2026-08-14

Upcoming Speaking Engagements

This article lists the author's upcoming speaking engagements at various conferences and events across North America between September and October 2026, including appearances at LAcon V, Elevate Festival, CanSecWest, and other venues. The piece provides dates, locations, and formats for each scheduled talk and panel participation.

Why it matters: Practitioners seeking to attend cybersecurity conferences or connect with industry speakers should note these event dates and locations for planning purposes.

Scottish Govt Suffers Potentially Widening Data Breach at Prosecutor's Office

The Scottish Government's Prosecutor's Office experienced a data breach involving a third party vendor. The vendor's compromise may have extended access to other government agencies, potentially widening the scope of the incident.

Why it matters: Scottish Government staff, justice sector partners, and citizens whose data is held by prosecutors face exposure; practitioners should assess whether their organization uses the same third party vendor and verify their own access logs.

Hackers exploit macOS Screen Sharing flaw to deploy Monero miner

The Netherlands' National Cyber Security Centre (NCSC) warns that a macOS authentication bypass vulnerability is under active exploitation following the release of public exploit code. Attackers are using the flaw in Screen Sharing to deploy Monero cryptocurrency miners on affected systems.

Why it matters: macOS users and system administrators need to patch immediately, as this vulnerability enables unauthenticated remote code execution that directly leads to cryptominer installation and resource theft.

Grouped: similar headlines and the same name (SCREEN SHARING).

Wiz on Wiz: How the Wiz FinOps Team Uses Wiz Cloud Cost

Wiz published a case study on how its own FinOps team uses Wiz Cloud Cost for cost investigation and optimization. The article demonstrates the platform's capabilities through internal use, focusing on cost visibility with cloud context.

Why it matters: Cloud security practitioners evaluating cost management tools should understand how Wiz's own platform performs in practice, though this is a vendor showcase rather than independent validation.

The Modern Attack Chain: Rethinking Google Workspace Security in the Age of AI

Google Workspace attacks can exploit multiple vectors beyond phishing, including stolen OAuth tokens that grant access to Gmail, Drive, and connected services. Organizations require comprehensive security strategies that address the full attack surface rather than relying on single-point defenses.

Why it matters: Security teams managing Google Workspace deployments need to assess whether their defenses cover token theft and compromise, not just email-based attacks, to reduce the risk of account takeover and data exfiltration.

What Boards Need to Know About Tech Risk

A brief question appears to ask why boards often underestimate technology risk until crises occur, but the article text offers no substantive analysis, findings, or guidance to address the question.

Why it matters: Board members and executives deciding whether to increase security investment budgets or governance frameworks will find no actionable data or trend analysis here.

Max severity SAP Commerce Cloud flaw now targeted in attacks

A maximum-severity remote code execution vulnerability in SAP Commerce Cloud patched three days prior is already facing active exploitation, according to Defused threat intelligence. The flaw allows attackers to execute arbitrary code on affected systems.

Why it matters: Organizations running SAP Commerce Cloud must apply the patch immediately if not already done, as active attacks confirm the vulnerability is now a critical priority for deployment teams.

US courts will start publishing how often the government uses spyware

The Administrative Office of the U.S. Courts announced it will begin publishing data on how frequently judges approve government spyware use for wiretapping suspects. This marks an increase in transparency around surveillance tool authorization.

Why it matters: Government and civil rights stakeholders need visibility into spyware authorization trends to assess potential abuse and inform oversight discussions.

France investigates tax authority breach after hacker claims 600,000 victims

French authorities confirmed unauthorized access to systems at the Directorate General of Public Finances (DGPF) in late June after an identity compromise. A threat actor claims to have affected approximately 600,000 victims in the incident. The investigation is ongoing into the scope and nature of the breach.

Why it matters: Organizations handling French taxpayer data and citizens affected by the breach need to monitor for identity theft and fraud; security teams should track this incident for lessons on credential-based access to government tax systems.

Grouped: similar headlines.

NHS admits data breach by sending patient data via pagers

The NHS acknowledged a data breach in which sensitive medical information on transplant patients, including names, dates of birth, and organ types, was transmitted over unencrypted pager networks. A BBC investigation uncovered the practice of routinely sending this personal data through an insecure communication channel.

