Cybersecurity policy currently focuses on securing systems, but data remains vulnerable when it is processed or moved. The article argues that encryption fails to protect readable data during active use, leaving sensitive information exposed to theft. A proposed solution called vaultless, keyless pseudonymization replaces sensitive values with realistic substitutes to reduce their value if stolen….
A vulnerability in several versions of Siemens SIMATIC WinCC allows authenticated users with database access to execute commands on the host system. The flaw, tracked as CVE-2026-59241, stems from insufficient restriction of permissions assigned to a database role. Siemens has released updates for WinCC V8.0 and V8.1, but no fix is currently available for V7.5….
Siemens has disclosed multiple path traversal vulnerabilities in the Industrial Edge Device Kit that allow authenticated remote attackers to access sensitive internal information. The flaws, tracked as CVE-2026-44414 and CVE-2026-44415, affect numerous versions of the software for both arm64 and x86-64 architectures. Siemens has released updated versions for some products, recommending users upgrade to the…
Indian certificate authority eMudhra announced it will stop issuing SSL/TLS certificates following a critical security flaw. Researchers discovered that eight intermediate certificates used private keys that could be reconstructed in under a second due to insufficient randomness. The vulnerability stemmed from an error in a key generation ceremony held in April 2025, which resulted in…
Siemens PSS SINCAL software is vulnerable to a denial-of-service attack when using a specific legacy license dongle. The flaw exists in a third-party driver that fails to properly validate input, potentially causing a system crash. Versions 21.5, 22.0, and 22.5 prior to update 5 are affected by this out-of-bounds write issue. Siemens advises users to…
A federal judge in New York ruled that the Office of Personnel Management broke privacy laws by giving DOGE agents access to employee records. Judge Denise Cote stated that OPM provided no credible reason for sharing personally identifiable information with the group. The decision supports federal workers who argued the access violated the Privacy Act…
The NCSC has urged UK organisations to urgently address two critical vulnerabilities in PHP. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute remote code on web servers. The issues stem from memory corruption caused by out-of-memory conditions and stale internal state. All versions of PHP are affected, so organisations are advised…
The PHP project released emergency patches for two critical remote code execution vulnerabilities rated 9.2 on the CVSS v4.0 scale. CISA stated it was not aware of any exploitation, though researchers observed active reconnaissance across internet-facing systems. The flaws, dubbed php2shell, affect versions from 5 onward and were discovered using AI tools by Calif and…
Microsoft researchers attributed a recent supply-chain attack on ConnectWise customers to a China-state aligned threat actor known as Storm-0940. The group used an agentic AI penetration testing framework called ARTEX to automate attacks against hundreds of organizations globally. Storm-0940 conducted a password-spraying campaign that resulted in over 151,000 failed logon attempts before compromising ConnectWise Cloud…
CISA advises organizations to urgently address two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619. These flaws, referred to as php2shell, enable unauthenticated remote code execution on any PHP installation handling web requests. The specific versions required to fix these issues are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Although exploitation has not yet been…