Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Enterprise AI is increasingly connected to sensitive data, business applications, APIs, and automated workflows. But the security controls surrounding these systems are not always keeping pace. IBM's 2025 Cost of a Data Breach Report found that 13% of organizations experienced breaches involving AI models or applications, and 97% of those organizations lacked proper AI access controls.

Five worthy reads is a regular column on five noteworthy items we’ve discovered while researching trending and timeless topics. In this edition we talk about the biggest tension in tech right now, which isn't building AI faster but surviving the security shortcuts taken to launch it and discover how smart teams can rewrite the play-book on governance.

On Patch Tuesday in January 2023, Microsoft fixed a privilege escalation flaw in afd.sys, the Windows driver behind the Winsock networking interface. Two IBM X-Force researchers who had never worked with that driver compared the old and new versions of the file and had a working exploit for Windows 11 in about a day. China's 360 IceSword Lab later reported finding the same flaw already exploited in the wild that month.

On October 21, 2026, PHP fixed two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. CISA added both to its Known Exploited Vulnerabilities catalog on October 26th. The real fix is upgrading PHP and restarting every worker process. But many Windows servers can’t do that yet: the vendor hasn’t certified the new version, the PHP branch is end-of-life, or nobody knows whether a PHP copy exists inside an old application.

We need to face a bitter truth: Most security awareness training out there just doesn’t work the way it’s supposed to. Year after year, companies worldwide pour billions into all sorts of training programs, posters, and click-through modules, yet phishing click incident rates stubbornly persist with no sign of them fading away any time soon. So, what are we missing? According to Verizon’s Data Breach Investigations Report, the human element is involved in 62% of breaches.

Enterprise networks host a variety of devices, from workstations and VoIP phones to printers and IoT devices. Each group may have different network configuration requirements, making it increasingly difficult to maintain consistent settings as the network grows. Microsoft DHCP policies help address this challenge by evaluating attributes in DHCP requests and applying configurations based on defined conditions.