Latest cybersecurity reporting from selected sources.

Infosecurity 2026: What Security Leaders Agree on as AI Reshapes Enterprise RiskAI has broken the speed of attack, but not the fundamentals of defense. Drawing on interviews with security leaders at Infosecurity Europe 2026, ISMG's Pulse Report explores the collapse of the vulnerability window, rise of AI agents, erosion of digital trust and disciplines that matter most.

Patch Rollout Slows and Ransomware Incident Volume Rises, Finds Latest Verizon DBIRThe frequency of hackers exploiting vulnerabilities in hardware and software to gain initial access to a victim's environment continues to surge, and half of all successful breaches also now involve some type of "ransomware action," according Verizon's 2026 Data Breach Investigations Report.

Déjà Vu: Is Mythos in Hands of Bad Actors Akin to Cobalt Strike, Brute Ratel Abuse?Anthropic's Claude Mythos and similarly powerful artificial intelligence tools pose elevated cyber risk to the healthcare sector, warns a new report. Addressing the onslaught of newly discovered bugs will require healthcare organizations to evolve their vulnerability mindsets.

Access, Vulnerability Management, Configuration LapsesA federal watchdog agency inspection of information security at the VA health system in Spokane, Wash. last year found deficiencies across three areas - configuration management, vulnerability management and access controls - that could potentially put sensitive data at risk, a new report said.

Trellix Says Email, Identify Failures Are Among Top Vectors in Health CompromisesOf the millions of threats detected in healthcare IT environments last year, email phishing, identity failures and device vulnerabilities were among the top vectors for non-clinical IT compromises - often "cascading" and disrupting patient care, said a new report from security firm Trellix.

PLCs Increasingly in Hacker Crosshairs, Warns TrellixPatching is still the mortal weaknesses of operational technology environments, warns cybersecurity firm Trellix in a report assessing incidents in critical infrastructure settings during the middle two quarters of this year.

Google Warns of Cyber Trends Gaining TractionThe virtualized layer of technology underpinning modern IT deployments is transforming from a strength to a cybersecurity vulnerability, warns Google in a report extrapolating current trends. A confluence of factors are converting virtualized environments into a "critical blind spot."

Pen Tests Find States Thwart Basic Attacks But Are Vulnerable to Sophisticated OnesPen testing of 10 Medicaid management and enrollment systems found that while the nine states and one territory implemented "generally effective" security controls to prevent limited cyberattacks, improvements are needed to protect against more sophisticated attacks, said a watchdog agency report.

Signs Point to Multiple Exploit Chains, One Including a Zero-Day, Being EmployedData-stealing attacks targeting Oracle E-Business Suite, for which an affiliate of Russian-speaking Clop ransomware group is claiming credit, appear to have begun by August and involved multiple attack chains, of which one targeted a zero-day vulnerability, report Google threat researchers.

GenAI Chooses Insecure Code Nearly Half the Time, Veracode FindsThere's been little improvement in how well AI models handle core security decisions, says a report from application security company Veracode. Large language models introduce vulnerabilities in nearly half of test cases when asked to complete secure code tasks, it found.

Senator Declines to Lift Hold on Trump's CISA Nominee Without Clear TimelineThe U.S. Cybersecurity and Infrastructure Security Agency plans to release a report on telecom vulnerabilities exploited in the Salt Typhoon cyberespionage campaign to help move along President Donald Trump's nomination to lead the agency - but Sen. Ron Wyden still intends to delay the vote.

Gigamon 2025 Survey: 17% Increase in Attacks as Public Cloud Vulnerabilities MountAI is transforming enterprise landscape, organizations report a 17% jump in cyber breaches over the past year. Security teams struggle with visibility gaps while adversaries weaponize AI to strike harder and faster, according to the Gigamon 2025 Hybrid Cloud Security Survey.

Eclypsium Report Describes BIOS/UEFI Issues in Illumina iSeq 100 FirmwareCertain vulnerabilities in device maker Illumina's iSeq 100 DNA gene sequencer could allow hackers to overwrite the system's firmware to render the device unusable or to install a firmware implant for ongoing attacker persistence, said researchers at Eclypsium who identified the flaws.

Federal Agencies Tasked with Adopting New Cloud Security Policies Beginning in 2025The Cybersecurity and Infrastructure Security Agency is requiring federal agencies to adopt secure cloud configurations, integrate monitoring tools and report cloud systems starting in 2025 as part of an effort to address vulnerabilities in part exposed by the SolarWinds attack.

Inspector General Report Reveals 97 Water Systems with Critical Cybersecurity RisksThe Environmental Protection Agency inspector general said over 100 million Americans depend on drinking water systems exposed to cybersecurity flaws that could allow hackers to "disrupt service or cause irreparable physical damage to drinking water infrastructure."

New Report Finds Chemical Firms Are Investing in Cyber, Raising CISO VisibilityChemical companies have significantly boosted their cyber budgets over the past five years, according to a 2023 cyber survey published Monday, as awareness of cybersecurity vulnerabilities has steadily risen across the industry and new U.S. and E.U. regulations loom on the horizon.

Redmond Calls Tenable Report Evidence of Customers Misconstruing Azure Service TagsMicrosoft is calling security research asserting a high-severity vulnerability exists in Microsoft Azure evidence that customers should better configure their cloud environments. An attacker with an Azure instance could obtain access to company resources by sending customizable HTTP requests.

GE HealthCare Says Risks Can Largely Be Mitigated Through Security Best PracticesSecurity researchers have found 11 vulnerabilities in certain GE HealthCare ultrasound products that could allow malicious actors to physically implant ransomware or manipulate patient data stored on the affected devices. GE said the risks can be mitigated through best security practices.

Researchers Discover Major Vulnerabilities in Popular Central Management PlatformResearchers identified major security vulnerabilities in F5's Next Central Manager that could allow hackers to gain a persistent, undetectable presence within any organization's network infrastructure connected to F5 assets, according to a Wednesday report.

Data Breach Report Lead Author Alex Pinto Discusses Top Findings, Best PracticesVerizon's 17th annual 2024 Data Breach Investigations Report highlights a troubling trend: The exploitation of vulnerabilities in the wild has tripled, primarily due to ransomware actors targeting zero-day vulnerabilities, such as the MOVEit flaw that triggered numerous data theft incidents.