Identity & access
-
NHS dismisses staff over unauthorised record access
Fifteen NHS staff have reportedly been dismissed after accessing sensitive records connected to the Nottingham attacks without authorisation, renewing scrutiny of patient confidentiality controls.
-
Roundcube fixes webmail security vulnerabilities
Roundcube has released security updates addressing command injection, request forgery, content filtering, session handling, and attachment-processing weaknesses across its supported webmail branches.
-
Keeper connects Tenable cloud findings to privileged access remediation
Keeper and Tenable have introduced a workflow linking cloud identity findings to governed privileged access actions, alongside a separate credentialed vulnerability-scanning integration.
-
German municipal IT project tests shared approach to Active Directory hardening
An October interview describes how 27 municipal IT organisations worked through Windows Server and Active Directory hardening together over 12 weeks, including rollback and ownership arrangements.
-
Microsoft leads Check Point phishing dataset as brand impersonation shifts towards AI tools
Microsoft accounted for 33% of brand impersonation attempts tracked by Check Point in the third quarter, while its research also identified lures involving AI developer tools.
-
German CDU account sends 6,500 phishing emails after mailbox compromise
Police say attackers used a compromised account belonging to the CDU in Heilbronn to send approximately 6,500 fraudulent emails, including to political and government contacts.
-
ConnectWise disables Cloud Backup identities after unauthorised access
ConnectWise suspended its Cloud Backup service and disabled seven application identities following unauthorised access, leaving partners to investigate possible activity inside Microsoft 365 tenants.
-
Check Point links 10,187 domains to concealed phishing infrastructure
Check Point identified 10,187 associated domains during a September scan of rotating phishing infrastructure that sometimes presents blank or error pages to visitors without the intended link.
-
Infoblox attributes Help TDS scam-routing infrastructure to Hotejka
Infoblox researchers identify an Eastern European operation behind a long-running traffic distribution system that uses disposable Cloudflare Pages sites to route users into remote-access fraud.
-
Access vs identity: The Native agent problem
Josh King, Chief Technology Officer at &above, argues that giving AI agents distinct identities solves only part of the security problem unless access rights, expiry, and accountability are addressed.