Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

persona

The DEA telehealth extension: how to prepare for new patient identity verification requirements

May 7, 2026 By Jennifer Lowe In Persona
On December 31, 2025, the DEA issued its fourth temporary extension of the COVID-era telemedicine flexibilities, keeping the current rules in place through December 31, 2026. For telehealth companies prescribing controlled substances, the extension was welcome news.
Read Post
protecto

Stop Blaming AI for Bad System Design | Fix MCP Security

May 7, 2026 By Amar Kanagaraj In Protecto
Every few weeks, a new story surfaces: an AI agent deletes a production database, an autonomous coding tool racks up a five-figure cloud bill, or a chatbot exfiltrates internal documents through a prompt injection attack. The reaction is predictable. “AI is dangerous.” “LLMs can’t be trusted.” “We need better guardrails on the model.” But if you look at the root cause of these incidents, the model is rarely the problem. The system around it is.
Read Post
tanium

Mac patch management: The realities of macOS patching

May 7, 2026 By Tanium In Tanium
Mac patch management is the process of identifying, testing, and deploying software updates across macOS endpoints and third-party applications to reduce the window of exposure before attackers can exploit known vulnerabilities. It's a foundational practice within any enterprise cybersecurity program, particularly as Mac adoption in corporate environments continues to grow.
Read Post

Stablecoin Payments in APAC: What Institutions Need to Know

May 7, 2026 By Fireblocks In Fireblocks
Stablecoin transaction volumes have hit $33 trillion. Hong Kong just issued its first stablecoin licenses. In this panel from Fintech Fireside Asia, leaders from Fireblocks, Coinbase, FOMO Pay, and AWS break down what's actually happening on the ground across APAC: real use cases, shifting risk models, and where institutional adoption goes next. Panelists: Dan Sleep, Head of Business Solutions, APAC, Fireblocks Hassan Ahmed, Country Director Singapore, Coinbase Zack Yang, Co-founder, FOMO Pay Naveen Gupta, Head of Business Development, Payments, APJ Leader, AWS.
View Video
vista infosec

Key PCI DSS Controls You Must Build For 2026

May 7, 2026 By Narendra Sahoo In VISTA InfoSec
PCI DSS controls are no longer just a compliance checkbox — they’re a mandatory security baseline that stands between your customers’ card data and sophisticated cybercriminals who are faster, smarter, and better-funded than ever before. According to the Nilson Report, global card fraud losses exceeded $33 billion in 2022 and are projected to surpass $38 billion by 2027.
Read Post
jumpsec

What's happening to DevOps Security?

May 7, 2026 By Sean Moran In JUMPSEC
As 2026 rolls on, our capacity to prompt ourselves silly appears to be limitless. We’ve already seen the financial, legal, and reputational damage to Deloitte as they partly refunded the Australian government for a 237-page audit report containing LLM-generated hallucinations like fabricated academic references, fake footnotes, and a false quote attributed to a judge.
Read Post
armo

AI Agents in the Cloud: A Risk Management Framework for Security Leaders

May 7, 2026 By Shauli Rozen In ARMO
Your risk committee meets Thursday. The agenda has a new item: AI agent risk posture. You open the register. The fraud detection agent shipped in March is on it. So is the customer service agent. Neither row is useful — “likelihood: medium, impact: high, control: service account scoped via IAM.” Three months ago that was approximately right. Last week the platform team added two MCP connections, the model was upgraded, and the agent now touches data classes the entry never anticipated.
Read Post
armo

Why Editing IAM Policies Won't Fix Your AI Agent Identity Problem

May 7, 2026 By Ben Hirschberg In ARMO
Editing IAM policies cannot fix the most common architectural mistake in shipping AI agents on Kubernetes. It happens in thirty seconds: a platform engineer reuses an existing ServiceAccount with an IRSA annotation for Bedrock access because creating a new one takes thirty minutes plus a Terraform pull request. The new agent ships under the existing identity.
Read Post
armo

Privacy and Data Residency for AI Agents: What GDPR Requires That Static Controls Can't Show

May 7, 2026 By Yossi Ben Naim In ARMO
The residency evidence GDPR and the EU AI Act now expect lives in the runtime trajectory of every AI agent execution, not in the deployment configuration. Your residency compliance dashboard — every workload in eu-west-3, sovereign cloud configured, SCCs signed — cannot produce it. Your AI agent’s last thousand inferences crossed an external border, on average, eight times each. The translation API routed through us-east-1 when the EU endpoint hit capacity.
Read Post
apono

The JSONFormatter Wake-Up Call: How Developer Tools Are the New Identity Breach Vector

May 7, 2026 By The Apono Team In Apono
Everyone uses developer tools to get through the day. A JSONFormatter to inspect an API response, or a JWT decoder when you need to inspect a token quickly. In most engineering teams, these tools are treated as harmless productivity aids. In November 2025, researchers discovered that JSONFormatter and CodeBeautify had been storing everything users pasted into them via a save feature that generated shareable links with fully predictable URL structures. A simple crawler could retrieve all of them.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.