Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The final part of CYJAX's rail cybersecurity series sets out a practical, five-step roadmap for building a rail-specific threat intelligence capability, covering regulation, coverage, and where to start regardless of maturity.

Some of the most serious network security weaknesses develop gradually through routine operational changes. Firewall rules are adjusted to support business needs, exceptions remain in place longer than planned, and controls are modified during troubleshooting. Over time, those decisions can push the live environment away from the security posture the organization believes it has.

Modern enterprises depend on a complex network of interconnected systems, applications, identities, and security controls. This infrastructure has become the nervous system of the business, enabling critical operations, supporting applications, and enforcing the boundaries that protect sensitive data. When these systems function correctly, they become invisible.

Mend.io’s research team caught this campaign before most of the open source community ever saw it. Continuous monitoring of RubyGems flagged a batch of gems that looked, at a glance, like an ordinary cryptomining squat, and Mend.io reported the full batch to RubyGems for takedown. Every gem was pulled within hours. Mend.io’s team also pulled two of the samples apart in full, because knowing a campaign exists isn’t the same as knowing how it works.

For years, the conversation about AI in cybersecurity has been mostly hypothetical. What happens when a model can plan and execute an attack on its own? How far away is that, really? This week, OpenAI gave us a concrete answer, and it arrived earlier than many expected. The incident is a genuine milestone, and it deserves the attention it is getting. But the most useful response is disciplined execution on the fundamentals, at a pace that matches the moment.

Access review tools differ more than their marketing suggests: standalone certification platforms, full identity governance suites, and compliance automation tools all call themselves access review solutions and solve different problems at different costs and with varying implementation overhead. Matching governance maturity and compliance framework to the right category matters more than comparing feature lists, especially when audit evidence must prove that rejected access was actually removed.

Most teams conflate two questions that require separate tools: who can access a sensitive share right now, and who changed access or opened files. Native Windows utilities resolve neither at scale, so audits stall and incidents lose their trail. The tool you need calculates effective access across nested groups and captures every permission change with attribution across Windows, network-attached storage, and SharePoint.

Healthcare has spent years strengthening its infrastructure against ransomware, patching vulnerabilities, deploying endpoint detection, and implementing zero-trust architectures. Yet, attackers continue to find new ways to compromise healthcare organizations.

Researchers at Cisco Talos are tracking a sophisticated phishing-as-a-service operator panel called “ARToken” that’s built on the EvilTokens phishing platform. ARToken focuses on targeted social engineering attacks, allowing operators to customize phishing attempts for each victim.

Threat actors are using a new technique called “phantom squatting” to trick AI tools into directing users to phishing sites, according to researchers at Palo Alto Networks’ Unit 42. Since AI models frequently hallucinate phony information, they sometimes point users to websites that don’t exist. Threat actors are now registering these AI-hallucinated domains and using them to host phishing sites.