Third-party assessment findings often get lost in email threads. A vendor promises a fix, the thread stalls, and months later an examiner asks you to prove the issue is closed. Too often, nothing in one place shows that it is.… Read More "How Vendor Risk Teams Track Remediation and Prove Closure"
A vendor assessment is true on the day it’s finished. 12 months later, it’s a historical document, and your team is still making decisions based on it. That gap is where third-party risk concentrates. A questionnaire answered in March says… Read More "Top Vendor Risk Monitoring Solutions for Continuous Oversight (2026)"
Ravie LakshmananOct 02, 2026Vulnerability / Enterprise Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability, tracked… Read More "Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes"
Shutting down endpoint detection and response (EDR) tools before encryption begins has become standard operating procedure across the ransomware ecosystem, analysis of attacks by researchers at Halcyon has warned. The practice, sometimes called EDR-kill, was once considered a specialist capability.… Read More "Ransomware Groups Increasingly Deploy EDR Kill Techniques"
The Operators of a well-known malvertising campaign have developed a novel technique to avoid detection: hiding their activity in the victim’s browser to secretly build and then deliver the final payload. The new tactics by SourTrade, a prolific and evolving… Read More "SourTrade Malvertising Campaign Secretly Builds Malware in the Browser"
Cybersecurity industry body CREST has added additional standards to accredit AI penetration testing services. Unveiled on July 28, the AI-Enabled Penetration Testing requirements are optional add-on requirements for cybersecurity service providers wishing to demonstrate responsible AI usage, both within their… Read More "New CREST AI Standards to Deliver AI-Enabled Pentesting Accreditation"
The Dutch Institute for Vulnerability Disclosure (DIVD) was hacked in an automated AI attack that exploited two zero-day vulnerabilities in the web-based, open source user support/ticketing solution Zammad. The attack occurred on September 21, triggering full incident response, including blocked… Read More "Zammad Zero-Days Exploited in AI-Powered DIVD Hack"
NVIDIA has assembled nearly 40 technology companies behind a new initiative to build open source security tools for AI, although the coalition launches without participation from several of the industry’s most influential AI developers. Announced on July 27, the Open… Read More "NVIDIA’s Open Security AI Alliance Is Missing Some Big Names"
Hackers started exploiting a high-severity OS command injection vulnerability in Zimbra Collaboration Suite (ZCS) shortly after patches were rolled out, before public disclosure, Microsoft reports. Tracked as CVE-2026-73570 (CVSS score of 8.9), the flaw exists because, in ZCS before 10.1.20,… Read More "Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure"
A dairy company owned by Coca-Cola Company suffered data theft as well as production outages following a July ransomware attack, the drinks giant has revealed. Coca-Cola said in a brief statement on July 27 that Chicago-based Fairlife had now “resumed… Read More "Coca Cola Reveals Subsidiary Fairlife Suffered Data Breach"
