The cybersecurity industry has spent the last several years chasing sophisticated threats like zero-days, supply chain compromises, and AI-generated exploits. However, the most reliable entry point for attackers still hasn't changed: stolen credentials. Identity-based attacks remain a dominant initial access vector in breaches today. Attackers obtain valid credentials through credential stuffing from prior breach databases, password spraying against exposed services, or phishing campaigns — and use them to walk through the front door. No exploits needed. Just a valid username and password. What makes this difficult to defend against is how unremarkable the initial access looks. A successful login from a legitimate credential doesn't trigger the same alarms as a port scan or a malware callback. The attacker looks like an employee. Once inside, they dump and crack additional passwords, reuse those credentials to move laterally, and expand their foothold across the environment. For ransomware crews, this chain leads to encryption and extortion within hours. For nation-state actors, the same entry point supports long-term persistence and intelligence gathering. AI Is Accelerating What Already Works The fundamental attack pattern here hasn't changed much. But what has changed is the speed and polish with which it gets executed. Attackers are leveraging AI to scale their operations by automating credential testing across larger target sets, writing custom tooling faster, and crafting phishing emails that are materially harder to distinguish from legitimate communications. This acceleration puts additional pressure on already-stretched defenders. Breaches are unfolding faster, spreading further and touching more of the environment, from identity systems to cloud infrastructure to endpoints. IR teams built for a slower tempo of engagement are finding that their existing processes can't keep pace. A Dynamic Approach to Incident Response This is where the way teams think about incident response matters as much as the technical controls they deploy.
Apr 21, 2026 · via thehackernews.com
This initiative aims to enhance access to the Falcon platform for small and medium-sized businesses (SMBs). Details CrowdStrike announced an expansion of its Managed Security Service Provider (MSSP) strategy, partnering with Dicker Data and Otsuka Corporation to increase SMB access to its Falcon platform. This move is expected to accelerate AI-driven cybersecurity transformation, allowing MSSPs to deliver tailored security services to meet growing regional demand. Jon Fox, vice president of channels and alliances, CrowdStrike Japan and Asia Pacific, added, “Budget constraints, complexity, and resource limitations continue to challenge businesses, with SMBs experiencing these challenges at a greater scale. Together with our partners, we are expanding access to the AI-powered protection that enables organizations to stay focused on their core business.” Technical Analysis The broader market saw gains on Monday, with the Technology sector rising 0.21%. CrowdStrike’s performance aligns with this positive sentiment, indicating that the stock is moving with broader market trends. CrowdStrike is currently trading within its 52-week range, showing a solid position compared to its recent performance. The stock is trading 9.4% above its 20-day simple moving average (SMA), indicating short-term strength, while it is 0.4% below its 100-day SMA, suggesting some intermediate weakness. The relative strength index (RSI) is at 59.29, indicating neutral momentum. This level suggests that the stock is neither overbought nor oversold, which may lead to a stable trading environment. - Key Resistance: $452.00 — This level may act as a barrier for upward movement. - Key Support: $364.50 — This level could provide a safety net for buyers if tested. CrowdStrike has shown a 12-month performance of 19.43%, reflecting a positive trend over the longer term. This performance suggests that the stock is maintaining upward momentum, despite some fluctuations along the way. Recent Earnings & Buyback Boost Annual recurring revenue (ARR) climbed 24%
Apr 21, 2026 · via benzinga.com
Outdated software has become a major cybersecurity liability Why AI‑accelerated threats are making patch delays untenable Takeaways - AI is compressing the vulnerability‑to‑exploit timeline, giving defenders less time to respond to newly disclosed flaws - Most attacks still target known, unpatched vulnerabilities, making outdated software a persistent and preventable risk - Automated updates and rollback capabilities are no longer optional, as manual patching cannot keep pace with modern threat activity In the artificial intelligence (AI) era, IT and cybersecurity teams must ensure every device runs the most secure software version available. As cybercriminals gain access to more advanced AI models, the amount of time and effort required to first discover a vulnerability and develop a means to exploit it is now approaching zero. While that is likely to increase the number of unknown zero-day vulnerabilities that might be exploited, most cybercriminals will—at least initially—focus on exploiting known vulnerabilities faster than ever. Unfortunately, there is no shortage of existing vulnerabilities to be exploited. For example, a Jamf Threat Labs analysis of 1.7 million iOS and Android devices and over 150,000 Mac devices finds more than half (53%) of organizations discovered they had devices with critically out-of-date operating systems. Additionally, 75% of devices had at least one vulnerable application installed. In fact, 95% of the applications assessed contained at least one medium-severity vulnerability, with 62% enabling dangerous permissions. A full 44% of devices had been exposed to malicious network traffic. Historically, many IT teams have been reluctant to deploy the latest version of any type of software for fear the update would break the application. However, as cybersecurity threats become more sophisticated the potential damage that might be unleashed by a successful cybersecurity attack is in many cases starting to exceed the risk that might occur if an application was unavailable. The
Apr 21, 2026 · via blog.barracuda.com
The IS&T Experience Episode 4: Leadership and Cybersecurity
Meet Zaid Kakish, a UNO student who unlocked new opportunities and deepened his mastery of cybersecurity by staying involved and leading an impactful student club.
