Earlier Security.io Daily Headlines episodes, preserved in reverse chronological order.
QTFY disruption exposes the weakness of source-IP trust · CISA’s two-SOC test makes response authority a control requirement · Actively exploited Gitea flaw puts the software forge in scope · Public SharePoint chain converts authentication bypass into RCE · Separate Zimbra campaigns converge on mailbox and identity risk
UK generator cyber disruption turns a small site into a large resilience decision · ReliaQuest response shows device trust containing a stolen session · Calix router flaw can turn a trusted NAT boundary into public exposure · CISA logging architecture makes evidence quality a leadership decision · TikTok settlement turns children’s-data controls into a board assurance test
Malicious Rust crates turn routine builds into incident investigations · Four-day UK generator shutdown exposes the risk below systemic thresholds · TrueConf Server exploitation requires more than an upgrade ticket · U.S. Bank claim exposes the assurance gap beyond direct providers · Microsoft Entra correction should reset incident priority, not governance
Active Siemens S7 targeting turns PLC exposure into a safety decision · Poisoned Rust crates turned ordinary builds into code execution · Repeated GitHub failures test software-delivery resilience · Actively exploited MLflow flaw can expose cloud credentials · Canvas findings reset the evidence standard for SaaS assurance
Federal agencies warn of active AI-assisted targeting of Siemens S7 PLCs · CareCloud breach scope rises to 3.76 million people · CISA adds MLflow SSRF flaw to exploited-vulnerability catalogue · Federal Medusa update raises critical-infrastructure victim count above 500 · Mirage2FA telemetry reframes Microsoft 365 MFA as a session-containment problem
Medusa update compresses the ransomware decision window · Exploited vCenter flaw requires control-plane compromise review · Heights Finance breach exposes the risk outside core systems · Expanded Mabna charges sharpen the research-espionage threat model · StubMaker Ruby gems turn package installs into credential theft
Active Ray exploitation turns developer AI environments into an incident question · Clop’s PTC campaign gains company confirmation but victim scope remains uneven · France escalates tax-data breach response after containment missed extraction · CEVA breach reaches Pokémon customers as fulfilment disruption spreads · Bluesky’s 24-hour DDoS attack tests communications continuity
Fresh Windchill indicators force compromise reviews beyond patch status · Dutch cyber and critical-entity laws enter into force · RingCentral exposure gains scale as 1.6 million addresses are catalogued · SAP Commerce Cloud exploitation attempts collapse the patch window · Claude outage shows AI continuity must be service-specific
vCenter exploitation turns patching into a compromise investigation · US sets framework for supervised private-sector cyber operations · Trezor breach exposes the risk hidden in fulfilment data · Jewelbug turns one shared webmail template into a national-scale foothold · Apple spyware alerts require a high-risk-user incident path
Internet-exposed macOS Screen Sharing is yielding root access · White House creates a federally controlled private cyber operations programme · Lazarus campaign used a Windows zero-day to suppress endpoint visibility · Akira's Safe Mode tactic blinded controls before encryption failed · NIST asks how the NVD should operate in the age of AI