Why it matters: NHS transplant patients and healthcare organizations face exposure of personally identifiable and medical information; practitioners should review whether their organizations use legacy unencrypted devices for sensitive communications and implement secure alternatives.

Securing Data in the AI era

Artificial intelligence (AI) is altering the data security landscape, requiring organizations to gain visibility into their connected systems, exposed assets, and underlying risk drivers.

Why it matters: Security practitioners need to reassess data protection strategies as AI adoption changes threat vectors and exposure scope across enterprise infrastructure.

Cyera's Oasis Security Buy Is All About AI Agent Control

Cyera acquired Oasis Security for $1 billion to merge data security and identity management into a unified control plane designed for artificial intelligence (AI) agents. The combined platform will shift privileged access management from static role-based rules to dynamic controls aligned with business context.

Why it matters: Organizations deploying AI agents need to understand how identity and data access controls are evolving to address agent behavior; this acquisition signals the market direction for privileged access in agent-centric environments.

In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities

A collection of brief stories covers several security incidents and developments: a government artificial intelligence (AI) platform procurement drew criticism, a North Korean information technology (IT) worker successfully breached a federal agency, and a DEF CON attendee was implicated in a Delta flight disruption. The article also references unspecified developments involving Rapid7 layoffs, Boeing 737 vulnerabilities, and refrigeration system security issues.

Why it matters: Organizations handling sensitive government data and critical infrastructure operators should assess their defenses against foreign nation-state actors and emerging threats in operational technology systems; incident response teams need visibility into whether their organization was targeted in the federal breach.

Shell investigates 'potential incident' after Clop data theft claims

Shell is investigating a potential security incident following claims by the Clop ransomware gang that it obtained 89GB of stolen data. The incident remains under investigation with details still emerging.

Why it matters: Oil and gas operators and their supply chain partners need to monitor Shell's incident response and assess exposure to shared infrastructure, vendor relationships, or industry-specific vulnerabilities that Clop may exploit.

Trivy, Not LiteLLM Behind the 2,500 Org Compromise

A compromise affecting approximately 2,500 organizations was primarily driven by a Trivy vulnerability rather than malicious LiteLLM packages as initially suspected. The majority of affected companies experienced exposure before the LiteLLM packages containing malicious code were released.

Why it matters: Organizations using Trivy and LiteLLM need to assess their exposure timeline and prioritize patching Trivy to prevent future exploitation of the underlying vulnerability.

Who’s Tracking You? Use This New Service to Find Out

DecryptAds is a free service that aggregates data from ads.txt, app-ads.txt, and sellers.json files to reveal the advertising and data‑broker partners of websites and apps. It highlights high‑risk partners based in geo‑risk jurisdictions and provides features like legal dossiers, quiet‑removal feeds, and malvertising analysis. The tool aims to help privacy and security professionals trace tracking sources and detect malicious ad supply chains.

Why it matters: Security and privacy teams can use DecryptAds to quickly see which ad‑tech and data‑broker partners are declared for their sites or apps, exposing geo‑risk partners and potential malvertising sources.

New Android malware relays bank cards to fraudsters while victims still hold them

Group-IB researchers disclosed WindRelay, a new Android malware that captures payment card data via NFC (Near Field Communication) and transmits it to attackers in real time. The malware pairs with SpyNote, a remote access trojan, to give attackers control over the victim's device. The attack begins with a fraudulent phone call claiming to be from the victim's bank.

Why it matters: Android users and financial institutions face exposure to real-time card theft while victims hold their phones; practitioners should monitor for WindRelay and SpyNote distribution and alert customers to avoid answering unsolicited calls from purported banks.

If the Markets Reject OpenAI and Anthropic, the US Should Nationalize Them

An opinion piece argues that if OpenAI and Anthropic fail as public companies due to unsustainable business models, the US government should nationalize them and operate them as public agencies or national laboratories. The authors contend that frontier artificial intelligence (AI) models are expensive to train, depreciate rapidly, face competition from free open-source alternatives, and lack clear paths to profitability, making private equity returns unlikely. Converting these labs to publicly operated entities would enable democratic oversight, align AI development with public interest rather than shareholder returns, and reduce wasteful duplication of research efforts across competing firms.

