cloud security dashboard

AWS Security Hub adds support for CRI profile version 2.2

AWS Security Hub CSPM now includes automated security checks aligned with the Cyber Risk Institute profile version 2.2. This framework helps financial institutions harmonize cybersecurity and regulatory expectations into a common set of requirements. The update provides 404 controls that support a subset of the CRI Profile v2.2 requirements, excluding those needing manual checks. The…

Continue
server room

SiteGuard WAF flaw allows attackers to execute admin-level commands

Hackers are actively exploiting an OS command-injection vulnerability in the SiteGuard Server Edition web application firewall. The flaw, tracked as CVE-2026-106931, affects the statistics feature and allows attackers to execute commands with root or SYSTEM privileges. SiteGuard, a Japanese vendor protecting over 1.5 million websites, has confirmed the critical severity of the issue and noted…

Continue
computer server room

Acting federal CISO outlines four priorities for cybersecurity

Acting Federal CISO Michael Duffy presented four key priorities for the CISO Council at the ACT-IAC Cybersecurity Summit. The first priority focuses on reducing cyber exposure by removing outdated infrastructure and accelerating remediation of known exploited vulnerabilities. The second priority emphasizes operational resilience through government-wide tabletop exercises to ensure critical missions continue during breaches. The…

Continue
paper check envelope

Treasury confirms paper check waivers for federal benefits remain active

The Bureau of the Fiscal Service announced that existing procedures for waiving electronic payment requirements remain in effect until further notice. This update affects recipients of federal benefits, such as Social Security and veterans benefits, who currently receive paper checks. The agency stated it is reviewing waiver guidance and will coordinate with paying agencies before…

Continue
server room

ConnectWise supply chain attack compromises Microsoft 365 tenants

ConnectWise has suspended access to its Cloud Backup service after hackers exploited application identities to breach customer environments. The attack, which began on October 15, allowed unauthorized access to Microsoft 365 tenants by abusing existing service principal permissions. Security firms Huntress and Todyl confirmed that attackers used automated scripts to sign in, bypassing multi-factor authentication…

Continue