- published: 2026/04/20
- contact: Kaylee Pena Guerrero - College of Information Science and Technology
This episode features Zaid Kakish, a cybersecurity graduate student at the University of Nebraska at Omaha (UNO), and Martha Garcia-Murillo, Ph.D., Dean of the UNO College of Information Science & Technology (IS&T). Kakish shares their involvement on campus through Nullify, a student club that explores cybersecurity fundamentals, tools, workshops, and current industry topics—all while hosting guest speakers and organizing community events.
Watch Episode on Youtube
About the IS&T Experience Series
The IS&T Experience gives an insider look at the people and stories shaping the future of technology at the University of Nebraska Omaha's College of Information Science & Technology. Through engaging conversations with students, faculty, staff, alumni, and community partners, discover the experiences that define our community—from navigating career development and research breakthroughs to building the skills that prepare the next generation of technology leaders.
Learn more about the College of Information Science & Technology
Apr 21, 2026 · via unomaha.edu
ZAWYA: OPSWAT and Emerson to strengthen cybersecurity for critical infrastructure operators with global reseller agreement Dubai, United Arab Emirates – OPSWAT, a global leader in critical infrastructure cybersecurity, and Emerson EMR, a global automation leader, have announced a global strategic reseller agreement that will bring OPSWAT’s industry-proven cybersecurity technologies to Emerson’s power and water industry customers. As the first initiative under this enterprise-wide agreement, Emerson will integrate OPSWAT’s scalable and safe operational technology (OT) patch management capabilities into its Ovation™ Automation Platform. The new OT patch management solution further builds on the collaboration to date by securing the Ovation Platform through OPSWAT’s MetaDefender Endpoint™ and My OPSWAT™ Central Management On-Premises, part of Emerson’s purpose-built power and water cybersecurity suite of solutions. “Our customers need cybersecurity solutions designed specifically for operational technology—not adapted from IT,” said Robert Yeager, President of Emerson’s power and water solutions business. “They benefit from purpose-built OT cybersecurity solutions that protect critical, real-time industrial systems while supporting availability, performance, and safe operations. Collaborating with OPSWAT enhances our ability to help operators protect their Ovation Automation Platform with a modern, OT appropriate approach to patch management. It reflects our commitment to delivering proven, efficient, best-in-class protection for critical infrastructure.” Critical infrastructure operators, including power generation and water/wastewater utilities, continue to face increasing cyber threats, regulatory pressure, and operational risk stemming from unpatched vulnerabilities. OPSWAT’s solution for the Ovation Automation Platform delivers a modernized patch management approach designed specifically for industrial environments, addressing challenges posed by a mix of modern and legacy tools and the ongoing surge of nation-state and ransomware activity targeting the energy and water sectors. “As LLMs, automation, and digital transformation accelerate across power and water infrastructure, the attack surface expands just as quickly,” said Benny Czarny, Founder and CEO of OPSWAT. “In environments where safety
Apr 21, 2026 · via tradingview.com