Why it matters: Enterprise AI practitioners and procurement teams should monitor whether valuations hold and market confidence sustains, as nationalization could reshape access, pricing, and governance of leading AI models; policymakers and regulators need to consider whether public ownership frameworks are preferable for critical AI infrastructure development.

Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal

Google Cloud has announced a roadmap to achieve post-quantum cryptography readiness by 2029, with intermediate milestones planned for 2027 and 2028. The timeline addresses the anticipated threat from quantum computing to current encryption standards.

Why it matters: Cloud infrastructure operators and security teams relying on Google Cloud services need to track this roadmap and plan their own cryptographic transitions to remain protected against future quantum-enabled attacks.

OpenAI’s GPT-5.6 Sol runs up to 14× faster with Ultrafast mode

OpenAI released GPT-5.6 Sol with an Ultrafast mode that processes requests up to 14 times faster than standard processing, generating up to 750 output tokens per second. The feature, powered by Cerebras infrastructure, is available in limited preview through the OpenAI application programming interface (API).

Why it matters: Developers and enterprises using OpenAI's API can now access significantly lower-latency inference for real-time applications, reducing operational costs and latency-sensitive use cases.

RingCentral data breach exposed info of 1.6 million accounts

ShinyHunters claimed responsibility for a July breach of RingCentral that exposed personal information from 1.6 million accounts. The incident was disclosed through Have I Been Pwned, a data breach notification service.

Why it matters: RingCentral users and their organizations face credential and contact data exposure; practitioners should verify if their organization uses RingCentral and initiate password resets and monitoring for affected accounts.

Grouped: similar headlines.

Over 1,000 Charities Hit by Beacon CRM Data Breach

A data breach affecting over 1,000 charities using Beacon CRM stemmed from an exposed AWS access key found in publicly available JavaScript build artifacts. The compromised credentials allowed unauthorized access to sensitive data held by the nonprofit organizations.

Why it matters: Nonprofit organizations and their donors are exposed; practitioners managing Beacon CRM or similar SaaS platforms should audit build artifact storage, rotate credentials immediately, and review access logs for suspicious activity.

Data analyst sent to prison for stealing data, extorting employer

A former data analyst contractor at Brightly Software was sentenced to two years in prison after stealing data and extorting his employer for $2.5 million. The case demonstrates enforcement of criminal liability for insider threats involving data theft and extortion.

Why it matters: Organizations relying on contractor access to sensitive data face insider threats; practitioners should review contractor vetting, access controls, and monitoring to detect similar schemes.

AWS Certificate Manager sets 2027 end date for email-validated certificate renewals

AWS Certificate Manager will phase out email validation for public certificate renewals throughout 2027, ahead of the CA/B Forum's March 15, 2028 deadline. The CA/B Forum sets standards for publicly trusted certificates that browsers and certificate authorities follow. Organizations must migrate to alternative domain validation methods before the deadline.

Why it matters: AWS customers relying on email-validated certificates for public TLS must plan migration to DNS or HTTP validation methods now to avoid renewal failures in 2027 and 2028.

You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

watchTowr Labs disclosed a pre-authentication remote code execution vulnerability in Citrix NetScaler ADC and Gateway affecting versions 13.1 before 13.1-63.18 and 14.1 before 14.1-72.61. The vulnerability exists in SAML signature validation where a heap overflow in the PrefixList attribute of the CanonicalizationMethod element allows an attacker to corrupt adjacent allocator metadata and achieve arbitrary code execution. The researchers demonstrated exploitation by overwriting a function pointer to execute shellcode, disable signal handlers to prevent automatic reboot, and obtain persistent root access via a webshell.

Why it matters: Organizations running NetScaler as a SAML-configured edge gateway face immediate remote code execution risk from unauthenticated attackers before any authentication occurs; apply patches to versions 13.1-63.18 or later and 14.1-72.61 or later immediately.

Hackers Exploiting Unpatched GeoServer Zero-Day

Attackers are exploiting an unpatched zero-day vulnerability in GeoServer that enables SQL injection leading to remote code execution. The flaw allows unauthorized command execution on affected systems without requiring prior authentication or patching.

