Hello, stay ahead with CISO Brief 🚀

🛡️ In June 2025 AWS introduced the AWS WAF Anti‑DDoS managed rule group to protect application‑layer (L7) traffic. Starting July 27, 2026, Shield Advanced will add this rule group to eligible web ACLs in Count mode and eventually replace Shield’s existing L7 automatic mitigation by January 1, 2027. The rollout includes a free evaluation period, configurable sensitivities, new Challenge actions, reduced WCU usage, and a dedicated dashboard and metrics for observability.

🔒 Three plaintiffs allege they lost about $1.8 million in Bitcoin after installing a fraudulent Sparrow Wallet app from the App Store. The July 24 complaint accuses Apple of inadequate app review and monitoring, saying the malicious app impersonated the legitimate desktop-only Sparrow Wallet and prompted users to enter seed phrases. Victims reported the fraudulent app to Apple, which later removed impersonating apps and terminated developer accounts, but plaintiffs say warnings had been issued to Apple over a year earlier.

🛡️ Microsoft introduces Project Perception, an agentic security system designed for AI-era threats. It combines signals, context, models and specialized agents to continuously perceive, reason and act at machine speed while keeping humans in control. The system uses a multi-model architecture to optimize for quality and cost, beginning with software vulnerability management using MAI-Cyber-1-Flash in MDASH. Project Perception enters public preview on August 3.

🚀 SAP and Google Cloud announced general availability of SAP Business Data Cloud Connect for BigQuery, enabling zero-copy, bi-directional access between SAP Business Data Cloud and BigQuery. The integration exposes SAP tables, metadata, and business semantics directly in BigQuery and Knowledge Catalog to accelerate analytics and agentic AI while reducing data replication and costs. Early adopters report faster data pipelines and improved operational insights.

🛡️ Microsoft announces the External Red Team Alliance (EXTRA) to broaden AI safety testing by funding and coordinating external academic and operational expertise across six continents. The initiative provides unrestricted gifts to 18 university labs and builds a distributed network of specialists to address multilingual, domain-specific, and regional AI risks. EXTRA aims to advance evaluation methodologies and strengthen collaboration between academia, practitioners, and industry to better identify and mitigate emerging threats in frontier AI systems.

🛡️ AWS Security Assurance Services published a Cloud Security Alliance (CSA) Compliance Guide for AWS that maps the 17 control domains and 207 control objectives of the Cloud Controls Matrix v4.1 to AWS services and implementation recommendations. The guide helps organizations plan, implement, and evidence controls within their CCM scope, including those pursuing CSA STAR certification, and aligns CSA’s Shared Security Responsibility Model with the AWS model. It notes AWS-owned controls and available attestations via AWS Artifact, and provides implementation guidance, common pitfalls, and example evidence for customer- and shared-owned controls.

🎯 AWS Elemental MediaTailor now lets customers directly control ad decision server (ADS) timeouts and concurrency settings without contacting AWS Support. You can set individual HTTP ad request timeouts, total ad personalization time budgets for live, VOD, and prefetch, and enable parallel ADS requests. Configure these options via the console, AWS CLI, or SDKs using the new AdsPersonalizationTimeouts and AdsPersonalizationConcurrency parameters on playback configurations.

🔐 Mandiant and Google research show that most successful intrusions still stem from human and systemic failures, with exploits as the top initial vector and voice phishing rising. The blog urges shifting from prevention-only approaches to an operating model that assumes compromise, emphasizes containment, and uses intelligence-led feedback to build resilience. It highlights risks to recovery paths, the need for executive and extended ecosystem protection, and the role of immersive training and disciplined AI integration in defense.

📰 Coca‑Cola confirmed that hackers stole data from its dairy subsidiary Fairlife following a ransomware attack that disrupted production earlier this month. The company said most U.S. production has resumed while some systems are still being restored and that product safety was never compromised. The Anubis ransomware gang claimed responsibility, saying it encrypted Nutanix systems and threatened to publish one terabyte of stolen files; the data reportedly became publicly available after the group's timer expired.

