Hello, stay ahead with CISO Brief 🚀

Every day the cybersecurity world moves fast — new incidents, evolving AI risks, changing regulations, and critical vendor updates. We cut through the noise to deliver only what matters most for your business and security strategy.

CISO Brief brings you a daily digest of high-signal news: major breaches, hyperscaler security releases, AI and compliance shifts, and the latest threat intelligence — all in one concise update.

Built for CISOs, CTOs, and architects, our goal is to save you time, reduce distraction, and keep you always on pulse with the risks and opportunities that shape tomorrow.

👉 Join our Telegram channel for your daily update — stay informed, stay ready.

Cybersecurity News Digest — Daily Briefings

Latest News

all posts →

July 28, 2026

Choosing AWS KMS or AWS CloudHSM for Key Management

🔐 This post compares AWS KMS and AWS CloudHSM, explaining their differences, deployment models, pricing, region coverage, and typical use cases. It emphasizes that AWS KMS is the recommended, fully managed option for most workloads while CloudHSM is appropriate for legacy applications or strict dedicated-HSM requirements. The article outlines shared security assurances, compliance coverage, supported algorithms, and operational trade-offs to guide selection.

AWS KMS Key Management

July 28, 2026

Guidance for isolating critical infrastructure OT

🔒 New joint guidance from U.S. and Australian cybersecurity agencies, including CISA and the ACSC, advises critical infrastructure operators to prepare to isolate vital operational technology systems during cyber incidents. The document defines concepts like vital systems, isolation points, and graduated versus physical isolation, and stresses planning, documentation, and regular testing. It highlights trade-offs, operational impacts, and the need to maintain manual operations and secure offline plans.

Critical Infrastructure OT Security Incident Response

July 28, 2026

Google Cloud Conversational Analytics Expanded in Q3

🗂️ Google Cloud has advanced Conversational Analytics from experiments into enterprise-ready offerings across BigQuery, Looker, and preview support for AlloyDB, Cloud SQL, and Spanner. The platform supports querying data across clouds, Lakehouse and Iceberg catalogs, and integrates into tools like BigQuery Studio, Looker, and Gemini Enterprise. Enterprises gain governance features such as CMEK, VPC, DRZ, and row- and column-level access controls, plus cost and observability tools via OpenTelemetry. Agentic Workflows, anomaly detection, and APIs/SDKs enable embedding conversational agents across applications and workflows.

Google Cloud BigQuery Agentic AI AI Governance

July 28, 2026

AWS publishes updated IRAP Phase 1a report for Australia

🔒 Amazon Web Services (AWS) announced the release of the Information Security Registered Assessors Program (IRAP) Phase 1a full assessment report, now available via AWS Artifact. The assessment, completed by an ASD-certified IRAP assessor in June 2026, adds four services to the PROTECTED-level scope, bringing the total to 167 assessed services. AWS also released an IRAP documentation pack, updated consumer guidance, and Reference Architectures for ISM PROTECTED workloads to help Australian customers plan and assess cloud risk.

AWS Cloud Security Regulatory Action

July 28, 2026

Google Cloud KMS Adds Quantum‑Safe Digital Signatures

🔒 Google Cloud Key Management Service (Cloud KMS) now offers general availability support for quantum‑safe digital signatures (ML‑DSA, SLH‑DSA) and ML‑KEM post‑quantum key encapsulation. The release addresses the challenge of signing large payloads by supporting pre‑hash and external‑µ variants to enable efficient HSM and KMS signing workflows. Cloud KMS includes multiple ML‑DSA and SLH‑DSA variants mapped to NIST security categories to help organizations meet emerging standards and regulatory timelines. Developers can manage PQC keys and integrate signing via the Cloud KMS API with documentation and examples provided.

Google Cloud Post-Quantum Cryptography Key Management

July 28, 2026

AWS Console Home adds Cost widget in EU sovereign cloud

💡 AWS Console Home now supports the Cost and Usage widget in the AWS European Sovereign Cloud (Germany) Region, enabling users to surface insights from Cost Explorer and Cost Optimization Hub on their dashboard. The widget shows month-to-date and forecasted costs, highlights savings opportunities, and breaks down spend by service over time. To enable it, sign in to the AWS Management Console, select Add widgets, and drag the Cost and Usage widget onto your Console Home dashboard.

AWS Cloud Security Product Update

July 28, 2026

Best Buy scales secure AI access with federation

🔒 Best Buy eliminated service account key hassles by adopting Google Cloud's Workforce Identity Federation to let developers use their existing Microsoft Entra ID credentials for secure access to BigQuery and other cloud services. This syncless approach removes the need to synchronize user records into Cloud Identity, reduces credential management and attack surface, and delivers auditable, user-level access. The change is largely invisible to developers while simplifying operations for security and platform teams.

Google Cloud Microsoft Identity Security Federation

July 28, 2026

AWS Outposts racks now supported in Mumbai

🔔 Second-generation AWS Outposts racks are now supported in the Asia Pacific (Mumbai) Region. Outposts racks extend AWS infrastructure, services, APIs, and tools to on-premises data centers or colocation spaces to provide a consistent hybrid experience. Customers in and outside India can order Outposts racks connected to this region to optimize latency and meet data residency needs. The expansion increases flexibility in region connectivity for Outposts deployments.

