The quarterly board meeting is two weeks out. The security team is pulling exports from the identity provider, the cloud posture tool, the vulnerability scanner, the SIEM and the EDR console. Someone is building a spreadsheet to reconcile them. Someone else is turning that spreadsheet into slides. Then a board member asks three questions: How secure is the organization, overall? What is
Google has announced a new security measure that limits access to Android's accessibility services to verified applications classified as Accessibility Tools when Advanced Protection is enabled. With malicious Android applications abusing the API serving as the main conduit for malware and financial fraud, the tech giant said the move would block a major attack pathway. Advanced Protection is a
Zero Trust can verify users once they are established, but onboarding creates a gap where organizations must decide who to trust before strong authentication exists. Specops explains why identity verification should begin before credentials, MFA methods, and access are issued.
The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of military service members that hackers stole their data after breaching the Pentagon's human resources management system in October 2025. In data breach notification letters shared online by affected individuals, the DMDC told affected military personnel that "a small number of unauthorized users" had access to their sensitive data, including personally identifiable information (PII), between October 2025 and July 2026 after exploiting a vulnerability in its file-sharing systems. The stolen data varies by person and includes Social Security numbers (SSNs), names, dates of birth, contact information, sex, race, and military personnel information. Pentagon officials told Federal News Network that the data breach affects more than 3 million people, including nearly 2.8 million living individuals and 294,000 "deceased individuals."
Microsoft has reminded customers that the Entra ID authentication system will get better protection against external script injection attacks starting next month. The company first revealed plans to secure Entra ID sign-ins from script injection attacks in a November 2025 announcement. According to a Monday message center update seen by BleepingComputer, Microsoft will begin enforcing additional Content Security Policy (CSP) defenses that will only allow scripts from trusted Microsoft content delivery network (CDN) domains during Entra ID sign-ins. The rollout should end by late October 2026, after which all users will be protected from various sign-in security risks, including cross-site scripting attacks in which malicious code is injected into websites to steal credentials. "Microsoft Entra ID will enhance sign-in security by enforcing a Content Security Policy blocking external script injection starting mid-October 2026," the company said. "This change helps protect users from threats such as cross-site scripting (XSS) by allowing only trusted Microsoft-hosted scripts to run during authentication and blocking unauthorized or externally injected code."
Attackers are exploiting a new critical zero-day flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30. The flaw, CVE-2026-76504, could allow a remote attacker with no login access to use the Manager's API as the admin user. Fixed releases are available, and there is no workaround. It carries a
Pentagon personnel agency breach exposed data of 3 million people after attackers accessed a file-sharing server for about nine months. The U.S. Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense, is notifying people that their personal information was exposed in a data breach. According to the agency, unauthorized users accessed one of its file-sharing servers for roughly nine months. The breach affects 2.76 million living people and 294,000 deceased individuals, according to a Department of War official. DMDC held at least 60 million records in fiscal year 2024, covering military and civilian personnel, contractors, family members, retirees and veterans. “The Pentagon has confirmed that the breach affects 2.76 million “living individuals,” a category that potentially includes current and former defense personnel or their dependents, and 294,000 “deceased individuals,” a Defense Department official told CNN on Monday, three days after this story was published.” CNN states. The Defense Manpower Data Center (DMDC) has notified individuals that a security vulnerability exposed personal information stored on one of its file-sharing systems. The vulnerability was discovered on July 16, 2026, and the US office quickly patched the system and restored it. An investigation found that a small number of unauthorized users had accessed files between October 2025 and the discovery date. The files contained unencrypted personal information. “On July 16, 2026, a security vulnerability in a DMDC file sharing system was discovered, which allowed unauthorized users to access files. DMDC immediately updated the file sharing system to patch the vulnerability and the system was restored.” reads a data breach notification letter sent to impacted individuals. “Analysis identified that between October 2025 and the date of discovery, a small number of unauthorized users accessed files on a server containing unencrypted PII. The types of PII involved vary by individual; however, in your case, they include social security number (SSN) and at least one additional identifier such as name, date of birth, contact information, sex, race, and military personnel information (such as occupational specialty).” US Defense Manpower Data Center (DMDC) notice of data breach (Source Reddit) The data exposed varies by person, but in this case included Social Security numbers (SSNs) and at least one other identifier, such as name, date of birth, contact details, sex, race or military personnel information, including occupational specialty. After discovering the vulnerability, the Defense Manpower Data Center (DMDC) launched its privacy and cybersecurity incident response process in line with U.S. government policies and guidelines. The agency says it is assessing the affected system and taking steps to improve its security. DMDC is also offering 12 months of free credit monitoring through IDX, a company specializing in data breach and recovery services. Individuals affected by the breach are encouraged to contact IDX with any questions and enroll in the service. Enrollment is available through the dedicated IDX website using the enrollment code provided in the notification. The deadline to enroll is August 19, 2027. The credit monitoring is intended to help affected individuals identify potential misuse of their personal information following the breach. At this time, no known cybercrime group claimed responsibilty for the attack. DMDC says it launched privacy and cybersecurity incident response actions after finding the vulnerability. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, US Defense Manpower Data Center)
Identity governance helps control who should have access, but periodic reviews alone may not reveal attacks as they happen. tenfold Software explains how real-time identity telemetry can help security teams investigate suspicious activity before it escalates.
A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real service, the SDK's maintainers said in a security advisory. Affected versions sent the client secret, the authorization code, and the PKCE proof key to a token endpoint the attacker controlled. The fix is in versions 1.30.0 and
Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclosed late last week. The company announced the incident on September 25, saying that a third party had accessed its systems at the beginning of the month. Times Car took action to block the unauthorized access on September 26. At the time, the company said it was investigating whether the attackers accessed members' personal information, but confirmed the data theft in an update earlier today. The company says that the intrusion affects 6.6 million current and former Times Car members, and also current and former members of the Times Business Service corporate account program. According to the update, exposed information includes the following data: The company said that passwords were stored in “a form that cannot be restored,” suggesting they were encrypted or hashed, although it did not provide additional details.
Confirm this action.
Leaving now will discard your changes.