CVE-2026-42897 on DanSec Daily

Cybersecurity Brief – 2026-06-11

Thu, 11 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The University of Nottingham suffered a data breach impacting over 450,000 current and former students, with the ShinyHunters group taking credit and leaking email addresses and other information^[13]^[39].
Oracle PeopleSoft servers have been targeted in ongoing data theft attacks by the ShinyHunters extortion gang, who claim to have stolen data from over 100 organizations^[18].
Data belonging to 2.4 million VRChat users has been stolen in a breach, exposing sensitive user information^[44].

Newly Discovered Vulnerabilities

Multiple critical vulnerabilities have been patched by Ivanti, Fortinet, and SAP, with risks including arbitrary code execution and information disclosure^[9].
Microsoft patched three zero-days as part of its largest-ever Patch Tuesday, addressing 206 vulnerabilities in total^[47].
A high-severity, unpatched path traversal vulnerability in the Langflow AI development platform (CVE-2026-5027) is under active exploitation, allowing unauthenticated attackers to write arbitrary files and achieve remote code execution^[10]^[15]^[34].
A maximum-severity flaw in Ivanti Sentry, recently patched, is being actively exploited to execute code with root privileges on exposed secure mobile gateways^[14].
Microsoft released a fix for a BitLocker recovery bug affecting Windows Server 2025 devices that caused systems to boot into recovery mode after a security update^[12].
Microsoft patched an actively exploited Exchange Server vulnerability (CVE-2026-42897) that allowed arbitrary JavaScript execution via cross-site scripting attacks in Outlook Web Access^[21]^[40].
CISA added actively exploited vulnerabilities in Cisco, Chrome, and Arista products to its Known Exploited Vulnerabilities (KEV) catalog, following reports of in-the-wild attacks^[11].
Splunk and Palo Alto Networks released patches for severe vulnerabilities that could allow attackers to create or modify arbitrary files and access protected resources^[37].
A Windows Defender bug, with proof-of-concept code released by the “Nightmare-Eclipse” actor, allows for system takeover and bypassing BitLocker protection^[26]^[38].

Notable Threat Actor Activity

The China-linked JDY botnet has expanded to over 1,500 SOHO devices, increasing its reconnaissance activity and specifically expanding targeting of US military networks^[8]^[19].
OceanLotus, a Vietnam-aligned threat actor, has been linked to campaigns targeting domestic entities and investors using the SPECTRALVIPER backdoor^[6].
The Miasma worm, a credential-stealing attack framework recently used in supply-chain attacks on open-source ecosystems, had its source code briefly leaked on GitHub^[16].
The ransomware group “The Gentlemen” has emerged as the second most active by victim count, rapidly recruiting skilled hackers through aggressive tactics^[31].
ShinyHunters continue to target enterprise systems for data theft and extortion, including attacks on the University of Nottingham and Oracle PeopleSoft servers^[13]^[18]^[39].

Trends, Tools, or Tactics of Interest

Infostealers are increasingly turning millions of devices into credential theft platforms, providing initial access for ransomware and other cybercrime operations^[41].
Free “Spotify Premium” hacks promoted on social media platforms like TikTok and Instagram are being used to distribute infostealers^[46].
Attackers are bypassing weak authentication controls via phishing, MFA fatigue, and service desk social engineering, highlighting the need for robust identity verification practices^[20].
AI-driven changes are disrupting traditional vulnerability management, leading CISOs to shift budgets toward Breach and Attack Simulation (BAS) tools^[5].
The rise of AI risks is causing some insurers to explicitly exclude AI-related incidents from cyber insurance policies, while others are developing new frameworks to address emerging threats^[25].

Regulatory or Policy Developments Affecting the Security Industry

CISA has issued a new directive requiring US federal agencies to patch the most dangerous vulnerabilities within three days, in response to the accelerated threat landscape driven by AI-enabled attacks^[23]^[28]^[33].
The UK government announced a requirement for Apple and Google to block nude images on children’s phones by September, with a stipulation that no data is collected during the process^[45].
GitHub will disable npm install scripts by default in npm version 12 to mitigate software supply chain attacks, representing a significant change for the open-source ecosystem^[7]^[17].

