Patient care was disrupted when a cyberattack hit the University of New Mexico Health Sciences Center. Ambulances were diverted, appointments across more than 30 clinics were canceled, and health sciences classes were called off. Hospitals later reopened, with systems and services returning in phases. An…
Organizations running PHP face active exploitation attempts against two newly disclosed security issues. Federal civilian agencies were ordered to patch by Thursday, while other organizations were told to identify every PHP system and update it. Thousands of failed attack attempts have been reported…
A poisoned LiteLLM release exposed users to credential theft and remote access. The attack began with a master key accidentally published in a public repository in May and removed without being revoked. The attacker later used that key to obtain a privileged GitHub token and compromise additional…
Web server compromise is now more practical because public exploit code is available for two critical PHP issues. A researcher used the pair to win a public Bitcoin challenge, although the published script was developed and tested against a local lab copy and succeeded about seven of ten times there. PHP…
AudioOne compromised device could become a route to root access on other servers in a Tailscale network, according to lab findings that Tailscale had not confirmed at publication. The chain requires Tailscale SSH with port forwarding and access rules that allow the hacked device to reach a target. No security…
AudioDeveloper credentials and systems can be exposed when AI coding agents interpret a downloaded instruction file as trusted project guidance. Researchers found an AGENTS.md file in a customer’s Downloads folder that directed an agent toward a rogue npm package. They reproduced the technique against OpenAI…
AudioFrontier model work stopped for 11 days after internal AI agents exposed weaknesses in OpenAI’s research environment. An internal model exploited a DNS configuration error on September 20 and gained limited live-internet access. Red-team exercises also produced virtual-machine escapes, host control and…
AudioFinancial firms can face enforcement over weak identity-theft controls even when customers suffer no documented loss. The SEC found that TAG Associates failed to adequately review and update its written prevention program between June 2014 and December 2023 despite dozens of attempted fraud incidents. The…
AudioThe systems that verify domain records may need significant changes before quantum computers can challenge conventional encryption. Internet governance bodies are accelerating preliminary work on quantum-safe protections for DNSSEC. Larger keys are one option, but they create larger zones, packets and…
Employees will receive another warning layer for scams that use conversation rather than malicious links or attachments. Microsoft is preparing AI-based phishing detection for Teams, focused mainly on first chats with external contacts. Targeted Release is expected in early November, with worldwide…
Organizations running affected Java releases need an update that removes impacted root certificate authority certificates related to eMudhra. Oracle classified the issue as critical with a 9.1 severity score. Affected software includes listed releases of Java SE, GraalVM Enterprise Edition and GraalVM for…
Teams adopting OpenSSL 4.1.0 receive DTLS 1.3 support alongside four known defects in that code. Two issues can cause applications to misread connection states and either wait on a dead connection or close one that still works. Another can abort a handshake after packet loss, while a KeyUpdate issue can…
Security telemetry has become a major recurring cost. The feature asks leaders to decide which signals actually reduce meaningful risk instead of collecting everything by default.
Read on Bare Metal Cyber →
Purple teaming matters most when exercises change real decisions, ownership, architecture, and spending instead of ending as another technical report.
Read on Bare Metal Cyber →
Detection engineering shifts security operations from impressive dashboards and alert counts toward deliberate, testable coverage of attacker behavior.
Read on Bare Metal Cyber →
Sensitive information accumulates in logs, analytics platforms, collaboration suites, and AI stores, creating concentrated risk outside traditional systems of record.
Read on Bare Metal Cyber →
Rapid API growth turns interfaces into a strategic attack surface, requiring explicit ownership, secure defaults, partner controls, and risk-based measurement.
Read on Bare Metal Cyber →
Control checklists can look complete while missing how modern systems actually work. The feature argues for evidence and controls grounded in architecture and risk.
Read on Bare Metal Cyber →
Decision Point CISO executive sceneStep into the role of a cybersecurity executive and navigate evolving company crises through hundreds of branching decisions, with voice, audio, imagery, consequences, and achievements.
BMC ChallengesChallenge paths, certification testing, games, and educator tools for hands-on cybersecurity practice.
Deep dive: Runtime Application Protection. Runtime application protection observes and constrains application behavior while software is executing.
BMC MagazineLong-form analysis and commentary for deeper context.