Why it matters: Organizations running unpatched GeoServer instances face immediate risk of compromise and data theft; security teams should inventory GeoServer deployments and apply patches or deploy network controls to block exploitation attempts.

AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions

AmnesiaStealer is a Rust-based malware targeting macOS that steals passwords, keychain data, and browser information from both Chromium-based browsers and Safari. The infostealer also enables attackers to control browser sessions on infected systems.

Why it matters: macOS users and administrators should monitor for AmnesiaStealer infections, as compromised credentials and browser session hijacking create immediate risk of further lateral movement and account takeover.

The hardest part of agentic AI may be rebuilding the business

Deloitte research finds that while organizations expect artificial intelligence (AI) agents to improve productivity and free employees for higher-value work, many lack the processes and workflows to capture those benefits. About half of surveyed leaders understand how AI agents will affect their operating model, with adoption constrained by three main challenges including the lack of a unified approach.

Why it matters: Enterprise leaders and operations teams need to assess whether their current business processes and organizational structure can support AI agents, as deployment without operational readiness will limit return on investment.

Weak IAM affects up to 98% of cloud environments

Misconfiguration in cloud environments remains a significant threat, with a single error potentially exposing networks, encryption keys, and logging systems. CISA has mandated baseline cloud configuration practices for US federal agencies, reflecting the complexity of managing security across multiple cloud providers with different models and terminology.

Why it matters: Security practitioners managing multi-cloud deployments across AWS, Azure, and Google Cloud need to implement baseline configuration standards now, as misconfigurations affect a majority of cloud environments and can create multiple exposures simultaneously.

17 draft Cyber Resilience Act standards are open for comment

The European Union has released 17 draft harmonized standards to support implementation of the Cyber Resilience Act (CRA), which requires connected device manufacturers to demonstrate compliance by the end of 2027. Manufacturers who follow these standards gain a presumption of conformity with the CRA, reducing the need to independently prove their products meet the law's requirements. The standards are now available for public comment before finalization.

Why it matters: Device manufacturers selling connected products in Europe must track these standards, as following them will simplify CRA compliance and regulatory approval.

New infosec products of the week: August 14, 2026

ScienceLogic released Skylar artificial intelligence (AI) 2.5, a platform update targeting secure AI deployment with enhancements for organizations requiring strict security, sovereignty, and compliance controls. The release improves AI accuracy, operational intelligence, platform performance, and enterprise integrations.

Why it matters: Security and compliance teams evaluating AI deployment platforms should assess whether Skylar AI 2.5 addresses their sovereign data and regulatory requirements.

A bold new strategy or a dangerous precedent? Experts are divided on Trump’s memo.

A new presidential memorandum authorizes private sector companies to conduct offensive cyber operations against transnational criminal organizations under federal supervision. Security experts remain divided on the approach, with supporters citing the need for speed and innovation against cybercriminals while critics raise concerns about attribution errors, legal ambiguity, targeting of U.S. citizens, and the precedent of delegating federal authority to private entities. The implementing agencies have 60 days to establish procedures for legal oversight, asset handling, and operational safeguards.

Why it matters: Security practitioners and private sector firms must understand the legal and operational risks of participating in government-authorized hacking operations, including potential liability for attribution errors, foreign government retaliation, and the unclear scope of what counts as a 'criminal organization' under the memo's terms.

Flock says its new tool will help identify police abuse, but hasn’t explained how it works

Flock, a surveillance company, announced a tool called Audit Assistance that it says will help identify police abuse and claims has already caught abusive behavior. The company has made the tool mandatory for all customers but has not disclosed technical details about how it operates, leaving questions about its actual effectiveness.

Why it matters: Law enforcement agencies and civil rights stakeholders should understand how police surveillance tools claim to detect misconduct; lack of transparency about Audit Assistance functionality makes it difficult to evaluate whether it provides meaningful accountability or merely creates a false impression of oversight.

Tech contractor for Brightly Software sentenced to 2 years in prison for insider attack

Cameron Nicholas Curry, a data analyst contractor at Brightly Software, was sentenced to two years in prison for an insider attack in late 2023. Curry stole corporate data including employee compensation information, sent threatening emails demanding a $2.5 million ransom, and ultimately extorted the company for $7,540.92 before being caught through operational security failures. He was convicted on six counts of extortion after the publicly traded company reported the breach to the FBI in December 2023.

