Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In April 2026, Mexican President Claudia Sheinbaum announced that individuals will no longer need a Federal Taxpayer Registry (RFC) number to open an N2 or N3 bank account. As the country continues its transition to cashless payments, this move has the potential to bring more than 32 million unbanked, informal workers into the financial system. But it doesn’t come without risk.

Corelight, a leader in fueling the AI SOC, today announced that it is providing industry-leading data to power AI investigations of emerging threats through an integration of Corelight Open NDR into Cloud Control Studio. Cloud Control Studio is the design space within Cisco Cloud Control, Cisco’s unified platform for agentic IT operations, where customers can build AI agents and connect them to non-Cisco tools.

In the public sector, it’s not uncommon for disruptions of critical infrastructure to ripple outward and wreak major havoc on systems and communities whether the cause is a technical issue, a natural disaster, or a cyber attack. As critical infrastructure becomes more connected through distributed systems and IoT devices, the attack surface continues to expand.

Gartner named Zenity the Company to Beat in AI Agent Governance on April 17, 2026. That recognition, grounded in technical capabilities, customer implementations, ecosystem breadth, and business model, isn't a marketing award. To us, it's the analyst community confirming that purpose-built architecture for agentic AI is winning. The recognition didn't come in isolation. Gartner's own language captures the stakes.

Zero-Shot Learning is a podcast about how AI gets built, secured, and deployed. Hosted by Nancy Wang, 1Password CTO, and Dev Tagare, Senior Director of Engineering at Google, it's a builder's view of the architecture and the complex choices it takes to ship with AI.

On May 25, 2026, the maintainer of jqwik, a Java property-based testing library, released version 1.10.0 to Maven Central with a hidden instruction intended for AI coding agents. The payload told agents to disregard previous instructions and delete all jqwik tests and code. It was hidden from humans with ANSI terminal codes but left fully readable to any tool that captures raw output.

For many organizations, the move to virtual private server (VPS) hosting feels like a natural security upgrade. After all, the word private suggests isolation, control, and protection; especially compared to shared hosting environments. But in practice, private hosting does not automatically mean secure hosting. In fact, without the right security maturity, VPS environments can introduce new risks rather than eliminate old ones.

Every year, the Verizon Data Breach Investigations Report (DBIR) gives the security industry a chance to step back from the noise and look at what happened. Not what vendors predicted. Not what attackers threatened. Not what defenders feared. What happened. This year’s report makes one point hard to ignore: vulnerability exploitation became attackers’ initial leading access vector.

Under pressure, organizations often prioritize speed over process, unintentionally making the situation worse.

In our previous post, Token Bingo: Don’t Let Your Code Be the Winner, we documented Kali365, a phishing-as-a-service (PhaaS) kit abusing Microsoft’s OAuth 2.0 device authorization flow to steal Entra ID tokens. In this follow-up report, we track the same operator into new territory as they expand their operation and infrastructure.