23, 2026

Email Threat Landscape Q2 2026: Key Findings

📊 Microsoft reports that Q2 2026 saw a sharp decline in phishing tied to the Tycoon2FA PhaaS disruption, while threat actors shifted tactics into Teams-based social engineering and vishing. Credential phishing remained the dominant payload objective, and notable campaigns demonstrated large-scale automation and multi-stage delivery chains. The post reviews QR code and CAPTCHA-gated phishing trends, BEC anomalies, and mitigation recommendations.

Microsoft Phishing

July 23, 2026

Practical Roadmap for Post‑Quantum Cryptography Readiness

🔒 The shift to Post‑Quantum Cryptography (PQC) is now a practical priority for security, architecture, procurement, and compliance teams. The White House EO sets firm federal deadlines for PQC adoption in 2030–2031 and prompts broader supply‑chain impacts, making 2026–2027 critical planning years. Organizations should inventory cryptographic dependencies, assess vendor readiness, prioritize systems vulnerable to “harvest now, decrypt later” threats, and build crypto‑agility. Fortinet tools like FortiManager, FortiAnalyzer, and FortiGate hardware acceleration support discovery, risk measurement, and targeted protection to help operationalize PQC migration.

Post-Quantum Cryptography Fortinet Regulatory Action

July 23, 2026

AWS adds G6 EC2 instances to SageMaker AI Inference

🚀 Amazon SageMaker AI Inference now supports G6 instances in AWS GovCloud (US‑East). These instances feature up to 8 NVIDIA L4 Tensor Core GPUs with 24 GB each and third‑generation AMD EPYC processors, offering up to 2x inference performance versus G4dn. The expansion enables government and regulated customers to deploy generative AI and computer vision endpoints while meeting compliance and data residency requirements. G6 offers competitive price‑performance for production workloads that fit within 24 GB GPU memory.

Nvidia

July 23, 2026

Organizations Delay Microsoft Copilot Over Data Risk

🔒 Two-thirds of organizations have delayed or cancelled Microsoft Copilot deployments due to fears the AI assistant could expose confidential SharePoint data. CoreView’s State of Microsoft 365 Security and Governance 2026 report (21 July) highlights confusion over Copilot's access and permissions and widespread concerns about data leakage. C-level executives are most likely to pause rollouts, and respondents link hesitation to prior Microsoft 365 security incidents and missing foundational controls.

Microsoft Copilot Data Security Cloud Security

July 23, 2026

Sandbox escape in Claude Cowork threatens macOS users

🔒 Researchers disclosed a sandbox escape in Anthropic's Claude Cowork that allowed an agent running in a Linux VM on macOS to read and write files across the host. Accomplish AI reported the flaw, codenamed SharedRoot, and said roughly 500,000 local Cowork users were affected before mitigation. Anthropic marked the report informative; newer Cowork defaults to cloud execution, but local sessions remain vulnerable. Accomplish AI outlined mitigation steps including restricting shared mounts and disabling unprivileged namespaces.

Anthropic Claude Sandbox Escape Container Escape

July 23, 2026

Q2 2026 Brand Phishing: Top Impersonated Companies

📊 Microsoft remained the most impersonated brand in Q2 2026, appearing in 23% of all brand phishing attempts. The top five—Microsoft, LinkedIn, Google, Apple, and Amazon—accounted for over half of observed attacks, while ChatGPT entered the top ten for the first time. Technology, social networks, and banking were the most targeted industries, and common tells included distorted logos, dead buttons, and mismatched links.

Phishing ChatGPT Microsoft Google