Sources

Nottingham University data breach affects over 450,000 students - bleepingcomputer.com
University of Nottingham Confirms Breach After Hackers Leak Data - securityweek.com
Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks - bleepingcomputer.com
Data of 2.4 million VRChat users stolen - malwarebytes.com
Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities - thehackernews.com
Microsoft’s biggest-ever Patch Tuesday fixes 206 bugs, including 3 zero-days - malwarebytes.com
Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE - thehackernews.com
Path traversal flaw in AI dev platform Langflow exploited in attacks - bleepingcomputer.com
Hackers Exploit Langflow Vulnerability for Remote Code Execution - securityweek.com
Max severity Ivanti Sentry vulnerability now exploited in attacks - bleepingcomputer.com
Microsoft fixes BitLocker recovery bug on Windows Server 2025 - bleepingcomputer.com
Microsoft patches Exchange Server zero-day exploited in attacks - bleepingcomputer.com
Microsoft Patches Exploited Exchange Server Vulnerability - securityweek.com
CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation - thehackernews.com
Splunk, Palo Alto Networks Patch Severe Vulnerabilities - securityweek.com
Nightmare-Eclipse Drops Yet Another Microsoft Exploit, RoguePlanet - darkreading.com
‘GreatXML’ Zero-Day Exploit Bypasses BitLocker - securityweek.com
China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance - thehackernews.com
China-linked JDY botnet expands targeting of U.S. military networks - bleepingcomputer.com
OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack - thehackernews.com
The ‘Miasma’ worm source code briefly leaked on GitHub - bleepingcomputer.com
Who Runs the Ransomware Group ‘The Gentlemen?’ - krebsonsecurity.com
Infostealers Turn Millions of Devices Into Credential Theft Machines - securityweek.com
Free Spotify Premium hacks on social media are spreading infostealers - malwarebytes.com
The 5 Best Practices for Secure Identity Verification - bleepingcomputer.com
AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS. - thehackernews.com
AI Risk Worries Insurers and Businesses Alike - darkreading.com
CISA Rewrites Federal Patching Requirements for AI Threat Era - darkreading.com
CISA Tells US Agencies to Fix Security Bugs in as Little as 3 Days Thanks to AI Threats - wired.com
CISA Issues New Directive Improving How Federal Agencies Prioritize the Mitigation of Cyber Vulnerabilities - cisa.gov
Children’s phones must block nude images by September, UK says - malwarebytes.com
GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks - thehackernews.com
GitHub announces npm security changes to tackle supply-chain attacks - bleepingcomputer.com

Cybersecurity Brief – 2026-05-19

Tue, 19 May 2026 00:00:00 +0000

Major Incidents or Breaches

Grafana Labs disclosed that hackers stole its source code by breaching its GitHub environment using a stolen access token ^[19].
7-Eleven confirmed a data breach after the ShinyHunters group demanded ransom, with attackers claiming theft of over 600,000 Salesforce records containing personal and corporate data ^[34].
Several large-scale healthcare data breaches in the US were reported, impacting hundreds of thousands to millions of individuals ^[32].
Vodafone, a major international telecom, sustained a cyberattack, as highlighted in recent threat intelligence reporting ^[37].
A CISA contractor publicly exposed highly privileged AWS GovCloud credentials on GitHub until the past weekend ^[28].
INTERPOL’s Operation Ramz led to the arrest of over 200 individuals and the seizure of 53 malware and phishing servers across the Middle East and North Africa, disrupting regional cybercrime networks ^[8]^[15].

