< ciso
brief />
Telegram

Hello, stay ahead with CISO Brief 🚀

Every day the cybersecurity world moves fast — new incidents, evolving AI risks, changing regulations, and critical vendor updates. We cut through the noise to deliver only what matters most for your business and security strategy.

CISO Brief brings you a daily digest of high-signal news: major breaches, hyperscaler security releases, AI and compliance shifts, and the latest threat intelligence — all in one concise update.

Built for CISOs, CTOs, and architects, our goal is to save you time, reduce distraction, and keep you always on pulse with the risks and opportunities that shape tomorrow.

👉 Join our Telegram channel for your daily update — stay informed, stay ready.

Cybersecurity News Digest — Daily Briefings

Latest News

all posts →

Shift from Patching to Mitigation in AI Era

🔒 Dick O’Brien of Symantec warned at IRISSCON 2026 that organizations “can’t patch their way out of AI” as attackers leverage AI to rapidly discover and chain vulnerabilities. He highlighted the collapsing Zero Day Clock — time-to-exploit fell from a week in 2025 to a day in 2026 — and cited PHP2Shell exploitation within minutes of disclosure. O’Brien urged defenders to adopt an assume-exploit mindset and prioritize mitigation measures such as behavior blocking, default-deny, least privilege, and data inspection.
Vulnerability ManagementAI SecurityZero-Day ExploitationPatch Management
read more →

NCSC launches Cyber Adversary Simulation scheme

🔒 The UK’s National Cyber Security Centre (NCSC) has launched the Cyber Adversary Simulation (CyAS) scheme to help critical infrastructure providers test and improve cyber resilience. Participating organisations select vetted suppliers who create realistic attack plans based on the client’s exposure and threat landscape. CyAS complements the NCSC’s Cyber Assessment Framework and Cyber Resilience Audit and will start as a Minimum Viable Product to refine methodology and gauge demand.
Cyber Resilience ActCritical InfrastructurePurple TeamingBreach and Attack Simulation
read more →

Critical pre-auth MongoDB flaw forces replica crash

🛡️ A critical use-after-free vulnerability in MongoDB Server (CVE-2026-118383) lets an unauthenticated attacker send two ping requests that can crash a replica set member when it later becomes primary while still missing recent writes. Datadog Security Labs reproduced the crash and detailed how the bug arises during primary catch-up cleanup. MongoDB released fixed versions and automatic Atlas updates; self-managed deployments must upgrade every replica member promptly. Researchers recommend restricting network access as a temporary mitigation and inspecting logs for specific events indicating planted waiters or catch-up anomalies.
Use-After-FreeRemote Code ExecutionZero-Day ExploitationPatch Release
read more →

When Developer Laptops Become Extensions of Production

đź”’ Developers increasingly run autonomous coding agents on laptops containing tokens, keys and credentials, turning local machines into de facto production endpoints. Sandboxing alone is insufficient because agents can misuse legitimate permissions or exfiltrate data over authorized channels. The article argues for separating agent identity from human identity, using narrowly scoped delegation and a trusted intermediary to authorize actions. It calls for layered controls, provenance for MCP components, and embedding policy enforcement into developer platforms.
Agentic AIAgent SecurityMCP SecurityInsider Threat
read more →

Maersk reports breach of legacy system after extortion

đź”’ Maersk disclosed an unauthorized access and data extraction from a local legacy IT system after an extortion group claimed to have stolen 100GB of logistics-related data. The company said its findings suggest no sensitive data was disclosed and that the incident is isolated, with no anticipated disruption to customer operations. Security experts urged careful due diligence and continuous validation of inherited systems and their controls following M&A activity.
Data BreachData ExfiltrationIncident Response
read more →

Node.js patches 16 vulnerabilities across HTTP/2 and TLS

🛡️ Node.js released security updates addressing 16 vulnerabilities across its HTTP/2, HTTPS, and TLS server code in the supported 22.x, 24.x, and 26.x lines. The fixes include two critical HTTP/2 issues that can crash servers or expose memory across connections, and an HTTPS flaw that may leak TLS private keys when certain handler patterns are used. Updated versions 22.23.5, 24.22.3, and 26.13.1 are provided and updating is the only remediation listed.
Patch ReleaseMemory CorruptionDenial of Service
read more →

Mass GitHub account hijack compromises CI secrets

đź”’ Aikido Security says an attacker used stolen credentials from 4,837 GitHub accounts to plant a secret-stealing payload into CI workflows, running in at least 1,806 repositories. SafeDep counted 8,093 repositories that received malicious commits; in many cases the stealer was added to existing workflows or delivered via npm postinstall hooks. The malware exfiltrates GitHub Actions secrets, cloud credentials, and repository data, often removing logs and reverting commits quickly. Owners must revoke tokens and keys, rotate secrets, enable 2FA, and inspect cloud trust policies and federated credentials for signs of compromise.
GitHubAccount TakeoverSecret ExposureCI/CD Security
read more →

Critical Apache HTTP/2 Vulnerability Requires Update

đź”’ A critical flaw in Apache HTTP Server's mod_http2, tracked as CVE-2026-119618, allows unauthenticated remote code execution on servers with HTTP/2 enabled. The issue affects Apache 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8 through 2.0.42, and is fixed in Apache 2.4.71 released yesterday. Red Hat has shipped fixes for RHEL 9 and 10, while other distributions vary in status. Administrators unable to upgrade are advised to disable h2/h2c in the Protocols directive as a temporary mitigation.
Remote Code ExecutionPatch ReleaseAdvisory
read more →

