Your contractor holds your data, and the ETS notice shows the risk
A third party data breach at ETS exposed California student records. Here is what the notice confirms and five vendor checks security buyers can use now.
CISA KEV and the three-day clock that a vendor has to answer
CISA KEV listed an Ivanti Connect Secure zero-day on 13 October with a 16 October due date. What was observed, what was only claimed, and what to publish.
Remote access security, and the controllers nobody meant to publish
Exposed Danfoss refrigeration controllers show why remote access security starts at the management interface. What CERT-FR said, and what to fix now first.
Malvertising does not break your product, it borrows your name
Malvertising turns brand trust into the attack surface. See what the Ledger probe has and has not shown, plus five practical moves for brands facing fake ads.
The EPSS score and five old flaws in a fresh joint advisory
An EPSS score above 0.96 on three old CVEs, a joint advisory from ten agencies and a federal 11 October deadline: what the numbers really show a security team.
Post quantum cryptography meets the medical device: a headline that overreads its data
Post quantum cryptography in healthcare: Forescout’s 6% IoMT figure measures SSH, not upgrade limits. Here is the honest read and the claims that stay true.
Citrix NetScaler zero-days: a 72-hour brief for security vendors who want to be believed
Citrix NetScaler zero-days landed on 27 September. See what security vendors can honestly say in the first 72 hours, and how three rivals said it, with sources.
AI agent safety gets two gates in NVIDIA’s new platform
AI agent safety is moving from prompts to runtime policy. What NVIDIA OpenShell and Sentry offer, what the evidence shows, and what buyers should test first.
The lead form was the way in: indirect prompt injection and the SalesBleed lesson
SalesBleed turned a Salesforce lead form into a zero-click leak. What indirect prompt injection means for marketing teams and security vendors, in five moves.
The cyber threat landscape in ENISA’s 2026 report: the loud attacks are not the costly ones
The cyber threat landscape in ENISA’s 2026 report: DDoS made the noise, ransomware and unpatched flaws did the damage. 5 sharp lessons for security marketers.