Newly Discovered Vulnerabilities

A zero-day cross-site scripting vulnerability in Microsoft Exchange (CVE-2026-42897) is under active exploitation, with no patch currently available. The flaw allows attackers to compromise Outlook Web Access (OWA) mailboxes ^[21]^[9].
Four vulnerabilities in the OpenClaw AI agent framework, collectively known as “Claw Chain,” have been patched. These flaws allowed attackers to steal credentials, escalate privileges, escape sandboxes, and maintain persistence ^[22]^[33].
Universal Robots PolyScope 5 is affected by a critical OS command injection vulnerability (CVE-2026-8153), which could allow attackers to compromise industrial robot fleets ^[31].
Ivanti, Fortinet, SAP, VMware, and n8n released security updates addressing remote code execution, SQL injection, and privilege escalation vulnerabilities ^[12].
A Windows privilege escalation zero-day, dubbed MiniPlasma, enables SYSTEM-level access on fully patched systems. A proof-of-concept exploit has been released ^[13]^[35].

Notable Threat Actor Activity

The ShinyHunters group claimed responsibility for the 7-Eleven data breach, demanding ransom and exposing sensitive Salesforce records ^[34].
The Mini Shai-Hulud campaign compromised npm packages in the @antv ecosystem, distributing infostealers and DDoS malware via supply chain attacks ^[7]^[14]^[18]^[23]^[36].
Threat actors compromised the popular GitHub Actions workflow “actions-cool/issues-helper” to steal CI/CD credentials through a supply chain attack ^[6].
The TeamPCP group continues its supply chain campaign, including a confirmed compromise of the Checkmarx Jenkins plugin and the emergence of a self-spreading npm worm ^[30].
A new SHub macOS infostealer variant was observed spoofing Apple security updates using AppleScript to install a backdoor ^[16].

Trends, Tools, or Tactics of Interest

Multiple software supply chain attacks have targeted developer workstations and development tools, including compromised VS Code extensions, malicious npm packages, and hijacked GitHub Actions workflows ^[5]^[6]^[7]^[11]^[14]^[18]^[23]^[30]^[36].
The release and subsequent adoption of the Shai-Hulud worm source code have accelerated the spread of self-replicating malware targeting npm developers ^[14]^[18]^[23]^[36].
AI agents are increasingly being used to discover and exploit obscure vulnerabilities, while the proliferation of AI-generated code introduces new risks for defenders ^[4]^[25].
There is a documented increase in mobile malware, with new versions of SparkCat and Triada identified as notable threats in Q1 2026 ^[1].
Social engineering and phishing remain highly profitable for attackers, with Americans losing $2.1 billion to social media scams in 2025 ^[3].
Shadow AI tool usage by employees is widespread, prompting recommendations for practical AI governance to manage associated risks ^[17].
Microsoft Edge will change its handling of saved passwords so they are no longer stored in plaintext memory throughout the browser session ^[38].

Regulatory or Policy Developments Affecting the Security Industry

INTERPOL’s Operation Ramz represents a significant international law enforcement effort targeting cybercrime infrastructure and actors in the MENA region ^[8]^[15].
The exposure of AWS GovCloud credentials by a CISA contractor raises concerns about government cloud security practices ^[28].

