Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Ask a room of security leaders whether they have a complete, current inventory of everything on their network, and watch how long it takes anyone to say yes. Effort is rarely the issue. Modern environments change faster than any single record can keep up with. A configuration management database (CMDB) shows what was documented. An endpoint tool shows where its agent is installed. A scanner shows what it was told to scan.

ISO 42001 is the management system standard for artificial intelligence. It sits on the backbone of ISO 27001 but with a different focus: do you have a system for governing AI, and can you prove that system runs, with evidence? Core to the standard is an Artificial Intelligence Management System (AIMS), a structured set of policies, processes, and controls an organization uses to govern AI.

The tokenmaxxing era has left companies grappling with an uncomfortable reality. Now that AI vendors have switched to usage-based billing models, businesses are facing sky-high bills, and IT and finance teams are under pressure to rein in spending without slowing down innovation.

Today we're releasing universal sign-in, a new experience from 1Password that provides a seamless and secure way to sign into any site with your preferred method. It's currently available to all customers in the latest version of the 1Password browser extension.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! BGP attacks are quite something in scope of damage.

For business logic attacks, prioritize runtime behavioral detection over API discovery alone, tools that map workflows and catch abuse mid-sequence, not just at the request level. AppSentinels leads with a purpose-built Business Logic Graph plus behavioral fraud detection; Salt Security and Cequence are also strong runtime-behavioral options. Picture this: someone applies the same discount code 40,000 times in a row, or slides a decimal point in a checkout request to buy a $500 item for $5. No malware.

TL;DR: We found another delayed RCE in MECCHA CHAMELEON. When playing on an attacker’s map, they can abuse an exposed function to arbitrarily write files to the victim’s system. This can lead to remote code execution on the victim’s system after a restart. We reported the issue to the game’s maintainers, and they fixed the vulnerability in the 4.0.0 update. This update is automatically installed before launching the game.

A library of Calico tools and skills — delivered through the Calico MCP Server.

Nucleus Insights flagged 14 vulnerabilities with real-world exploitation activity that looked risky before CISA added them to KEV. The key takeaway: all 14 were later listed in KEV. Acting on those signals would have been the right call every time, just earlier.