AWS Infrastructure Security Data Residency

July 28, 2026

Google Cloud launches early anomalies and spend caps

🛡️ Google Cloud announces two native billing features: Early Anomalies for AI services and Spend Caps on Budgets. Early Anomalies monitors daily service-level cost signals, builds dynamic baselines, and issues RCA highlighting top SKUs driving surges. Spend Caps let you set monthly financial caps per project and service that automatically block further billable usage when reached, while preserving data and resources.

Google Cloud Cloud Security

July 28, 2026

High-severity flaws bypass Hugging Face diffusers trust check

🔒 Three high-severity vulnerabilities in Hugging Face’s diffusers library allowed crafted model repositories to execute arbitrary code during model loading by bypassing the trust_remote_code safeguard. Zafran Security published findings showing the trust check ran separately from the code load, creating timing and path-based bypasses exploited by crafted files and configuration changes. Hugging Face patched the issues in diffusers 0.38.0 in May and acknowledged related concerns in transformers.

Hugging Face Supply Chain Vulnerability Model Security Arbitrary File Write

July 28, 2026

Security Awareness Shifts From External to Internal Risk

🔒 External threats still drive security training, but organizations increasingly focus on internal risks arising from everyday workflows, cloud apps, collaboration tools, and AI. The 2025 Fortinet Training Institute report shows rising attention to data security, privacy, and AI-related guidance, and finds practical, role-specific training is needed to reduce accidental exposures. Fortinet highlights integrating awareness, simulation, and assessment to build a resilient workforce.

Fortinet Security Awareness AI Security

July 28, 2026

AI-assisted research reveals Linux net/sched race

🛡️ AI-assisted research uncovered a years-old use-after-free race in the Linux kernel's net/sched code that permits local privilege escalation to root (CVE-2026-53264). The bug arises from mismatched locking where an entry can be freed before an RCU grace period ends, creating a window for the kernel to access freed memory. The flaw was found by Lee Jia Jie of STAR Labs, who used AI to locate and reliably reproduce the race; a patch defers freeing until after the grace period. Distributions should apply upstream fixes via normal security channels.

Use-After-Free Privilege Escalation AI Red Teaming

July 28, 2026

Phishing Now Leading Initial Access in Incidents

📈 Analysis of incidents from March to June 2026 shows phishing was the initial entry vector in just over half of cases requiring remediation, up markedly from the prior quarter. Cisco Talos researchers highlight increasingly sophisticated campaigns, including QR code-based credential harvesting and use of trusted cloud hosting to evade detection. The report also warns that advanced Phishing-as-a-Service kits and post-compromise toolsets are expanding capabilities and recommends phishing-resistant MFA, logging, patching, and stricter email controls.

Phishing Talos Cisco MFA

July 28, 2026

Q2 2026 Summary of Major Internet Disruptions

🛰️ In Q2 2026 Cloudflare Radar documented notable Internet disruptions worldwide, from Super Typhoon Sinlaku near Guam to frequent government-mandated shutdowns in Sudan. The quarter also included Iran’s partial restoration after an 88-day blackout, AWS region outages following drone strikes, a DNSSEC mishap affecting Germany’s .de zone, and a submarine cable cut impacting Saint Lucia. These incidents highlight the fragility and interdependence of global Internet infrastructure.

Cloudflare Critical Infrastructure

July 28, 2026

Infoblox enters EASM market with DNS-first focus

🔍 Infoblox has launched an External Attack Surface Management (EASM) capability and a Supply Chain Intelligence feature to expand its exposure management suite. The DNS-centric approach discovers internet-facing assets without agents, credentials, or active scanning and highlights DNS-specific risks like dangling CNAMEs. The new capabilities integrate with Infoblox’s existing Digital Risk Protection Services and aim to help security teams continuously identify and prioritize external exposures based on exploitability and business impact.

Exposure Management External Attack Surface Management Supply Chain Compromise Product Launch

July 28, 2026

OpenWrt critical DHCPv6 overflow and LuCI audit fixes

🛡️ OpenWrt released 24.10.8 (and 25.12.5 for 25.12 users) to fix a critical DHCPv6 stack overflow (CVE-2026-53921) and several remotely triggerable network-service flaws enabled by default. The DHCPv6 bug lets an unauthenticated attacker reachable to UDP/547 overwrite a stack buffer in odhcpd, potentially enabling code execution on devices lacking typical mitigations. The advisory includes public PoC code; other fixes include uhttpd request-smuggling, DHCPv6 hostname-injection XSS, and LuCI component hardening still under review.

Vulnerability Disclosure Remote Code Execution Buffer Overflow

July 28, 2026

Microsoft unveils agentic AI security platform

🛡️ Microsoft revealed Project Perception, MAI-Cyber-1-Flash and several AI security initiatives during a July 27 Security launch preview. Project Perception uses coordinated red, blue and green agents to identify, triage and remediate threats, and will enter Preview on August 3. The company also introduced the MAI-Cyber-1-Flash model integrated into MDASH, plus the FORGE Lab and the External Red Team Alliance to accelerate offensive research and broaden AI safety efforts.

Microsoft Agentic AI Agent Security Microsoft Sentinel

July 28, 2026

Axon adds to license-plate surveillance debate

📷 Municipalities are replacing some Flock license-plate reader arrays with Axon cameras, but the swap may offer little privacy benefit. Vendors claim differences, yet Axon systems still collect extensive personal data beyond plate numbers. Switching brands can be superficial if surveillance capabilities and data use remain similar. The article argues that changing suppliers doesn't necessarily reduce citizen privacy loss.

Privacy Engineering News