Water Utility Attacks in Multiple States Show the Cost of One Old Vulnerability
The latest wave of intrusions at municipal water systems follows the same playbook as Unitronics and Oldsmar because no one is closing the door.
George V. Hulme
AI Arms Both Sides. Defenders Win on Fundamentals, Not Firepower
While the panel cited threat intelligence and management, autonomous pen testing and code reviews, SOC automation, and much more, when they asked how they were countering AI-generated phishing and deepfakes, they leaned heavily into the security essentials.
Open Secure AI Alliance Pushes Open-Source AI Defense
The Open Secure AI Alliance aims to strengthen AI security with open-source tools. Can open defense outpace AI threats?
CISA Warns: Iranian Cyber Campaign Now Threatens "Potentially All" Exposed PLCs
The July 22 update to AA26-097A expands the scope of Iranian PLC attacks and lays out urgent mitigation steps for water, energy, and government operators.
OpenAI, Hugging Face, and the Real AI Security Problem
OpenAI and Hugging Face exposed AI's biggest security risk: enterprises automating broken processes, weak governance, and excess access.
Vendor Access Emerges as a Primary Weak Link in OT Security
As vendor ecosystems expand, industrial firms are still struggling with the basics of secure remote access, oversight and credential control.
GitLost Exposes Agentic AI Data Exfiltration Risks
GitLost shows how prompt injection can turn AI agents into data exfiltration tools by abusing legitimate permissions and trusted workflows.
AI Found Seven FatFs Bugs. Now Someone Has to Fix the Devices
AI uncovered seven FatFs flaws affecting embedded devices. The challenge now is patching millions of systems with no easy fix.
The CVE Stampede Is a Distraction, Finding the Vulns that Matter is the Challenge
With 48,000+ CVEs published annually, the challenge isn't volume. It's finding the vulnerabilities attackers will actually exploit.
Trump's Quantum EO Sets Aggressive PQC Deadlines
A new White House executive order sets hard deadlines for federal agencies to migrate to post-quantum cryptography by 2030 and 2031 and extends those obligations to contractors through new procurement rules. (includes infographic)
Federal Agency or Not: How BOD 26-04 Is Coming for your Vulnerability Management Program
CISA's BOD 26-04 tells federal agencies how fast to patch. It's quietly telling everyone else the same thing: through insurance underwriting, vendor contracts, and regulatory alignment.
From CVSS to KEV, CISA Rewrites Federal Patching Priorities
The agency’s new directive replaces blunt severity-driven remediation with a four-factor risk model built around internet exposure, known exploitation, automatability and system control.
A GPS Correction Tool Gave Iran-Linked Hackers Access to a Major Water Utility
Iranian-linked hackers reportedly breached California Water Service by pivoting through an open-source GPS correction tool to then access billing systems. The alleged intrusion laid bare security failures that federal inspectors had already flagged across hundreds of U.S. water systems.
Defenders Face an AI Arms Race and Most Lack Full Visibility into Their Attack Surface
Security teams are caught between a rapidly expanding attack surface and accelerating adversarial use of AI. Thirty-two percent of security teams see automated, AI-fueled attacks as the single greatest driver reshaping their offensive security strategies.
AI, Ancient Bugs, Fresh Exploits, and an Overflowing Patch Queue
A trio of fresh flaws highlights the heightened vulnerability of the entire enterprise software stack, as the combination of automated scanning, the availability of exploit code, and patching delays is cited as a factor in the rise of vulnerability exploitation as a preferred entry point.
Industrial Ransomware Held Steady in Q1 2026, That's the Problem
The normalization of ransomware in industrial systems, along with an operating culture that treats downtime as unacceptable, is an uncomfortable tension that's not likely to go away soon.