Data & infrastructure
-
OpenSSL puts post-quantum transition centre stage
OpenSSL’s October conference in Prague will focus attention on post-quantum migration, cryptographic regulation and the maintenance of critical open-source infrastructure.
-
Four exploited vulnerabilities CISOs should check — now
Four vulnerabilities affecting Microsoft, VMware, and Apple products are now listed by CISA as actively exploited, putting patch status, internet exposure, and the role of affected systems under renewed scrutiny.
-
Clop-linked web shell targets Windchill data
A purpose-built web shell targeting PTC Windchill can decrypt stored credentials, map engineering repositories, and run additional code while operating inside the application’s own trust boundary.
-
Ray flaw moves into active exploitation
CISA has added a critical Ray code-injection flaw to its exploited-vulnerability catalogue after evidence of real-world attacks against the distributed computing framework.
-
NETSCOUT pushes DDoS defence to source
NETSCOUT is extending DDoS mitigation into service-provider networks so compromised subscriber devices can be suppressed closer to the source before attack traffic reaches wider internet infrastructure.
-
EU e-Evidence rules take effect
EU authorities can now send cross-border electronic evidence orders directly to service providers under a regime carrying strict production deadlines and material compliance obligations.
-
Hijacked WordPress sites powered malware network
Check Point says thousands of compromised WordPress sites were repurposed as infrastructure for a malware operation combining data theft, encryption, command and control, and stolen-data storage.
-
Alleged Azure dumps expose cloud identity gap
Alleged Azure and Entra datasets linked to some of the world’s largest companies show how credential theft outside the cloud perimeter can become access inside it without any cloud zero-day.
-
RingCentral breach data reaches 1.6m addresses
A dataset attributed to RingCentral’s July social-engineering incident contains almost 1.6 million unique email addresses, extending the known public footprint of the breach.
-
Trivy emerges as source of 2,500-org exposure
New analysis indicates that most organisations in a 2,500-plus exposure dataset were caught through the earlier Trivy compromise rather than the short-lived malicious LiteLLM releases.