From the Desk
CISO & Security Leaders
Strategic threat landscape, regulatory changes, board-level risk intelligence.
20
Stories filed
4
Desks covered
≥ 7/10
Editorial floor
Coverage:RegulatoryThreat IntelComplianceSecurity
§
On the CISO & Security Leaders Desk
The latest stories filtered for your beat, organised by sub-section.
Threat Intel16 stories
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted HackingAI-assisted post-exploitation targeting a European government entity signals that adversaries are operationalizing agentic AI, compressing dwell time and raising incident severity.1d
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure BootA UEFI-level bootkit exploiting a known flaw to bypass Secure Boot represents a persistent, firmware-layer threat that can undermine endpoint security stacks entirely — critical for risk posture assessments.2d
- Trust Is Not What It Seems — And Fraudsters Are Counting on ItAI-enabled social engineering targeting help desks to obtain legitimate credentials represents a strategic shift—technical controls alone are insufficient when attackers simply ask for access.3d
- AI Tools Are Generating Massive Attacks for Little CostAttackers achieving full domain control for as little as $12 using publicly available AI models demonstrates that the cost-asymmetry of cyber-attacks is widening dramatically against defenders.3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026)Chinese-linked actors using agentic AI in cloud supply-chain attacks signals an escalation in adversary capability that CISO threat models must incorporate.3d
- Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 CredentialsOver 70,000 credentials harvested from Fortinet and Palo Alto edge devices directly undermines perimeter trust — many European enterprises rely heavily on these vendors for remote-access infrastructure.3d
- Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine AttackSandworm's collaboration with UAC-0099 and deployment of a novel mesh-network backdoor signals evolving Russian state-sponsored TTPs that could pivot from Ukrainian targets to EU logistics and critical infrastructure.3d
- PhishGen: Understanding LLM Capabilities in Automated Phishing Website Generation4d
- LiteLLM release pipeline hacked to distribute info-stealer malwareA compromised AI-tooling release pipeline is a supply-chain attack vector that could silently exfiltrate secrets from any organisation adopting the affected package or Docker images.4d
- The Current Landscape of OAuth AttacksOAuth abuse is a growing vector for account takeover and lateral movement in cloud-first enterprises, especially where Microsoft 365 and Google Workspace are pervasive.4d
- Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agentsA Chinese state actor weaponising AI agents in a supply-chain attack on ConnectWise signals a step-change in adversary capability, with direct implications for any enterprise relying on RMM software.4d
- Amazon says PHP2Shell exploitation began 4 days before patchesPre-patch exploitation of PHP vulnerabilities demonstrates that threat actors are weaponising flaws before vendors release fixes, compressing the window for defensive action.4d
- ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software VendorsStorm-0940 expanding to target IT and software vendors using an AI-powered attack agent signals an escalation in adversary capability; European software firms and MSPs are high-value targets in this campaign pattern.4d
- Lazarus hackers use post-quantum cryptography for malware deliveryLazarus adopting post-quantum cryptography for C2 communications signals APT groups are future-proofing against decryption, complicating threat-intelligence efforts.5d
- ClickFix has never been bigger, and AI tools are its most convincing lure yetClickFix campaigns leveraging AI-tool branding represent a growing social-engineering vector that bypasses technical controls, making user-awareness investment a board-level priority.5d
- Decades-Old Windows Utility Powers Modern ClickFix Attack5d
Security3 stories
- Microsoft: Windows Server 2016 reaches end of support in JanuaryWindows Server 2016 end-of-support in January 2027 means no more security patches — any remaining instances become unmanaged risk that insurers and auditors will flag.3d
- Capcom confirms data breach affecting 11.7 million accountsA breach exposing 11.7 million accounts at a major gaming company underscores persistent risks in customer-facing identity services and potential GDPR implications for EU-resident data.4d
- Dutch National Cyber Security Center is Offline because it uses PHP5d