Hackers stole AI keys, costing Railway $740K

đź”’ Railway confirmed a near 26-hour intrusion in which attackers stole AI provider credentials and used them to rack up about $740,000 in fraudulent AI usage charges. The attackers exploited multiple vulnerabilities to obtain internal credentials, decrypted a subset of customer environment variables (up to ~100,000), and accessed linked-account tokens that were reset. Railway is working with providers to revoke keys, reimburse customers, and has moved to short-lived credentials and rebuilt tooling to prevent recurrence.
Credential DumpingAPI AbuseCloud Account Compromise
read more →

Russian EVs Hijacked via Account Takeovers

đź”’ This episode of Smashing Security explores how owners of Chinese-made Li Auto SUVs in Russia are having their vehicles remotely immobilised after attackers take over app-linked accounts. Hosts Graham Cluley and Danny Palmer discuss ransom demands, possible use of rented Chinese phone numbers, and the evolving tactics from higher previous demands to smaller payments today. The episode covers advice, vendor responses, and broader implications for connected vehicles.
Account TakeoverMobile SecurityRansomware
read more →

Ornith 1.0 Models Added to SageMaker JumpStart

🚀 Ornith-1.0-9B and Ornith-1.0-35B are now available on Amazon SageMaker JumpStart, extending AWS’s collection of foundation models for agentic coding. The 9B dense model targets efficient single‑GPU deployment with a 256K token context window, while the 35B Mixture‑of‑Experts model balances performance and efficiency on a 24GB GPU. Both use reinforcement learning to optimize scaffold generation and solution rollouts for improved code generation.
Amazon SageMaker AIAgentic AIProduct Launch
read more →

DeepSeek V4 models added to SageMaker JumpStart

🚀 DeepSeek's DeepSeek-V4-Pro, DeepSeek-V4-Flash, and DeepSeek-V4.1-Flash are now available on Amazon SageMaker JumpStart as open-weight Mixture-of-Experts (MoE) language models under the MIT license. These models offer frontier performance across reasoning, coding, and agentic workloads while activating only a fraction of parameters per token for improved efficiency. Customers can deploy them from the SageMaker JumpStart catalog or via the SageMaker Python SDK to address long-context, multimodal, and cost-sensitive production use cases.
DeepSeekAmazon SageMaker AIAgentic AIProduct Launch
read more →

AI-Enabled Red Team Tools Accelerate Attacker Pace

🔍 Unit 42 reports that AI-enabled red-teaming platforms like ARTEX and CyberStrikeAI are being adopted by threat actors to perform rapid, autonomous intrusion campaigns. Observed activity includes internet-facing consoles, coordinated cloud-targeting, and forks filling gaps after ARTEX was closed-source. The report outlines tool categories, behavioral hallmarks, and practical mitigations defenders can apply.
Unit 42AI Red TeamingThreat ActorActive Exploitation
read more →

AWS Network Security Manager Expands to EU Sovereign Cloud

đź”’ AWS announces general availability of AWS Network Security Manager in the AWS European Sovereign Cloud Region and in thirty-one additional regions worldwide. The service centralizes and automates network security policy deployment, supporting AWS WAF and AWS Shield in the sovereign region. It offers always-on automation to apply WAF protections to internet-facing assets, detects configuration drift, and enables centralized remediation to reduce operational overhead.
AWSAWS WAFNetwork Security
read more →

AWS Cloud WAN adds centralized VPC Flow Logs

🛰️ AWS Cloud WAN now supports VPC Flow Logs, enabling centralized visibility into IP traffic across global networks. Flow Logs capture per-flow details—IP addresses, ports, protocol, traffic volume, and packet-loss counters—plus Cloud WAN metadata like segment, Region, service insertion hops, and attachment details. Owners can enable logging for an entire core, specific edges, or individual attachments and publish records to CloudWatch Logs, S3, or Data Firehose. There is no additional Cloud WAN fee for Flow Logs; standard destination charges apply.
AWSCloud Detection and Response
read more →

AWS simplifies getting started with secure defaults

đź”’ The new AWS experience streamlines how you start building by applying sensible, secure defaults so projects are safe and manageable from day one. Features include Builder ID sign-in with MFA, an automatically managed AWS Organization and per-project boundaries, a single default Region, spend limits that pause projects at a ceiling, and preconfigured IAM roles to reduce initial setup. These defaults let developers focus on building while providing a secure foundation that can scale and be handed over to advanced controls when needed.
AWSAWS IAMZero Trust
read more →

GSocket misuse: Persistent relay-based C2 on Linux

🔍 Microsoft observed multiple incidents where threat actors deployed GSocket, an open source remote access tool, on compromised Linux web servers to maintain access beyond initial vulnerability remediation. The tool uses a shared relay network, so blocking IPs or domains is ineffective; defenders should look for persistence, privilege escalation, and outbound relay connections rather than relying on application patching alone. Microsoft Defender for Endpoint telemetry shows rapid growth in detections focused on web applications and hosting environments.
MicrosoftDefender for EndpointPersistenceRemote Access Trojan
read more →

Amazon EKS increases etcd size for larger clusters

🔧 Amazon EKS now provides a larger 24 GB etcd database (up from 16 GB) for 4XL and 8XL Provisioned Control Plane clusters on EKS version 1.34 or later. The etcd store holds cluster state, and the 50% capacity increase allows more Kubernetes objects, supporting larger pods, jobs, events, and custom resources. Existing eligible 4XL and 8XL clusters receive the upgrade automatically, and the 24 GB database is available in all commercial AWS Regions where Provisioned Control Plane is offered.
AWS EKSKubernetesProduct Update
read more →