AI cloud company Vercel breached after employee grants AI tool unrestricted access to Google Workspace — hacker seeking $2 million for stolen data The culprit? An infostealer infection from a Roblox cheat download. Get Tom's Hardware's best news and in-depth reviews, straight to your inbox. You are now subscribed Your newsletter sign-up was successful Vercel, the cloud platform behind the widely used Next.js web framework, has acknowledged a security breach after an attacker compromised a third-party AI tool called Context.ai and used it to gain access to a Vercel employee's enterprise Google Workspace account. The breach exposed non-sensitive environment variables, and a threat actor operating under the ShinyHunters name has claimed responsibility, reportedly seeking $2 million for the stolen data. Vercel said it has engaged Google-owned incident response firm Mandiant, notified law enforcement, and contacted a limited subset of affected customers directly. According to Vercel’s bulletin, the breach didn’t start with them but instead with Context.ai, an enterprise AI platform that builds agents trained on company-specific knowledge. At least one Vercel employee had signed up for Context.ai's AI Office Suite using their corporate account and granted it "Allow All" OAuth permissions, Context.ai explained in its own security notice, which says that “Vercel’s internal OAuth configurations appear to have allowed this action to grant these broad permissions in Vercel’s enterprise Google Workspace.” The attacker exploited that broad access to take over the employee's Vercel Google Workspace account and move laterally into internal systems. Article continues belowCybersecurity firm Hudson Rock claims to have traced Context.ai's own compromise back further to an employee infected by Lumma Stealer malware after downloading Roblox game exploit scripts in February. The stolen credentials reportedly included Google Workspace logins along with keys for Supabase, Datadog, and Authkit, Hudson Rock reported, but Vercel hadn’t independently confirmed this at the
Apr 21, 2026 · via tomshardware.com
About
Press
Copyright
Contact us
Creators
Advertise
Developers
Terms
Privacy
Policy & Safety
How YouTube works
Test new features
NFL Sunday Ticket
© 2026 Google LLC
Apr 21, 2026 · via youtube.com
Expanded go-to-market empowers distributors to recruit and onboard MSSPs, increasing SMBs access and adoption of the Falcon platform AUSTIN, Texas & DA NANG, Vietnam--(BUSINESS WIRE)--Apr. 20, 2026-- JAPAC Partner Symposium -- CrowdStrike (NASDAQ: CRWD) today announced an expansion of its Managed Security Service Provider (MSSP) go-to-market strategy across Japan and Asia Pacific (JAPAC), increasing access to the CrowdStrike Falcon® platform for small and medium-sized businesses (SMBs) and accelerating AI-driven cybersecurity transformation. Through expanded strategic partnerships with Dicker Data and Otsuka Corporation, this distributor-led aggregation model enables partners to onboard MSSPs at scale and deliver managed security services that bring AI-powered protection to SMBs. Independent research from Canalys shows that for every $1 of Falcon platform sales, partners can generate up to $7 in services revenue – validating CrowdStrike’s services-led ecosystem as a key driver of partner growth and profitability. Building on this momentum, CrowdStrike’s distributor-led model enables select distributors to recruit and activate MSSPs across JAPAC, with flexible billing through distributor marketplaces. This approach allows MSSPs to quickly build and deliver tailored offerings, expanding access to enterprise-grade security and meeting growing regional demand from SMBs. “Distributors and MSSPs are pivotal to scaling CrowdStrike’s reach across JAPAC and helping organizations modernize their security for the AI era,” said Jon Fox, vice president of channels and alliances, CrowdStrike Japan and Asia Pacific. “Budget constraints, complexity, and resource limitations continue to challenge businesses, with SMBs experiencing these challenges at greater scale. Together with our partners, we are expanding access to the AI-powered protection that enables organizations to stay focused on their core business.” Supporting Partner Quotes: "Cybersecurity continues to be a key growth driver for the ICT channel, with many SMBs needing access to additional capabilities to defend against modern threats," said Vlad Mitnovetski, executive director and chief operating officer of Dicker Data.
