Hello, stay ahead with CISO Brief 🚀

🔍 BigQuery announced GA for Autonomous Embedding Generation and AI.SEARCH(), plus a public preview of Hybrid Search to simplify retrieval and analytics over unstructured data. It automates embedding creation (including images), offers large single-query performance gains, and combines semantic and lexical techniques for more precise results. These features integrate into a broader end-to-end document analytics workflow in BigQuery.

🔍 Today AWS announced enhanced CloudTrail filtering for VPC endpoint network activity events, allowing selectors that filter logs by the IAM user identity making API calls. This update lets customers log only relevant events — for example, access denied actions from identities outside a trusted list — reducing logging noise and cost. The feature supports console, CLI, and SDK access and is available in all Regions that support CloudTrail network activity events.

🧩 Rapid7 found an exposed delivery server containing 1,048 files: lure templates, tests, droppers, builder notes, and two campaign chains. One campaign targeted Windows users in Mexico via a fake government ID lookup and delivered an infostealer through a WebDAV-hosted exploit. The artifacts included README notes, test matrices, and logs that indicate the operator used generative AI (an open-source coding agent) to create, test, and document phishing delivery at scale. The kit heavily probed a WebDAV working-directory hijack (CVE-2025-33053) and contained tests for other file-handling flaws, while active delivery logs showed thousands of launch events concentrated in Mexico.

🔒 Amazon Web Services completed an onboarding audit reissued on May 31, 2026, covering ISO 9001:2015, 27001:2022, 27017:2015, 27018:2019, 27701:2019, 20000-1:2018, 22301:2019 and CSA STAR CCM v4.0. EY Certify Point conducted the audit with no findings to add two additional AWS services into the certification scope. These certifications reflect AWS’s ongoing commitment to robust security controls and customer data protection across services. Customers can view full lists and access certificates via the AWS Management Console through AWS Artifact.

🔊 Amazon Connect now offers more natural, human-sounding agentic voice experiences with expanded support across 50+ languages, including Spanish, French, Italian, Japanese, Korean, Portuguese, and Thai. The update introduces over 100 new voice options and conversational improvements for smoother, more responsive AI interactions. Enhanced features include seamless response pacing, improved turn-taking to avoid interruptions, and speech controls to adjust speed, volume, and emotion to match brand tone.

🚀 Cloud Run now supports one-command multi-region deployments with automatic failover when paired with a global or internal application load balancer. Readiness probes give instance-level health checks and Service health aggregates those checks per region, exposed via serverless NEGs to enable rapid failover. These features target both public internet and private VPC applications and are intended to reduce downtime and simplify HA architectures.

🛠️ Panasonic Automotive’s vSkipGen virtualization platform is validated on Google Cloud’s Axion-based C4A-metal, enabling cloud-native development and validation of Cockpit Domain Controller (CDC) software. The solution pairs vSkipGen’s Unified HMI remote GPU offload with support for Android Automotive OS and Android SDV to provide high-fidelity graphics, VirtIO device virtualization, and integration with automotive simulators. C4A-metal delivers high-performance Arm-based bare metal instances optimized for digital twins, accelerated testing, and scalable CI/CD pipelines.

🛡️ As AI becomes embedded across products, workflows, and supply chains, security leaders are being asked to enable faster, safer business decisions. Existing governance programs lag behind AI adoption, widening gaps in visibility and control. Fragmented risk views across security, procurement, privacy, and IT create blind spots that expand the blast radius when AI systems connect to enterprise data and workflows. CISOs must move from periodic risk review to continuous assurance and risk decisioning to prioritize what can move forward, what needs guardrails, and what must stop.

🛡️ Group-IB discovered a .NET espionage implant called HollowGraph that uses a hijacked Microsoft 365 calendar as a covert command-and-control channel, reading operator instructions from a calendar event dated 2050-05-13 and exfiltrating stolen files as attachments. The implant uses the Microsoft Graph API to blend with legitimate traffic and avoids contacting attacker-owned servers directly. A secondary DNS-based channel supplies Entra ID client credentials via IPv6 AAAA records, written to a log file named logAzure.txt. Group-IB links the malware to the Cavern code family and recommends monitoring calendar events, application-driven Graph activity, and suspicious DNS AAAA queries.

