Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Cisco has disclosed a critical authentication bypass affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). Tracked as CVE-2026-76460, the vulnerability allows an unauthenticated, remote attacker to send a crafted request to an affected API endpoint and bypass the web-based management interface. The vulnerability received the highest possible CVSS v3.1 score of 10.0.

When Anthropic introduced Mythos Preview, the story practically wrote itself. Here was a frontier AI model taking work that once required researchers and threat actors a lot of time and compressing it into hours. Mythos demonstrated the ability to find and exploit vulnerabilities across major operating systems and browsers. In controlled testing, it produced a working Firefox code-execution exploit in less than an hour and developed eight in roughly 12 hours.

AI adoption is outpacing enterprise control. The 2026 Verizon DBIR found that 45% of employees regularly use AI on corporate devices, and 67% of those users access AI through non-corporate accounts. Cyberhaven Labs reports that 39.7% of data sent to AI tools is sensitive, while endpoint AI app adoption grew 509% year over year.

Large language models are now a core part of the software development lifecycle. The 2025 Stack Overflow Developer Survey found that 82% of developers used OpenAI’s GPT models in their work last year, and Google has reported that AI now writes over 25% of new code committed at the company. All of that rests on one assumption. The model understands what you asked, and its answer is accurate.

A cyber insurance application is treated as a form to complete. Somebody gathers the answers, checks the boxes, submits it and waits for terms. ‍ Read the other way, the questions are a ranked list of what a market with claims data across thousands of organizations believes predicts loss. The list was assembled by parties who pay when they get it wrong, which makes it a more disciplined signal than most control frameworks and it arrives for free. ‍

With hybrid work as the new standard, consistently enforcing security across every edge is a challenge for teams. Working from any location or device creates a persistent challenge: how to enforce consistent, risk-based access controls across users, devices, and applications without introducing policy gaps or operational complexity. To understand the impact, let’s consider the user experience within a single global organization operating across three continents.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! Not good news for some customers…

Apple's 2025 App Store Transparency Report states that the company blocked over $2.2 billion in fraudulent transactions and removed roughly 59,000 apps for bait-and-switch tactics: publishing one thing to gain approval, then swapping in something else once the app goes live. The year before, fraud accounted for 38,315 of Apple's 82,509 total app removals, roughly 46%, making it the second-largest removal category that year. Google's numbers point in the same direction.

Analyzing vendor evidence is a massive undertaking, which is why more third-party risk management (TPRM) tools now offer AI capabilities that let teams upload evidence and get a faster read on a security assessment. When these capabilities come up in a vendor evaluation, the conversation almost always narrows to one question: how accurate are the AI results? A tool can answer every individual question correctly and still leave you exposed.

The financial sector has always been on the radar of cyber criminals. With billions and trillions of dollars in transactions taking place around the world, one tiny mistake can allow attackers to take financial systems hostage and demand millions of dollars in ransom. For this reason, cybersecurity in finance is not optional; it's paramount to the safety of internal and public-facing systems.