Apr 21, 2026 · via ir.crowdstrike.com
About
Press
Copyright
Contact us
Creators
Advertise
Developers
Terms
Privacy
Policy & Safety
How YouTube works
Test new features
NFL Sunday Ticket
© 2026 Google LLC
Apr 21, 2026 · via youtube.com
CISA Adds Eight Known Exploited Vulnerabilities to Catalog CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. - CVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability - CVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerability - CVE-2025-2749 Kentico Xperience Path Traversal Vulnerability - CVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability - CVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability - CVE-2026-20122 Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability - CVE-2026-20128 Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability - CVE-2026-20133 Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. This product is provided subject to this Notification and this Privacy & Use policy.
Apr 21, 2026 · via cisa.gov
Education & Training Advance Your Cybersecurity Career Practical advice for cyber professionals seeking to advance their careers. Security Magazine: What education or certification(s) can support a successful career in cybersecurity? Jenkins: As a hiring manager for more than 20 years, I recognize and appreciate that having a degree or being “certified” is not necessarily indicative of knowledge, skill, or long‑term success. I have hired several candidates — and worked with many colleagues — who had no formal credentials to speak of, yet they were highly skilled and successful in their fields. That said, having one or more degrees or certifications related to your career — in this case, cybersecurity — does imply a certain level of foundational knowledge, discipline, and the ability to synthesize information. Relevant education and certifications also help establish a shared vernacular and common thought processes, which creates useful points of reference when working with others in the same professional domain. Education that supports a successful career in cybersecurity, even if not explicitly labeled as such, includes related technical and engineering disciplines such as computer science, information technology, computer engineering, and electrical engineering. Useful corollaries include business- and policy‑oriented education in areas like information systems, business administration, and even privacy or technology law. Certifications include the obvious examples — CISSP, CISM, CRISC, CompTIA Security+, and others. Ultimately, what matters most to me as a hiring manager is hands‑on experience, demonstrated skills, certifications that align to the role, and the relevance of a candidate’s educational background. Aspiring leaders must also know how to build trust — both with their teams and with executive leadership. These capabilities are not ‘nice to have’; they are foundational skills for anyone seeking to lead effectively in cybersecurity. Security: What “soft skills” should aspiring security leaders develop? Jenkins: Negotiation, compromise, and the ability
Apr 21, 2026 · via securitymagazine.com
Airdate: Tuesday, April 21 at 10 AM
The San Francisco AI firm Anthropic has developed a new model that it says is too powerful to be released to the public. Called Mythos, Anthropic says it’s in a “different league” when it comes to identifying and exploiting cybersecurity vulnerabilities, and in the wrong hands could enable bad actors to unleash powerful cyberattacks. Anthropic is alerting governments and releasing a limited version called Claude Mythos Preview to about 40 tech companies (including some of its AI competitors) to find and fix their own security vulnerabilities. We look at how this next generation of AI could reshape digital security and policy.
