Cybersecurity
A newly published application describes a cloud endpoint-detection sensor that watches events at the data-link layer, acts on rule matches, and writes each event into a software bill of materials so that separate signals can later be correlated into a single dangerous combination.
Cybersecurity
Cisco was granted a patent June 30 for detecting domain fronting without decrypting the session — by learning where a domain normally resolves and flagging encrypted connections that reach an atypical CDN address known to support fronting.
Cybersecurity
A Verizon application published June 25 describes using a generative adversarial network — a generator paired with a discriminator — to produce encryption keys with higher entropy than conventional key derivation functions.
Cybersecurity
In an 8-K filed under Item 1.05, 8x8, Inc. (EGHT) said an unauthorized third party exploited the Klue integration connected to its Salesforce CRM and exfiltrated customer contract, opportunity and contact data. The company reported the incident under Item 1.05 but said it is not expected to be material to its financial condition.
Cybersecurity
The CISA Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities that are being actively exploited in the wild. Established by Binding Operational Directive 22-01, it directs federal agencies to remediate cataloged bugs and shifts prioritization from severity scores to evidence of active exploitation.
Cybersecurity
Post-quantum cryptography is encryption designed to resist attack by quantum computers. In August 2024, NIST published FIPS 203, standardizing ML-KEM — a lattice-based key-encapsulation mechanism believed secure even against an adversary with a quantum computer.
Cybersecurity
Zero trust is a set of cybersecurity principles that move defenses from static network perimeters to users, assets, and resources. NIST Special Publication 800-207 is the authoritative definition, and it turns on one rule: no implicit trust based on network location.
Cybersecurity
Endpoint detection and response (EDR) watches endpoints; extended detection and response (XDR) correlates security data across endpoints, network sensors, firewalls, and email. A granted Cisco XDR patent spells out the architectural difference in its own claim language.
Cybersecurity
Item 1C of the 10-K is where a public company describes its cybersecurity risk-management processes, the material effects of cyber threats, and the board and management roles in oversight — the standing-program counterpart to the event-driven Item 1.05 8-K.
Cybersecurity
Item 1.05 of Form 8-K is the mandatory disclosure for a cybersecurity incident a company has determined to be material. The SEC's Division of Corporation Finance has said companies should use a different item — for example, Item 8.01 — to voluntarily disclose incidents that are immaterial or not yet determined material.
Cybersecurity
Under the SEC's cybersecurity rule, a cybersecurity incident is material — and triggers an Item 1.05 8-K — when there is a substantial likelihood that a reasonable shareholder would consider it important to an investment decision. Two real Item 1.05 filings show how companies apply the standard.
Cybersecurity
Item 1.05 of Form 8-K requires a public company to disclose a cybersecurity incident it has determined to be material, and to describe the material aspects of the incident's nature, scope, and timing and its impact or reasonably likely impact. The filing is due within four business days of the materiality determination.
Cybersecurity
A complaint filed June 18 in the Eastern District of Texas accuses Sophos of infringing four U.S. patents covering wireless channel optimization, virtualized-network monitoring, detection modeling and text-classification risk warning, citing products from Sophos Firewall to Sophos Central XDR.
Cybersecurity
An incomplete-comparison vulnerability in Arista's Extensible Operating System, which the KEV record says causes switches to decapsulate and forward unexpected tunneled packets, was added to CISA's catalog with a June 23 remediation due date.
Cybersecurity
CISA placed an exploited missing-authentication vulnerability in Splunk Enterprise on its Known Exploited Vulnerabilities catalog on June 18, citing a PostgreSQL sidecar endpoint that can be reached without credentials.
Cybersecurity
A newly published application describes an antimalware driver that picks its response to a suspicious event using reinforcement learning rather than fixed rules. The disclosure puts a trial-and-error learner inside the endpoint itself.
Cybersecurity
An 8-K filed June 17 shows the RMM and managed-security vendor expanding its credit line to fund deferred Adlumin acquisition payments, future deals, and share repurchases. Here is what the filing says and what it signals for the managed-security market.
Cybersecurity
An out-of-bounds read-and-write flaw in Chromium's V8 engine lets a crafted web page run code inside the sandbox, exposing every Chromium-based browser at once.
Cybersecurity
An OS command-injection flaw in Ivanti Sentry gives a remote, unauthenticated attacker root-level code execution when the appliance is unmanaged and externally reachable.
Cybersecurity
CISA's catalog ties a missing-authentication flaw in Oracle PeopleSoft Enterprise PeopleTools to known ransomware use, with an unauthenticated path to complete takeover.
Cybersecurity
A directory-traversal flaw in Cisco's SD-WAN management plane gives an authenticated remote attacker arbitrary file write across the controller's filesystem.
Cybersecurity
A symbolic-link-following bug in the LiteSpeed cPanel plugin lets a single tenant with FTP or web-shell access escape its lane on CloudLinux/CageFS shared servers.
Cybersecurity
A broken-access-control bug in the widely deployed JCE extension for Joomla is being exploited in the wild, and federal agencies were given three days to fix it.
Cybersecurity
CISA added CVE-2026-20262, a CVSS 6.5 file-write path-traversal flaw in Cisco Catalyst SD-WAN Manager, to the KEV catalog and cited its newer BOD 26-04 risk-prioritization directive in the required action.