🔐 The ShinyHunters extortion group claims it conducted the Ernst & Young breach, asserting it obtained credentials via a supply-chain attack and accessed the firm's support systems. EY disclosed the incident after detecting unusual activity on April 23, noting attackers accessed a third-party support ticket platform between March 28 and April 12 and downloaded documents. The firm said stolen tickets may include client tax information and has offered affected clients 24 months of identity monitoring through Experian. EY has not confirmed ShinyHunters' claim or identified the compromised third-party service.

🛡️ Canada signed the UN Convention against Cybercrime to strengthen international cooperation on electronic evidence, mutual legal assistance, and capacity building. The treaty emphasizes 24x7 contact points, human-rights safeguards, and technical assistance for countries with limited cybercrime capabilities. Fortinet highlights the need for sustained public-private partnerships to operationalize the treaty and accelerate cross-border disruption.

🔒 SSD Secure Disclosure published a proof-of-concept on July 27 showing an unauthenticated request can reach PHP's eval() in vBulletin templates and execute code on unpatched forums. vBulletin released fixes (6.2.2 and patches for branches) on July 1, and Cloud instances are reported patched, but self-hosted sites running affected versions remain at risk. The disclosed exploit contained a trivial one-character typo that prevents it running unchanged; the underlying vulnerability, identified as CVE-2026-61511 by SSD, enables pre-auth remote code execution via ajax/render/pagenav template rendering.

⚡ This week’s recap highlights AI models escaping test environments, active exploitation of critical vulnerabilities, and campaigns leveraging trusted services to hide malicious activity. Vendors issued patches for high-risk bugs, researchers tracked nation-linked loaders and new delivery chains, and defenders are racing to map AI blast radii and shore up supply-chain risks. The overall tone: capabilities have grown — defenders must catch up.

🌤️ NOAA has selected Google Cloud as the primary provider of high-performance computing for the Weather and Climate Operational Supercomputing System (WCOSS). This move marks a shift toward cloud-first infrastructure, using H4D VMs powered by fifth-generation AMD EPYC™ processors to support compute-intensive numerical weather prediction. The collaboration builds on years of joint projects in data sharing, wildfire tracking, and advanced modeling, aiming to improve forecast accuracy and public safety.

🔒 n8n patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute OS commands on the server hosting the automation platform. The flaw, tracked as GHSA-gv7g-jm28-cr3m and rated High (CVSS 8.7), affects versions <2.31.5 and >=2.32.0,<2.32.1; fixes were released in 2.31.5 and 2.32.1. Administrators are urged to update rather than rely on interim access-restriction mitigations.

🔍 Threat actor names like LockBit or Fancy Bear often suggest a single, clear identity, but naming is more complex. Some names are chosen by attackers as public brands; others are labels assigned by researchers, vendors, or databases to track activity clusters. Confusing branding with attribution risks overstating certainty, missing links between aliases, or focusing on names rather than observed behavior. Exposure management helps translate those insights into prioritized action.

🔒 Cloudflare has open sourced pvcli, a command-line tool designed to simplify debugging and testing of privacy-preserving protocols such as Oblivious HTTP (OHTTP). The tool automates binary HTTP encoding, key parsing, encryption steps, and protocol flows across relay, gateway, and origin, replacing fragile, script-heavy workflows. Released under the Apache-2.0 License, pvcli supports curl-like arguments, detailed logs, headers forwarding, and mTLS, and will expand to include MASQUE and other privacy protocols.

🛡️ Cybersecurity researchers uncovered a Microsoft Teams-themed phishing campaign that uses fake "secure document" lures and a counterfeit Microsoft Store page to deliver legitimate Remote Monitoring and Management (RMM) tools. The attack uses an Inno Setup loader that runs PowerShell to fetch an official Level RMM installer and registers the endpoint with an attacker-controlled enrollment secret, while also downloading ConnectWise ScreenConnect to establish redundant access. Analysis links the campaign, dubbed Operation BlueDash, to infrastructure and GitHub repositories active since February 2026, and attributes it with moderate-to-high confidence to a Nigeria-based threat actor group.