Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

knowbe4

Warning: Vishing Attacks Open the Door to Ransomware Gangs

Aug 13, 2026 By KnowBe4 Team In KnowBe4
An initial access broker for ransomware gangs is targeting organizations with voice phishing (vishing) attacks through Microsoft Teams, according to researchers at Zscaler’s ThreatLabz. “From January through June 2026, ThreatLabz examined a cluster of related campaigns that used Microsoft Teams vishing and Quick Assist for initial access, followed by PowerShell-based staging,” the researchers write.
Read Post
knowbe4

Shadow AI: The New Frontier of Shadow IT

Aug 13, 2026 By Dr. Kawin Boonyapredee In KnowBe4
As a CISO advisor, I am observing a familiar pattern gaining a new, critical dimension. What we historically identified as "Shadow IT", the use of unapproved SaaS and tools, is rapidly evolving into "Shadow AI." Employees are increasingly leveraging AI bots for drafting, analysis, code generation and strategic decision-making.
Read Post
1Password

Demoting the IDE

Aug 13, 2026 By Chris Fowler In 1Password
Zero-Shot Learning is a podcast about how AI gets built, secured, and deployed. Hosted by Nancy Wang, 1Password CTO, and Dev Tagare, Senior Director of Engineering at Google, it’s a builder’s view of the architecture and the complex decisions it takes to ship with AI. This episode features guest co-host Richard Liu, Head of API Products at Anthropic, who sits in for Dev.
Read Post
indusface

SharePoint RCE: AI-Discovered Exploit Chain (CVE-2026-55040, CVE-2026-63520)

Aug 13, 2026 By Bhargavi Pallati In Indusface
A JWT authentication bypass and a remote code execution vulnerability in Microsoft SharePoint, chained together, give an attacker full control of a vulnerable server with zero credentials. Tracked as CVE-2026-55040 and CVE-2026-63520, the pair was discovered and weaponized by Rapid7 Labs. The goal was to test whether an AI agent, guided by human researchers, could find and weaponize a real exploit chain. It could.
Read Post
netwrix

Static credentials are still AI's easiest way in

Aug 13, 2026 By Sascha Martens In Netwrix
Netwrix's 2026 research found a 4x gap in breach rates between organizations where AI has significantly grown their identity count and those where it hasn't. Static credentials are AI’s easiest way in: passwords, keys, and tokens that never expire and never get checked. AI didn't invent the over-privileged credential, it just found the fastest way to use one.
Read Post
levelblue

Beyond the Inbox: How BEC Leads to SSO Abuse

Aug 13, 2026 By Jamie Mamroe and Federico Cedolini In LevelBlue
For years, many business email compromise (BEC) investigations have followed a familiar playbook: an attacker phishes credentials, logs into the victim's mailbox, establishes persistence with inbox rules, monitors communications, and waits for an opportunity to steal money or sensitive information. Today, we're seeing something different at LevelBlue. Across multiple recent investigations, we've observed attackers treating a compromised mailbox as just the first step.
Read Post

Sophos MDR: Define MDR Contacts in Sophos Central

Aug 13, 2026 By Sophos In Sophos
A step-by-step tutorial showing you how to define your Sophos Managed Detection and Response (MDR) authorized contacts and threat response mode in Sophos Central. As a Sophos MDR customer, assigning authorized contacts lets you fully utilize the service. This instructs the Sophos MDR Operations team who to contact and how to take action during an active threat. You're prompted to take these steps in Sophos Central after activating a new Sophos MDR license, and you can modify this information at any time.
View Video
mend

OWASP LLM Top 10 2026: the model will be fooled, the question is what breaks

Aug 13, 2026 By Asaf Saar In Mend
The OWASP GenAI Security Project published the 2026 edition of its Top 10 for LLM Applications. Prompt Injection stayed at number one. Sensitive Information Disclosure stayed at number two. Read the headlines and you would conclude that not much moved. Something did move, and it is not in the rankings. The project leads open by telling you to stop trying to build a model that cannot be fooled, and to build the system around it so that when the model is fooled, nothing important breaks.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.