⚠️ This week saw small inputs produce severe outcomes: unauthenticated RCEs in WordPress Core, SonicWall SMA zero-days exploited in the wild, OpenSSL DoS via an 11-byte payload, and a SharePoint RCE added to CISA's KEV catalog. Other notable items include the OkoBot malware framework targeting crypto wallets, the NadMesh botnet harvesting cloud keys, and a long list of high-priority CVEs that require immediate patching and investigation.

🔒 After a breakup, shared digital ties like accounts, subscriptions, and devices can leave you vulnerable if not properly separated. Review active sessions, update passwords and recovery options, and remove your ex from trusted devices and family-sharing settings. Revoke access to smart home devices, unlink payment methods, and cancel or recreate shared subscriptions. Use password managers, privacy tools, and support services to reclaim control and protect your safety.

⚠️ Security researchers disclosed a pre-authentication remote code execution flaw in WordPress’ built-in REST Batch API, tracked as wp2shell. The bug allows attackers to execute arbitrary code on default WordPress installs without plugins or authentication by exploiting an indexing mismatch in the batch/v1 endpoint. Affected versions include 6.9.0–6.9.4 and 7.0.0–7.0.1; fixes were released in 6.9.5, 7.0.2 and 6.8.6. Administrators are urged to patch immediately or block the REST Batch endpoints at the web server or WAF and inventory all WordPress instances.

🛡️ This piece examines how Anthropic's Mythos accelerated vulnerability discovery but did not create the core problem: the exposure window. It explains that while AI has pushed discovery and prioritization to machine speed, mobilization—the organizational steps to actually fix vulnerabilities—remains slow. The article argues security teams must adopt speed-based metrics and attack-path analysis to reduce the blast radius and convert remediation into a measurable business risk.

🚨 A viral account describes a writer wrongly identified and arrested after Flock camera data matched a partial plate. The system recorded only the main characters (e.g., "34 DTM") and ignored a small intervening number, causing nationwide false alerts for vehicles with similar plate structures. Flock defended its ML as working as designed and said police request partial-plate alerts; its CEO has since apologized for inflammatory remarks. Reporting also shows Flock cameras are frequently used to search for people by appearance, raising abuse concerns.

🛠️ Microsoft is addressing a known issue that has caused Windows Server Update Services (WSUS) servers to experience prolonged synchronization times and timeouts, impacting the delivery of updates. The problem, with heightened impact since July 13, 2026, affects client and server platforms and prevents admins from deploying updates through WSUS or Configuration Manager. Mitigations have been deployed for new or rebuilt WSUS installations, and Microsoft is developing additional steps to remediate previously affected servers.

🛠️ Microsoft released out-of-band updates to address a compatibility issue that caused some Dell PCs to shut down or suffer performance and power problems after July 2026 Windows 11 updates. The bug stems from a June preview change to the Windows USB-C Connection Manager that conflicts with the Intel Innovation Platform Framework (IPF) Processor Participant driver, producing a yellow exclamation in Device Manager. Microsoft blocked the July update on affected systems and on Saturday shipped emergency updates KB5121767 and KB5121768 for Windows 11 25H2, 24H2 and Enterprise LTSC 2024 to resolve the issue. Managed devices with Autopatch will get the fix automatically, while Intune admins can accelerate deployment; affected users should restart after installation.

🛠️ Amazon CloudWatch launches Coding Agent Insights to give engineering leaders visibility into how AI coding tools drive value across their organizations. The feature integrates with Claude apps gateway for AWS to collect telemetry from Claude Code without additional instrumentation and supports other agents like Codex and GitHub Copilot. It builds on OpenTelemetry metrics and surfaces agent telemetry alongside existing CloudWatch operational data to help track spend, adoption, and productivity. The capability is available in most AWS commercial regions with standard CloudWatch metric ingestion pricing.

🛡️ Senior UK law enforcement leaders have urged stronger legal tools after two men were jailed for the 2024 TfL hack, calling for Cybercrime Risk Orders (CCROs) to manage high-risk suspects. Sentenced under Section 3ZA of the Computer Misuse Act, the case—described as the largest cybercrime prosecution—highlighted investigation complexity, cross-border cooperation, and gaps in existing powers for underage offenders. Debate continues over CCROs’ practicality and enforcement.