Latest news
After losing federal funding, MS-ISAC's membership dropped from 18,574 to 5,618, a loss of about 70%. Although CIS maintains operations through subsidies and automation, experts worry that local governments' cybersecurity protections will face greater risks, especially against the backdrop of escalating threats from state-sponsored cyberattacks.
Several technology companies, including Anthropic, AWS, IBM, and Microsoft, announced a joint effort to discover, disclose, and fix security vulnerabilities in open source software. The alliance, named Akrites, will establish a shared security incident response team and a coordinated vulnerability disclosure process. This initiative is primarily driven by the emergence of frontier AI models, which have greatly accelerated the speed of vulnerability discovery, while the existing open source ecosystem struggles to respond quickly.
The Trump administration announced the launch of a vulnerability management hub called Gold Eagle, aimed at coordinating the security community to use cutting-edge AI models to quickly identify and fix vulnerabilities. The project, led by the White House, operates the VINCE platform in partnership with Carnegie Mellon University's Software Engineering Institute, focusing on open-source software to address the pressure on the security community from the AI-driven surge in vulnerabilities.
Researchers at VulnCheck warn that two critical Microsoft SharePoint vulnerabilities—an authentication bypass (CVE-2026-55040) and an input validation flaw (CVE-2026-63520)—can be chained to let unauthenticated attackers execute code on vulnerable servers. While the auth bypass alone has limited impact, chaining it with the second flaw achieves full criticality. Rapid7 disclosed a proof of concept on Aug. 11; exploitation was confirmed days later. Microsoft has released patches in its July and August security updates. Defused researchers report probing activity against honeypots using the chain.
CISA added the Zimbra vulnerability (CVE-2026-73570) to its Known Exploited Vulnerabilities catalog, requiring federal agencies to complete patching within three days. The vulnerability has been exploited by hackers since mid-August, and thousands of organizations worldwide still use vulnerable versions.
UK government officials confirmed that a small power facility was forced to shut down for four days in July due to a suspected cyberattack linked to Iran. Officials stated the incident affected only a single facility and did not have a broader impact on the national power grid.
Several senior House Democrats sent a letter to the Government Accountability Office (GAO) requesting a study on the recovery of the Cybersecurity and Infrastructure Security Agency (CISA) following large-scale layoffs and mission adjustments, assessing the impact on critical infrastructure protection and cyber threat response capabilities.
Microsoft disclosed a critical remote code execution vulnerability in Entra ID, identified as CVE-2026-69836, with a severity score of 10 out of 10. The vulnerability is related to the deserialization of untrusted data and was discovered by Microsoft's own security researchers. Microsoft stated that the vulnerability has been fully mitigated, requiring no additional action from customers, and emphasized that the disclosure aims to enhance transparency.
A report released by CyberSheath on Thursday indicates that defense contractors still face difficulties in meeting the requirements of the U.S. military's CMMC program, despite the Pentagon's efforts to ease their compliance burden. In 2026, only two-thirds of contractors submitting self-assessments were highly confident in the accuracy of their scores, and the median contractor believed they were only 70% ready for a CMMC certification review. The report also found that contractors want more types of businesses to be included in cybersecurity requirements, reflecting concerns about supply chain risks.