Apr 20, 2026 · via kqed.org
This website uses certain cookies, pixels and similar tracking technologies in order enhance site navigation, analyze site usage, and assist in our marketing efforts. Certain information collected by that technology may be shared with our third party partners. By continuing to use this website, you agree to the use of these technologies. The April 14 Park County Commission meeting was held in the City/County Complex in Livingston. The City of Livingston and Park County are developing a cybersecurity incident response plan. It’s part of an effort to ensure public resources aren’t compromised by hackers and other malicious actors. State, local, tribal and territorial governments are frequent targets of cyberattacks and are on the front lines of cybersecurity, according to a fact sheet from the U.S. Cybersecurity and Infrastructure Security Agency. “Whether it’s a phishing email targeting a small-town clerk or ransomware disrupting a huge city’s emergency services, you see real threats every day,” reads the fact sheet. Park County commissioners will consider adopting a resolution on Tuesday to establish the Park County-City of Livingston Computer Security Incident Response Team to support the development and implementation of the Park County Cybersecurity Incident Response Plan. The team would include a core IT group consisting of the county IT director and two people appointed by the director; and a staff support group composed of the county emergency management director, county HR director, city HR director, someone appointed by the sheriff, county commission assistant, and the county maintenance director. The purpose of the IT group will be to direct cybersecurity incident response efforts, analyze cybersecurity incidents, recommend technical containment actions, and other such efforts as appropriate, according to the proposed resolution. The staff group will support the efforts of the IT group and engage appropriate city and county departments. Commissioners will consider the resolution
Apr 20, 2026 · via livingstonenterprise.com
At the same time, the city board that manages the office ignored concerns from other city departments and officials that the office may have violated state laws, a member of the Madison City Council said. Madison police paused openly sharing data with the Office of the Independent Police Monitor and requested an internal review of its employees’ handling of sensitive documents after learning that sensitive, unredacted documents it had provided the office were being uploaded to a personal device and analyzed with software not approved by the city’s IT department. Cybersecurity isn’t the city’s only concern with the monitor’s office. In an email the Wisconsin State Journal obtained through a public records request, Ald. MGR Govindarajan told the chair of the Police Civilian Oversight Board, Maia Pearson, the office’s staff were working beyond allotted hours, circumvented the city’s AI policy and purchased and contracted services without following city guidelines. “While independence in its core function is both important and necessary, extending that independence to areas such as compliance with City policies and legal requirements creates risk not just for the OIM, but for the City as a whole,“ Govindarajan wrote. POLICE PUSHBACK AGAINST DATA SHARING Police paused record-sharing on Nov. 7 after the monitor’s data analyst, Greg Gelembiuk, told Assistant Police Chief Angie Kamoske that he had used his personal computer to analyze police records provided to the monitor’s office. According to an internal memo from Madison Police Chief John Patterson, Gelembiuk called his city-issued laptop a “paperweight“ and stated that he received permission from the previous monitor, Robin Copley, to use his own device. Gelembiuk never received approval from the city’s IT department to use his own computer for the work. He also reportedly told Kamoske that he used software that IT initially rejected. “I have ‘data analyst’ in
Apr 20, 2026 · via govtech.com
The House Appropriations Financial Services and General Government (FSGG) Subcommittee advanced its fiscal year (FY) 2027 appropriations bill on Friday, including $5 million for the Technology Modernization Fund (TMF) and millions in appropriations for cybersecurity improvements. In the FY 2027 FSGG bill, House appropriators included $5 million in total funding for the TMF “to remain available until expended.” The TMF – overseen by the General Services Administration (GSA) – was created in 2017 under the Modernizing Government Technology Act to fund federal civilian agencies’ technology modernization projects. House appropriators’ draft differs slightly from the White House’s FY 2027 budget proposal. The White House asked for no direct appropriation for the TMF and instead recommended relying on budget transfer authority to fund the program. That approach would allow GSA – with the Office of Management and Budget’s approval – to collect up to $100 million in unobligated appropriations across federal agencies to fund the TMF. The House, according to its bill, is instead considering funding the TMF directly. The $5 million in funding – if enacted – would match what Congress ultimately approved for FY 2026 TMF appropriations. Beyond TMF-related funding, the 2027 FSGG bill takes a largely decentralized approach to IT funding. It expands agencies’ ability to redirect existing funds toward IT modernization, allowing up to 5% of certain appropriations to be transferred into IT working capital funds. At the same time, the bill continues support for shared digital services through GSA, with the Federal Citizen Services Fund authorized to finance interagency IT projects and improvements to online government services, up to $150 million. The measure channels funding into data and analytics capabilities, particularly for Treasury systems used in financial analysis and data processing. The bill does not include major new artificial intelligence funding, but it still enables agencies to
Apr 20, 2026 · via meritalk.com
