Klue breach exposed Salesforce CRM data through stolen OAuth tokens
An attacker broke into competitive-intelligence vendor Klue, stole OAuth tokens its customers use to connect to Salesforce and other platforms, and accessed ...
CSO Online
20 articles
Anatomy of a retail ransomware attack: Tabletop simulates modern mayhem methods
Attacks on AI systems and disinformation starred as key elements of a ransomware tabletop exercise CSO participated in during this month’s Infosecurity Europ...
6 security leader tips for mastering business risk
Longtime security leader Doug Kersten has expanded his list of responsibilities. As CISO of software maker Appfire, he now has accountability for business ri...
Why Southeast Asia CISOs Need Zero Trust as Their AI Control Plane – AI Agents, Data Borders and Supply Chains
At Zenith Live 2026 held on 16-17 June in Vienna, Zscaler sharpened a reality that Southeast Asia CIOs and CISOs are already sensing, which are, AI agents ar...
Threat actor adds advanced ‘EDR killer’ tools to ransomware-as-a-service platform
One of the world’s top ransomware groups has given its criminal affiliates access to advanced tools capable of successfully disabling many of today’s enterpr...
Microsoft broke some OLE automations with latest Windows update
Microsoft Office users may find that some of their applications are failing to open when called on by third-party applications. It’s an issue that has emerge...
Breaking the SOC triangle: How AI reshapes security operations trade-offs
A simple framework has always governed security operations that I call the SOC Triangle. It is a balance between quality, consistency and cost efficiency.
Security considerations for adopting Claude Code and Cowork for SMBs
You are a security leader at a small or medium-sized business (SMB), and your organization has decided to adopt Claude. If you are like me, after the initial...
Microsoft says web-enabled AI agents can trigger host-level RCE
Microsoft is warning of a novel remote code execution (RCE) path possible through web-enabled AI agents, demonstrating the technique against AutoGen Studio, ...
M365 Copilot SearchLeak: Your prompt injection attack surface just got bigger
A recent proof-of-concept attack against Microsoft’s M365 Copilot Enterprise highlights what could be a much broader prompt injection threat based on a commo...
Oracle releases 245 new security patches, all rated ‘high-priority security’
The Oracle Critical Security Patch update (CSPU) released this week contains 245 newly-announced fixes for supported on-premises software, some of which impa...
Attackers abuse Google Ads, GitLab, and Claude to deliver malware
Threat actors are abusing trusted platforms, including Google Ads, GitLab pages, and Claude’s shared chat feature, to trick users into executing malicious co...
FortiBleed campaign exposes 75,000 Fortinet firewalls worldwide
A massive credential-compromise campaign dubbed “Fortibleed” has been found to expose tens of thousands of Fortinet devices worldwide, with researchers warni...
New CISO appointments 2026
The upper ranks of corporate security are seeing a high rate of change as companies try to adapt to the evolving threat landscape. Many companies are hiring ...
5 new security operations roles the AI-SOC will create
For years we’ve heard the frightening prediction that AI will take jobs away from people. It will and it already is, but that doesn’t mean it won’t also crea...
Cybersecurity was built for predictable systems. AI changes the rules
Every major technology shift changes cybersecurity. I’ve spent much of my career working through major technology transitions, from the rise of the commercia...
Estonia plans government IDs giving AI agents rights and responsibilities
There’s no shortage of agentic AI tools out there that offer to perform online tasks on your behalf, if only you’ll give them all your passwords and credit c...
Google’s Vertex AI SDK could allow RCE through bucket squatting
A design flaw in the Vertex AI software development kit (SDK) for Python, Google Cloud’s managed platform for building, training, and deploying AI agents, co...
5 AI risk management frameworks for shoring up key gaps
Organizations racing to embed AI into business operations are realizing that the risk management frameworks they’ve relied on for decades aren’t built for th...
What 22,000 breaches teach us about incident preparedness
The 2026 Verizon Data Breach Investigations Report analyzed more than 22,000 confirmed data breaches across 145 countries. Its findings point to a single unc...