Sources

Grafana says stolen GitHub token let hackers steal codebase - bleepingcomputer.com
7-Eleven Data Breach Confirmed After ShinyHunters Ransom Demand - securityweek.com
Millions Impacted Across Several US Healthcare Data Breaches - securityweek.com
18th May – Threat Intelligence Report - research.checkpoint.com
CISA Admin Leaked AWS GovCloud Keys on Github - krebsonsecurity.com
INTERPOL Operation Ramz Disrupts MENA Cybercrime Networks with 201 Arrests - thehackernews.com
INTERPOL ‘Operation Ramz’ seizes 53 malware, phishing servers - bleepingcomputer.com
Microsoft Exchange Zero-Day Under Attack, No Patch Available - darkreading.com
⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More - thehackernews.com
'Claw Chain' Vulnerabilities Threaten OpenClaw Deployments - darkreading.com
‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Delivery - securityweek.com
Critical Vulnerability Exposes Industrial Robot Fleets to Hacking - securityweek.com
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws - thehackernews.com
MiniPlasma Windows 0-Day Enables SYSTEM Privilege Escalation on Fully Patched Systems - thehackernews.com
Researcher Drops MiniPlasma Windows Exploit for Unpatched 2020 CVE - securityweek.com
Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account - thehackernews.com
Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware - thehackernews.com
Leaked Shai-Hulud malware fuels new npm infostealer campaign - bleepingcomputer.com
Shai-Hulud Worm Clones Spread After Code Release - darkreading.com
First Shai-Hulud Worm Clones Emerge - securityweek.com
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials - thehackernews.com
TeamPCP Supply Chain Campaign: Activity Through 2026-05-17, (Mon, May 18th) - isc.sans.edu
SHub macOS infostealer variant spoofs Apple security updates - bleepingcomputer.com
Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer - thehackernews.com
Developer Workstations Are Now Part of the Software Supply Chain - thehackernews.com
What Is an Al Agent in Cybersecurity? - blog.knowbe4.com
The Boring Stuff Is Dangerous Now - darkreading.com
IT threat evolution in Q1 2026. Mobile statistics - securelist.com
FTC: Americans Lost $2.1 Billion to Social Media Scams Last Year - blog.knowbe4.com
5 Steps to Managing Shadow AI Tools Without Slowing Down Employees - bleepingcomputer.com
Microsoft is changing Edge’s plaintext password behavior - malwarebytes.com

Cybersecurity Brief – 2026-05-16

Sat, 16 May 2026 00:00:00 +0000

Major Incidents or Breaches

OpenAI disclosed that two employee devices were compromised via the Mini Shai-Hulud supply chain attack on TanStack, resulting in the theft of credential material from code repositories. OpenAI stated that no user data or production systems were affected. The incident is linked to the public release of the Shai-Hulud worm source code by TeamPCP, which is encouraging its use in further supply chain attacks and offering monetary rewards to attackers ^[8]^[22]^[23].
The JDownloader website was compromised, and installer download links were replaced with malware for several days, exposing users who downloaded the installer during this period to potential compromise ^[24].
American Lending Center reported a ransomware attack affecting 123,000 individuals. The breach was discovered nearly a year ago, but the investigation has only recently concluded ^[21].
Researchers observed active exploitation of a critical vulnerability in the Funnel Builder WordPress plugin, allowing attackers to inject malicious JavaScript into WooCommerce checkout pages and steal credit card data ^[9].
Two vulnerabilities in the Avada Builder WordPress plugin, which has around one million active installations, allow attackers to read arbitrary files and extract sensitive information, including site credentials ^[12].

Newly Discovered Vulnerabilities

Four vulnerabilities in the OpenClaw platform can be chained to achieve data theft, privilege escalation, and persistence. These flaws have been collectively rated as high severity ^[6].
During the second day of Pwn2Own Berlin 2026, researchers demonstrated 15 unique zero-day vulnerabilities in products including Windows 11, Microsoft Exchange, and Red Hat Enterprise Linux ^[10].
Microsoft warned of a high-severity, actively exploited Exchange Server zero-day vulnerability (CVE-2026-42897) that allows remote code execution via cross-site scripting. Temporary mitigations have been released pending a permanent patch ^[16]^[20].

Notable Threat Actor Activity

The Russian state-sponsored Turla group has evolved its Kazuar backdoor into a modular peer-to-peer (P2P) botnet, enhancing its stealth and persistence capabilities ^[5].
The hacking group TeamPCP released the source code for the Shai-Hulud worm, incentivising its use in supply chain attacks and promising monetary rewards to participants ^[23].
Attackers compromised the node-ipc npm package by injecting credential-stealing malware into newly published versions, targeting developers in a supply chain attack ^[11].
Researchers are tracking 40 separate traffic-themed SMS phishing (smishing) campaigns impersonating transport authorities, toll operators, and parking services globally ^[3].

