Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Apache Axis 1.x is a SOAP engine whose last release came out in 2006. Twenty years later deps.dev counts 384 packages that still depend on 1.4, 83 of them directly, and that single version carries five published advisories. The worst of them turns the client-side service factory into a remote code execution primitive (tracked as CVE-2023-40743, NVD CVSS 9.8, critical).

This briefing covers two distinct horizons. The past week (23–30 September 2026) is a cluster of material, actively exploited edge and enterprise-application flaws, plus confirmed identity and third-party incidents. The past month (31 August–30 September 2026) shows those events as part of a faster pattern: perimeter appliances as the preferred initial-access class, build systems as ransomware feedstock, non-human identity as a wipe and extortion primitive, and overlapping EU and U.S.

Application security testing (AST) is the practice of scanning software for vulnerabilities using static, dynamic, and component-level analysis – then managing those flaws through remediation, validation, and certification. A new independent report from FOURCASTERS and Lionfish Tech Advisors confirms that AST is not becoming obsolete. AI and cloud platforms are changing how testing gets delivered, but the need for independent testing, flaw lifecycle management, and validation has only grown.

You already pay for Microsoft 365. Before adding AI security, check which tools, accounts and activities your existing controls protect. Then decide what your IT team or managed service provider will manage. Microsoft AI security includes Purview controls for supported third-party AI discovery, sensitive-data protection and prompt-injection detection. Purview may meet your requirements when its licensed and configured controls cover your workflows.

Cloud adoption is no longer just a question of where workloads run. Managing a complex cloud environment without a unified view is like running a city with separate control rooms for every utility. While this is quite possible, it likely will be much slower and much harder to manage. In a similar way, the bigger challenge for IT Leaders is maintaining visibility, security, operational control, and evidence for compliance.

A Technical blog series on where sensitive data moves in an AI workflow, what decisions Protecto makes at each point, and what enterprises get from enforcing policy once instead of everywhere.