CISA Put an AI Compute Framework in the KEV Catalog and Gave Agencies Three Days
On 17 August CISA added CVE-2025-62593 — a code injection flaw in Ray, the distributed AI compute engine — to the Known Exploited Vulnerabilities cata...
supply-chain
9 articles on supply-chain — privacy laws, security frameworks, and regulatory compliance.
A Wind Farm, a Private APN, and a Frozen Town: Poland's Heat Plant Attack and the NIS2 Scope Question Nobody Asked
Attackers entered through a FortiGate VPN at a wind farm with no MFA, crossed a private cellular network into an unrelated district heating plant, spe...
Ceva Logistics: One Processor, Ten Controllers, and a Notification Chain That Took Five Days
A cyberattack on eight European warehouses run by Ceva Logistics has produced breach reports to the Dutch data protection authority from at least ten ...
Langflow CVE-2026-9198: The AI Orchestration Layer Is a Credential Vault Nobody Inventoried
CISA added CVE-2026-9198 to the KEV catalog on 4 August 2026 with a 7 August federal deadline. A CVSS 9.8 unauthenticated RCE in IBM Langflow, exploit...
N-able N-central CVE-2026-18577: When the Patch Bypass Is the Breach, and the MSP Is the Blast Radius
Attackers found a bypass for the fix to CVE-2026-18556 and began exploiting it in late July 2026. N-able confirmed exploitation on 2 August; CISA adde...
Stadler Rail Refused $12.3 Million and Everest Leaked 271,000 Files: The Compliance Case for Saying No
Attackers used compromised credentials to reach a data-exchange platform shared between Stadler Rail and one of its suppliers. Everest demanded $12.3 ...
Nichirei, RansomHouse, and the Cold Chain: When a Logistics Outage Becomes a Personal-Data Incident
A 13 July 2026 ransomware attack on Nichirei disrupted roughly 140 distribution centres across Japan, affecting food manufacturers, supermarkets, and ...
Ushering In the Next Frontier: The June 2026 Quantum Innovation Executive Order and What It Signals for Compliance
On June 22, 2026, the White House issued an executive order directing a whole-of-government push on quantum information science — an updated National ...
ShinyHunters, Salesforce, and the FERPA Blind Spot: The McGraw-Hill and Rockstar Games Supply Chain Breach
In April 2026, ShinyHunters executed two related but technically distinct supply chain attacks: a Salesforce Experience Cloud misconfiguration at McGr...