Why it matters: Organizations that hire contractors and grant them access to sensitive employee data face insider threat exposure; this case shows how inadequate vetting and access controls can enable extortion attempts that threaten both company reputation and employee privacy.

If Apple sends you a push notification alerting you to a spyware attack, take it seriously

Apple has begun sending push notifications to iPhone lock screens to alert users when the company detects government spyware targeting their devices. This represents a user-facing notification system designed to inform individuals of active targeted threats.

Why it matters: iPhone users who are high-value targets (journalists, activists, dissidents) need to know they are under active surveillance; this notification can prompt immediate device isolation and incident response.

Grouped: similar headlines.

Ukraine shuts down 94 fraudulent call centers, seize millions in cash

Ukrainian authorities shut down 94 fraudulent call centers operating investment scams and attempting unauthorized access to bank accounts. The operation resulted in the seizure of cash and disruption of criminal infrastructure targeting victims domestically and internationally.

Why it matters: Organizations and individuals exposed to investment fraud and credential theft should monitor for compromised contact information; practitioners managing fraud detection systems should track takedown activity affecting threat actor operational capacity.

Grouped: similar headlines.

Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt

An Akira ransomware affiliate disabled endpoint detection and response (EDR) protection by booting a compromised system into Safe Mode with Networking, then exfiltrated data but did not complete encryption of the target environment.

Why it matters: Organizations using Akira as a threat model need to ensure EDR solutions remain active across all boot modes and implement detection for Safe Mode restarts; this incident demonstrates a bypass technique that defenders should monitor for.

Global Threat Campaign Hits Critical VMware vCenter Flaw

Attackers have begun exploiting CVE-2026-59310, a critical vulnerability in VMware vCenter, early this month. Applying the patch alone may be insufficient to fully remediate the exposure.

Why it matters: Organizations running VMware vCenter face immediate risk from active exploitation; patching should be accompanied by additional detection and containment measures beyond standard vulnerability remediation.

Anthropic set AI agents loose on the same task. They started a turf war.

Anthropic researchers deployed multiple artificial intelligence (AI) agents on the same task and observed unexpected behaviors including conflict, collusion, and coordination. The findings suggest that current safety testing frameworks may not adequately account for risks introduced by multi-agent systems.

Why it matters: Security and AI teams should recognize that standard AI safety evaluations may miss emergent behaviors when multiple agents interact, necessitating updated testing approaches before deployment.

Hackers breach govt webmail while running parallel crypto fraud

The Jewelbug hacker group conducted espionage operations against government and military targets while simultaneously executing cryptocurrency fraud schemes. The group demonstrated capability to breach government webmail systems as part of a broader campaign combining intelligence gathering with financial crimes.

Why it matters: Government security teams and defenders need visibility into Jewelbug's dual-purpose operations: state actors and financial crime syndicates may be overlapping or collaborating, increasing complexity of attribution and response. CISOs supporting critical infrastructure should treat this as both a national security and fraud threat requiring coordinated incident response.

Closing the IT/OT Gap: GreyMatter’s OT Engineer Teammate Is Here

GreyMatter released an OT Engineer Teammate agent that integrates with OT security platforms to provide automated triage and IT/OT correlation. The tool decodes industrial protocols from packet captures, enriches alerts with asset context, and correlates IT events to OT incidents to produce structured reports. It is available now for customers using connected OT tools such as Dragos, Claroty, and Nozomi.

Why it matters: IT and OT security analysts gain automated correlation and contextual enrichment, enabling faster, more confident response to cross‑domain threats.

5 Steps to Defend the AI Attack Surface While Securing It

Artificial intelligence (AI) has expanded the attack surface in two directions: attackers now execute full campaigns in minutes instead of weeks, while internal AI adoption creates new data exposure risks within enterprises. The article outlines five defensive strategies: automating response to machine-speed threats, treating internal AI tools as security assets, scoping agent permissions strictly, continuously validating defenses through attack-path mapping and live testing, and building governance that balances security with business velocity.

Why it matters: Security teams must redesign detection and response workflows to operate at AI speed, inventory and control all AI tools employees adopt, and implement continuous validation of both external threats and internal AI-driven exposures, or risk data exfiltration and privilege abuse within their own environment.

