Intelligence desk
Identity
A permanent file of Security.io’s selected briefings tagged to this executive theme. It reflects the publication’s curated coverage, not a census of all global activity.
Binance breach turns AI tooling and deployment tokens into a USD 6.34bn control-plane failureIdentity and Control Plane
cPGuard update-channel compromise requires root-level secret rotation, not patch-only closureSupply Chain
PowerSYSTEM Center flaws put low-privileged users inside an OT management control planeOperational Technology
ConnectWise recovery leaves MSPs with a tenant-proof problemThird-Party Risk
BeyondTrust zero-day requires appliance forensics after patchingVulnerability Management
BeyondTrust zero-day requires appliance and credential containmentVulnerability Management
Ivanti zero-day chain reaches root while evading integrity checksVulnerability Management
Adception chains Google Ads and Bing redirects into Claude ClickFixThreat Intelligence
Allied agencies turn Integrity Tech reporting into a hunt mandateThreat Intelligence
AWS Toolkit disclosure requires token exposure checks, not upgrade evidence aloneApplication Security
Denmark’s national register breach turns delegated access into population-scale identity riskIdentity
Exchange V2 release adds privilege-escalation fix ahead of scheduleVulnerability Management
Exploited NetScaler SAML flaw turns authentication availability into an emergency changeVulnerability Management
WSO2 KEV listing forces an API control-plane reviewApplication Security
CrowdSec disclosure joins package compromise, offboarding and source-code lossSupply Chain Intelligence
Cisco ISE zero-day requires patching and compromise reviewVulnerability Management
Forged admin tokens target WSO2 API control planesApplication Security
AdaptHealth breach scope reaches 4.1 million peopleData Protection
Vendor-held API credentials expose Veradigm patient dataThird-Party Risk
N-central Hotfix 4 resets the control-plane decisionVulnerability Management
SonicWall SMA 1000 zero-days demand compromise checks, not patch-only closureVulnerability Management
CISA’s two-SOC test makes response authority a control requirementIncident Response
Expanded Mabna charges sharpen the research-espionage threat modelThreat Intelligence
Heights Finance breach exposes the risk outside core systemsThird-Party Risk
Jewelbug turns one shared webmail template into a national-scale footholdThreat Intelligence
Snowflake campaign guilty plea turns an old cloud-account failure into a verified legal recordThird-Party Risk
OpenAI–Hugging Face incident makes AI evaluation containment a privileged-system decisionAI Security
Cisco FMC zero-day requires hunting and secret rotation, not patching aloneVulnerability and Network Security
OWAReaper persistence survives credential rotation and endpoint rebuildingThreat Intelligence
CubePilot DNS hijack exposed trusted services behind valid certificatesSupply Chain and Infrastructure Security
Origin Energy says approximately 900,000 customers were affected by data incidentData Protection and Incident Response
Origin Energy says approximately 900,000 customers were affectedData Protection and Critical Services
Laundry Bear’s Zimbra campaign turns a viewed email into mailbox persistenceThreat Intelligence and Identity
Adobe extension flaw shows browser add-ons can bridge trusted SaaS sessionsEndpoint and SaaS Security
CISA gives exposed SharePoint farms three days as attackers pursue machine keysVulnerability and Exposure Management