Trends, Tools, or Tactics of Interest

Phishing attacks are becoming more sophisticated, leveraging AI to mimic legitimate conversations, use trusted domains, and scale attacks, making detection increasingly difficult ^[1].
Stolen browser sessions and authentication tokens are becoming more valuable than passwords, as seen in the evolution of the REMUS infostealer, which now focuses on session theft and is offered as malware-as-a-service (MaaS) ^[14].
AI agents capable of discovering and exploiting obscure vulnerabilities are emerging, alongside an increase in potentially flawed AI-generated code, creating new challenges for defenders ^[17].
Supply chain attacks remain prevalent, with notable incidents affecting npm packages (node-ipc), open-source projects (TanStack), and widely used software installers (JDownloader) ^[8]^[11]^[22]^[24].
Security researchers highlight that trusted internal tools and activities can represent significant risk, as malicious behaviour increasingly blends in with legitimate operations ^[7].
Geopolitical turmoil is being exploited by fraudsters to conduct scams and social engineering attacks ^[4].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft is updating the Edge browser to prevent saved passwords from being loaded into process memory in clear text at startup, reversing its previous stance that this behaviour was “by design” ^[13].
Microsoft is introducing a capability to remotely roll back faulty Windows drivers delivered through Windows Update, aiming to reduce the risk from problematic driver deployments ^[15].
Big Tech companies are opposing a Canadian encryption bill, which has implications for privacy and secure communications ^[19].
Meta has introduced disappearing AI chats in WhatsApp, claiming they cannot be read by Meta, while simultaneously removing protections on Instagram that previously prevented Meta from accessing user messages, creating confusion about chat privacy ^[25].

Sources

TanStack Supply Chain Attack Hits Two OpenAI Employee Devices, Forces macOS Updates - thehackernews.com
OpenAI Hit by TanStack Supply Chain Attack - securityweek.com
TeamPCP Ups the Game, Releases Shai-Hulud Worm’s Source Code - securityweek.com
Attackers replaced JDownloader installer downloads with malware - malwarebytes.com
American Lending Center Data Breach Affects 123,000 Individuals - securityweek.com
Funnel Builder WordPress plugin bug exploited to steal credit cards - bleepingcomputer.com
Avada Builder WordPress plugin flaws allow site credential theft - bleepingcomputer.com
Four OpenClaw Flaws Enable Data Theft, Privilege Escalation, and Persistence - thehackernews.com
Microsoft Exchange, Windows 11 hacked on second day of Pwn2Own - bleepingcomputer.com
Microsoft warns of Exchange zero-day flaw exploited in attacks - bleepingcomputer.com
Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild - securityweek.com
Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access - thehackernews.com
Popular node-ipc npm package compromised to steal credentials - bleepingcomputer.com
Traffic-Themed SMS Phishing Targets Users Around the World - blog.knowbe4.com
Why Integrate Threat Intelligence Feeds into Email Security? - blog.knowbe4.com
Inside the REMUS Infostealer: Session Theft, MaaS, and Rapid Evolution - bleepingcomputer.com
The Boring Stuff is Dangerous Now - darkreading.com
What 45 Days of Watching Your Own Tools Will Tell You About Your Real Attack Surface - thehackernews.com
Why geopolitical turmoil is a gift for scammers, and how to stay safe - welivesecurity.com
Microsoft backpedals: Edge to stop loading passwords into memory - bleepingcomputer.com
Microsoft to automatically roll back faulty Windows drivers - bleepingcomputer.com
In Other News: Big Tech vs Canada Encryption Bill, Cisco’s Free AI Security Spec, Audi App Flaws - securityweek.com
Meta’s confusing new approach to chat privacy - malwarebytes.com

Cybersecurity Brief – 2026-05-15

Fri, 15 May 2026 00:00:00 +0000

Major Incidents or Breaches

Foxconn suffered a ransomware attack by the Nitrogen group on its North American manufacturing facilities. This is one of over 600 attacks targeting manufacturers this year.
OpenAI confirmed a security breach resulting from the TanStack supply chain attack, which compromised two employee devices and necessitated code-signing certificate rotation.
Taiwanese rail operations were disrupted for nearly an hour after a student used software-defined radio to shut down three bullet trains, exposing cybersecurity gaps in rail systems.
TeamPCP is threatening to leak source code from the Mistral AI project unless a buyer is found, following a breach.
Dell confirmed its SupportAssist software is causing Windows BSOD crashes, leading to system instability for users.