Highlights - Cybersecurity demand continues to reshape digital defense priorities - Leading firms expand influence across enterprise ecosystems - Market momentum reflects resilience in evolving threat landscapes Cybersecurity continues to evolve as a critical industry, driven by innovation, cloud adoption, and identity protection, strengthening digital ecosystems and supporting resilient operations across global enterprises. The cybersecurity sector continues to command strong attention as digital transformation accelerates across industries, with companies like Palo Alto Networks (NASDAQ:PANW) standing at the forefront of innovation. As organizations navigate increasingly complex cyber risks, the sector’s evolution is closely tied to broader market benchmarks like the S&P 500 Index (SPX), reflecting its growing importance in the modern economy. This shift highlights how cybersecurity is no longer optional but a foundational pillar of enterprise strategy, shaping how businesses operate, secure, and scale in a connected world. Industry Expansion Trends Cybersecurity has moved beyond traditional network protection into a comprehensive ecosystem that includes cloud security, identity verification, endpoint protection, and threat intelligence. This transformation is fueled by the rapid adoption of remote work environments, cloud infrastructure, and data-driven operations. Organizations across sectors are investing heavily in robust digital defenses to safeguard sensitive information and maintain operational continuity. As cyber threats become more sophisticated, companies specializing in proactive threat detection and response are gaining prominence. Evolving Threat Landscape The cybersecurity landscape is continuously evolving, driven by emerging technologies and increasingly sophisticated cyber threats. From ransomware attacks to data breaches, organizations face persistent risks that require advanced defense strategies (NASDAQ:PANW). Cybersecurity firms are responding by investing in automation, artificial intelligence, and predictive analytics. These technologies help identify vulnerabilities before they can be exploited, enabling faster and more effective responses to potential threats. Cloud Security Takes Center Stage Cloud adoption has become a defining trend in modern business operations, and with it
Apr 20, 2026 · via kalkinemedia.com
Understanding Cybersecurity Maturity Model Certification: The New Standard for Doing Business with the Department of Defense The post Understanding Cybersecurity Maturity Model Certification: The New Standard for Doing Business with the Department of Defense appeared first on Welcome to the PKWARE Blog – PKWARE®. For anyone working with or hoping to work with the Department of Defense (DoD), cybersecurity compliance is no longer optional. It’s now a condition of doing business. The DoD created the Cybersecurity Maturity Model Certification (CMMC) to solve a growing problem within the defense supply chain: inconsistent protection of sensitive information and unreliable self-reporting of compliance. CMMC changes that equation. It replaces self-attestation with formal certification, holding every defense contractor to clearly defined technical and legal standards. For thousands of organizations across the Defense Industrial Base (DIB), those standards are both explicit and non-negotiable. Why Cybersecurity Maturity Model Certification Exists The DoD depends on a vast network of suppliers, subcontractors, and service providers. These organizations handle two main types of information: - Federal Contract Information (FCI): Data generated under government contracts not meant for public release - Controlled Unclassified Information (CUI): Sensitive but unclassified material such as technical drawings, specifications, or export-controlled data Before CMMC, the government relied on contractors to self-report compliance with the NIST SP 800-171 cybersecurity framework. However, assessments revealed large gaps—particularly around encryption and data protection. The result was predictable. The outcome was inconsistent safeguards across the supply chain. With this comes increased risk to national security. CMMC aims to correct that, ensuring accountability through verified audits and standardized certification. The Three Levels of Compliance CMMC 2.0 organizes requirements into three tiers: Foundational: Level 1 - Defines the basic safeguards for contractors handling FCI only. - Directs organizations to self-assess their compliance with 17 core practices. Advanced: Level 2 - Applies to
Apr 20, 2026 · via securityboulevard.com
The greatest documentarians of computer vulnerabilities are completely overwhelmed and cannot keep up with the security holes, given the speed at which they are occurring. This is the main conclusion of the statement sent by the U.S. National Institute of Standards and Technology (NIST). The agency has announced that from now on they will only add details and information to those records of failures that meet certain criteria. To date, the NIST had strictly fulfilled its mission to catalog all CVEs (common vulnerabilities and exposures) as they occurred. The agency was responsible for adding descriptions and data to each failure after being listed in the National Vulnerability Database (NVD). However, the avalanche of new entries has made this task impossible for its staff. It is known that only 21 people are working on monitoring and documenting these bugs. The volume of vulnerabilities has increased massively in recent years. From 2020 to 2025, CVE submissions grew by 263%. And this year, the situation has escalated even more. "Requests during the first three months of 2026 are almost a third higher than those in the same period last year. We are working faster than ever... but it is not enough to keep up," the agency acknowledged. Selective with the 'enrichments' Therefore, NIST has decided to be selective with the 'enrichments'. This term refers to those vulnerabilities that receive additional information after being identified. Just last year, 42,000 entries were 'enriched'. Thus, although new CVEs will be incorporated into the list, only those failures actively exploited by the CISA agency, flaws in software used by the federal government, and vulnerabilities in programs considered critical will be updated. With these filters, some streamlining is expected. The idea is to be able to provide additional information on the most critical security issues within 24 hours.