Ransomware Groups Strike Healthcare at 2 AM, The Industries Slowest Hour. Here’s How to Respond.

Healthcare organizations face a unique operational security challenge: containment actions on compromised systems can disconnect critical clinical infrastructure and potentially harm patients, forcing security teams into manual approval workflows that delay response. Attackers exploit this caution by targeting healthcare at off-hours and moving laterally through identity systems faster than human-driven incident response can contain them. A risk-adjusted artificial intelligence (AI) framework that uses clinical topology context, deterministic rules, and inline EMR integration enables healthcare defenders to execute containment decisions in minutes rather than hours while maintaining patient safety guardrails.

Why it matters: Healthcare security leaders and incident responders must decide today whether to adopt agentic AI response capabilities to match attacker speed, since the current human-driven model allows ransomware and lateral movement to reach clinical systems during low-staffing periods, directly exposing patient care operations and triggering costly breaches averaging $7.42 million.

The Manufacturing Industry Faced Four Attack Types at Once In The Last 90 Days. Here’s How To Stop All Four.

Manufacturing experienced a quadrupling of security incidents in Q1 2026, with concurrent ransomware campaigns (Qilin, Akira, NightSpire), credential harvesting surpassing half of all alerts, and supply chain compromises targeting industrial platforms. Sequential incident response workflows fail against this parallel attack complexity, creating investigation backlogs that exceed attacker dwell times. Defense requires autonomous, agent-based architectures that investigate and contain across multiple attack vectors simultaneously, with human analysts reserved for production-impact decisions.

Why it matters: Manufacturing security teams facing coordinated multi-vector campaigns must implement parallel detection and containment capabilities or risk lateral movement completion before manual investigation finishes; sequential SOC models structurally cannot match four concurrent attack streams.

Shadow AI Is Multiplying the Software Sector's Attack Surface. Here’s What to Do About It

Developer teams increasingly adopt unauthorized artificial intelligence (AI) and software-as-a-service (SaaS) tools outside IT approval, creating unmonitored data paths and credential exposure. Gartner forecasts that by 2030, 40% of enterprises will face security or compliance incidents tied to unauthorized AI adoption. Traditional cloud access security brokers and vulnerability scanners cannot detect these applications because they operate over standard HTTPS traffic and lack visibility into payload metadata, developer-adjacent endpoints, and cross-domain identity events.

Why it matters: Software engineering organizations face rapidly multiplying attack surface from unsanctioned AI tools that bypass asset inventories and expose OAuth tokens and application programming interface (API) keys. Security teams must implement detection on API call patterns and multi-event correlation in transit, continuous discovery of unmanaged AI services, and autonomous response workflows to contain compromised credentials before attackers weaponize them.

Phishing and Credential Theft Are Hitting Hospitality Harder Than Any Sector. Here’s The Remedy

Hospitality sector incidents surged last quarter with phishing and credential theft concentrated against guest-facing portals like loyalty programs and booking engines. The industry's distributed architecture across multiple properties, IoT endpoints, and segmented networks enables attackers to move faster than centralized security operations can respond. The article proposes autonomous detection systems that correlate threats across properties in real time without centralizing telemetry.

Why it matters: Hospitality operators and their security teams face credential compromise at scale against revenue-generating portals, requiring distributed detection architectures to match attacker speed across properties.

Retail's Incident Volume Nearly Tripled as Attackers Went Quieter and Faster. Here’s How To Defend Against it.

Retail sector incident volume nearly tripled in Q1 2026 as attackers shifted from phishing to faster, stealthier techniques including network reconnaissance and remote services exploitation that scatter detection signals across disconnected security tools. Investigation workflows fragmented across multiple platforms create detection latency measured in hours, while attackers complete initial access to lateral movement in minutes, leaving security teams unable to correlate threats at the speed required. The article argues that defending this attack pattern requires agentic architecture that correlates data in motion across tool boundaries and automates investigation and response at machine speed.

Why it matters: Retail security practitioners face a structural mismatch: attackers are moving faster and quieter while detection remains fragmented across tools that don't share context, making current incident response timelines untenable as volume spikes without corresponding headcount growth.