The guidance aims to establish product cybersecurity requirements for IoT devices integrated into federal agencies’ networks.

The post NIST Opens Updated IoT Security Guidance to Public Review appeared first on SecurityWeek.

A standard non-admin account is sufficient to conduct an attack that exploits legitimate OS behavior rather than software vulnerabilities.

The post macOS Weaknesses Chained to Silently Disable Endpoint Security Agents appeared first on SecurityWeek.

The security defects allow unauthenticated users to take control of the open source software supply chain.

The post Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking appeared first on SecurityWeek.

Cisco noted that a PoC had been available for CVE-2026-20230 when it announced patches in early June.

The post Hackers Exploiting Cisco Unified CM Vulnerability appeared first on SecurityWeek.

A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions.

The post North Korean Hackers Blamed for Mastra NPM Supply Chain Attack appeared first on SecurityWeek.

A database of over 86,000 confirmed working credentials was created during the credential-harvesting campaign.

The post Fortinet Responds to FortiBleed Campaign appeared first on SecurityWeek.

HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium are among the affected Klue customers.

The post More Cybersecurity Firms Disclose Impact From Klue Hack appeared first on SecurityWeek.

The large-scale credential theft campaign hit roughly half of the internet-accessible Fortinet firewalls and VPNs.

The post FortiBleed: 86,000 Fortinet Device Credentials Compromised appeared first on SecurityWeek.

The hackers exfiltrated data from Salesforce instances of Klue customers, such as Huntress and Recorded Future.

The post Cybersecurity Firms Impacted by Klue Supply Chain Attack appeared first on SecurityWeek.

Insufficient validation of user input allows an attacker to gain access to the underlying OS and elevate their privileges to root.

The post Critical Command Execution Vulnerability Patched in Cisco ISE appeared first on SecurityWeek.

Ent has developed an intent-aware platform designed to interpret user and agent behavior before risky actions are carried out.

The post Endpoint Security Startup Ent Emerges From Stealth With $100 Million Seed Round appeared first on SecurityWeek.

By continuously analyzing security, infrastructure, and governance data, TrustCloud aims to give CISOs a real-time view of application risk and board-ready assurance.

The post Can CISOs Trust Their Applications? TrustCloud Wants to Replace the Questionnaire appeared first on SecurityWeek.

NSPM-12 establishes a clear structure for NSS cybersecurity governance and accountability and reestablishes CNSS.

The post White House Issues Memo to Bolster NSS Cybersecurity appeared first on SecurityWeek.

Cisco recently became aware of the exploitation of CVE-2026-20262, a Catalyst SD-WAN Manager zero-day that allows arbitrary file write.

The post Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks appeared first on SecurityWeek.

By default, npm install will no longer execute scripts from dependencies, unless explicitly allowed.

The post NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks appeared first on SecurityWeek.

The PoC exploits Microsoft Defender’s offline scan to spawn a SYSTEM shell when rebooting in Recovery Mode.

The post ‘GreatXML’ Zero-Day Exploit Bypasses BitLocker appeared first on SecurityWeek.

In the post-Mythos era, the company’s platform helps organizations enforce security controls across environments.

The post Aryon Security Raises $29 Million in Series A Funding appeared first on SecurityWeek.

Security teams need more than visibility into AI applications, they need a repeatable framework for monitoring, investigating, and defending them in production.

The post After AI Reaches Production: 12 Ways Security Teams Can Take Control appeared first on SecurityWeek.

Atsign’s AI Architect applies cryptographic protections to agentic software development, aiming to prevent attackers from exploiting vulnerabilities by making application identities effectively invisible.

The post New Platform Uses Cryptographic Invisibility to Protect AI-Built Applications appeared first on SecurityWeek.

The most recent variants of the self-propagating attacks are named Miasma and Hades.

The post Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks appeared first on SecurityWeek.