Apr 20, 2026 · via escudodigital.com
A cybersecurity company based in Mexico, BePrime, was reportedly the victim of a cyberattack that allegedly resulted in the leak of 12.6 GB of data and access to network infrastructure and video surveillance, according to information published by the supposed attacker on a cybercrime forum. The company, which provides connectivity and security services to large corporations such as Iberdrola, ArcelorMittal, Whirlpool, or Alsea (operator of Starbucks, Domino's, and Vips), was allegedly compromised by accessing administrator accounts without multifactor authentication (MFA), according to the malicious actor's claims. That is, although it seems paradoxical, the company apparently did not have one of the most basic and recommended security measures for critical environments. The attacker claims to have used credentials and API keys associated with Cisco Meraki environments to take control of 1,858 network devices, including switches and routers, which would have given them access to the traffic of more than 2,600 connected devices, as reported by journalist Ignacio Gómez Villaseñor on his X profile. Among the allegedly extracted data would be plaintext credentials, transaction information, and—more seriously—security audit reports (pentests). These would detail point by point current vulnerabilities of each client. "The irony that a firm selling cybersecurity was breached for not having two-factor authentication (2FA) on its administrator accounts results in a total loss of trust," notes hacker Alberto Daniel Hill on X. "The dissemination of unalterable visual evidence, such as screenshots of Cisco Meraki panels and live surveillance cameras, creates a 'forced transparency' in front of public opinion that prevents the company from covering up or minimizing the attack," he adds. For this cybersecurity professional, the incident is of great severity, as "unauthorized access to the control systems of energy sector suppliers represents a direct threat to Mexico's energy sovereignty and national security." BePrime admits the security breach In a
Apr 20, 2026 · via escudodigital.com
SINGAPORE - Media OutReach Newswire - 20 April 2026 - As digital lending continues to grow in Singapore, borrowers are placing greater emphasis on both convenience and the security of their personal information. Lending Bee® has responded to these evolving expectations by strengthening its digital capabilities alongside its cybersecurity and data protection standards. As a licensed money lender in Singapore, the company continues to invest in technology and governance to deliver a safer and more reliable borrowing experience. Recognised by the Singapore FinTech Association (SFA) with the SFA FinTech Certificate under the Credit Assessment and Lending category, Lending Bee® has established itself as a digitally progressive player within the regulated lending space. The recognition reflects its role in advancing the digitalisation of traditional moneylending processes within a regulated framework. Through its proprietary digital solutions and mobile-enabled services, Lending Bee® has streamlined personal loan application processes, allowing customers to receive outcomes more quickly and with greater transparency. This approach reflects the company’s focus on improving accessibility while maintaining responsible lending practices. At the same time, Lending Bee® has strengthened its cybersecurity framework to ensure that customer information remains protected in an increasingly digital environment. The company has upgraded its IT infrastructure with enhanced security architecture, improved system isolation, and reinforced monitoring capabilities to better detect and mitigate potential risks. Access control measures have also been further strengthened, alongside enhancements to user access management processes such as regular reviews and improved authentication practices, to reinforce accountability across the organisation. To align with national cybersecurity standards, Lending Bee® has initiated its roadmap towards obtaining Singapore’s Cyber Essentials certification, reinforcing its commitment to maintaining high standards of data protection and system security. Beyond internal systems, the company has enhanced its vendor governance and compliance processes, including periodic assessments and independent evaluations, to ensure that
Apr 20, 2026 · via galvnews.com