Newly Discovered Vulnerabilities

Cisco Catalyst SD-WAN Controller is affected by a critical authentication bypass vulnerability (CVE-2026-20182), which has been actively exploited in the wild to gain administrative access. This is the sixth SD-WAN zero-day exploited in 2026.
Microsoft disclosed a new actively exploited vulnerability (CVE-2026-42897) impacting on-premise Exchange Server, allowing arbitrary code execution via crafted email. A separate Exchange zero-day enabling XSS-based code execution is also under active exploitation.
PraisonAI (CVE-2026-44338) was targeted by threat actors within hours of disclosure, exploiting an authentication bypass flaw in this open-source orchestration framework.
Three versions of the node-ipc npm package were found to contain a stealer backdoor targeting developer secrets.
An 18-year-old NGINX vulnerability was discovered, allowing denial of service and, under certain conditions, remote code execution.
A new Linux kernel vulnerability, “Fragnesia” (CVE-2026-46300), allows root privilege escalation and is similar to previous Dirty Frag and Copy Fail exploits.
Burst Statistics WordPress plugin is being exploited via a critical authentication bypass flaw to obtain admin-level access on affected sites.
Chrome 148 update was released to patch critical use-after-free and other high-severity vulnerabilities.
F5 released patches for over 50 vulnerabilities in BIG-IP, BIG-IQ, and NGINX products, covering high and medium-severity issues.

Notable Threat Actor Activity

Kimsuky, a North Korean threat group, is using new PebbleDash-based tools linked to the AppleSeed malware cluster in recent campaigns.
Ghostwriter, a Belarus-aligned group, targeted Ukrainian government entities with geofenced PDF phishing and Cobalt Strike payloads.
FrostyNeighbor, another Belarusian APT, is spear-phishing government organizations in Poland and Ukraine using unique victim fingerprinting for espionage.
Chinese APTs Salt Typhoon and Twill Typhoon expanded their targeting: Salt Typhoon attacked an Azerbaijani energy entity, and Twill Typhoon deployed an updated RAT against Asian organizations.
KongTuke, an initial access broker, is now using Microsoft Teams for rapid social engineering attacks to breach corporate networks.
TeamPCP released the source code for the Shai-Hulud worm, encouraging its use in supply chain attacks and offering financial incentives for widespread deployment.

Trends, Tools, or Tactics of Interest

Ransomware gangs are increasingly targeting manufacturers due to their low tolerance for downtime, as evidenced by the Foxconn incident.
Phishing attacks are ramping up ahead of the 2026 FIFA World Cup, with at least 79 phishing sites targeting fans.
Netflix-themed phishing campaigns are proliferating, with attackers leveraging poor user security practices for credential theft.
Cyber-enabled cargo crime is shifting from physical hijackings to phishing and credential theft to reroute and steal freight.
AI-assisted ransomware and AI-driven social engineering are emerging, with threat actors leveraging generative AI for more convincing phishing and attack automation.
AI hallucinations are creating new security risks by generating plausible but incorrect outputs, which can mislead decision-makers in critical infrastructure.
Supply chain attacks remain a significant threat, highlighted by the node-ipc, TanStack, and Shai-Hulud worm incidents.
New malware libraries are prompting the need for updated detection signatures.
Mythos, an autonomous vulnerability discovery tool, proves effective in code audits and reverse engineering but has inconsistent exploit validation.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Cisco SD-WAN CVE-2026-20182 to its Known Exploited Vulnerabilities (KEV) catalog, mandating urgent remediation.
G7 countries released guidance on AI Software Bill of Materials (SBOM), outlining minimum elements to enhance transparency in AI systems and supply chains.
SecurityScorecard acquired Driftnet to improve threat intelligence and third-party risk visibility, responding to growing concerns over supply chain attack vectors.
Akamai announced the acquisition of LayerX for $205 million, expanding its Zero Trust portfolio to include browser-level protection.