Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Security and GRC teams have no shortage of risk mitigation activities. They are carrying more work than ever, yet many still lack confidence in the data and recommendations produced by all that manual effort. They are also operating in a risk environment that changes faster than their current operating model was designed to support. Unfortunately, the existence of risk activity does not mean actual risk has been reduced.

The Microsoft Defender Security Research Team and Microsoft Threat Intelligence documented a campaign in which Storm-2949 abused Microsoft Entra ID accounts to exfiltrate data from Microsoft 365 and Azure environments. The attack shows how cloud intrusions increasingly unfold through identity systems, administrative features, and legitimate platform capabilities rather than obvious malware or traditional endpoint compromise.

Monitoring milestone highlights shift toward real-time transaction intelligence as financial institutions face escalating fraud and operational risk VANCOUVER, B.C. — May 21, 2026 — INETCO, a global leader in real-time payment fraud prevention, today announced the monitoring of more than 100 billion transactions per year, empowering financial institutions and payment service providers across more than 30 countries to outsmart fraudsters, stay compliant and keep every customer safe.

In a significant security incident unfolding on May 20, 2026, GitHub confirmed unauthorized access to its internal repositories. The breach involved the exfiltration of sensitive internal source code and organizational data, reportedly totaling around 3,800 to 4,000 private repositories. A threat actor surfaced on underground forums advertising the stolen materials for sale, complete with directory listings of compressed archives and sample verification offers.

One of the most important shifts AI enables in detection engineering is changing where engineers spend their time. Traditionally, a significant portion of detection development effort is consumed by implementation details: writing complex SQL queries, building enrichment pipelines, handling edge cases, tuning rule logic, writing tests, documenting detections, and repeatedly iterating on detection logic. Those tasks are necessary, but they are also time-consuming.

Tatu Ylonen, the inventor of the SSH protocol, has long warned that a single stolen SSH key "can in many cases lead to compromise of the entire server environment." But in the bare-metal and private cloud infrastructure of high-frequency or quantitative trading firms, privileged access to trading infrastructure often depends on shared or static credentials like SSH keys or hardcoded API tokens.

The Musk vs. OpenAI trial has drawn a lot of attention over the past few weeks, but there’s a quieter legal development that matters more to most organizations. In February 2026, a federal judge in New York issued the first ruling in the country to directly answer whether conversations with a consumer AI tool can be protected by attorney-client privilege. The answer was no, and the reasoning behind it has implications that extend well beyond the courtroom where it was decided.

You’re most likely here because of some math and news about how to get that math and mess sorted. Your engineering team can’t manually pentest every release, your scanners flood Jira with noise, and your CISO needs audit-ready evidence by next quarter, and the autonomous pentesting market promises relief; AI agents that discover, chain, and exploit vulnerabilities at human-quality depth, in hours instead of weeks.

In 2012, the "Shadow IT" crisis was employees putting files in Dropbox for convenience. In 2026, the crisis is Shadow MCP. Instead of a simple file storage app, security teams are now facing unvetted AI agents with the power to read from and write to internal systems. These servers are often running on infrastructure that was never reviewed, never approved, and remains entirely invisible to governance.

CVE-2026-42945, nicknamed "NGINX Rift", is a heap buffer overflow in the ngx_http_rewrite_module component of NGINX. It has sat in the project's source code since 2008. F5 disclosed the flaw on May 13, 2026, after responsible disclosure by researchers at depthfirst, who reported finding it through an autonomous code scanning system.