Honeywell on DanSec Daily

Cybersecurity Brief – 2026-09-23

Wed, 23 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters cyber extortion group claims to have breached the US Federal Bureau of Investigation, stealing data on current and former employees and job applicants. The group states it exploited a zero-day vulnerability in Oracle PeopleSoft to access internal services and exfiltrate sensitive data. ShinyHunters is demanding the FBI retract a report describing its tactics and threatens to leak the stolen information if demands are not met ^[10]^[24]^[50]^[52].
Threat actors stole 170 private repositories from cybersecurity firm CrowdSec by leveraging an OAuth token obtained through the TanStack npm supply chain attack on a former employee’s computer ^[35].
Sweden’s data privacy regulator fined IT provider Miljödata $183,000 for insufficient security measures that led to a breach in August 2025, affecting 2.2 million individuals ^[22].

Newly Discovered Vulnerabilities

F5 disclosed and patched a critical zero-day vulnerability (CVE-2026-94127) in BIG-IP Access Policy Manager (APM) that allows unauthenticated attackers to execute remote code on affected systems. The flaw was actively exploited in attacks targeting OAuth servers ^[7]^[20]^[49].
Check Point released emergency fixes for a zero-day vulnerability (CVE-2026-93616) in its Security Management Server, which allowed attackers in targeted attacks to upload and execute arbitrary scripts ^[11]^[27]^[51].
Arista Networks patched a zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments, which was being actively exploited to allow remote attackers access to privileged internal functionality ^[17]^[48].
A new cPanel flaw in the CalDAV and CardDAV services enables any hosting account holder to execute code as root, granting full server control ^[3].
A critical vulnerability in Bifrost, an open-source AI gateway, allows unauthenticated attackers to execute arbitrary commands on the server without credentials ^[15].
A use-after-free vulnerability in the Linux kernel’s AF_UNIX socket subsystem enables container escape and host root access. An exploit has been released and the flaw remains unpatched in Ubuntu ^[6].
WordPress patched a critical flaw in its core software that allowed unauthenticated attackers to load arbitrary PHP files from outside theme folders, potentially leading to remote code execution on some servers ^[12].
Next.js disclosed a critical ImageResponse vulnerability that can lead to server code execution via crafted SVG input ^[9].
Adobe released patches for nine critical vulnerabilities in Connect and AEM Forms that could be exploited for arbitrary code execution and privilege escalation ^[43].
Google Chrome 154 patched 108 vulnerabilities, including several rated critical for memory safety and memory corruption ^[45].

Notable Threat Actor Activity

A Chinese state-linked threat actor (UTA0565) exploited a zero-day exploit chain in Google Chrome and Microsoft Windows via fake websites to deploy CLEANGULP malware, targeting victims with advanced techniques ^[8].
Chinese-speaking threat actors have been exploiting vulnerabilities in Zyxel GS1900 Smart Managed Switches and WordPress to steal sensitive government data from nearly 1,000 devices and over 18,500 records ^[23].
The EvilTokens phishing-as-a-service platform, which compromised more than 12,000 Microsoft accounts at over 10,000 organizations using AI-driven attack chains, was disrupted in a coordinated takedown by Microsoft, which seized 50 websites and disabled over 150 domains ^[14]^[28]^[33]^[44].
A malicious npm package (“tw-pkgprobe-7731”) posed as a Twilio bug-bounty probe to target developers, enabling credential exfiltration ^[13].
A new Windows malware, ClosedQuorum, uses multiple AI models (Google Gemini, DeepSeek, Qwen, Mistral) to autonomously determine post-compromise actions ^[25].
The Ryuk ransomware group member was sentenced to 24 months in prison for attacks on US companies ^[19].
Threat actors exploited a stolen OAuth token from a former employee to access CrowdSec’s private GitHub repositories ^[35].

Trends, Tools, or Tactics of Interest

An AI-assisted phishing campaign sent over one million personalized emails attempting payment diversion scams, demonstrating the growing use of AI in large-scale phishing operations ^[1].
AI is increasingly being leveraged in both attack (e.g., phishing, malware decision-making) and defense (e.g., autonomous security agents), with new tools emerging to benchmark and control AI agent performance ^[4]^[5]^[25]^[36]^[44]^[47].
Attackers with privileged access can register rogue external MFA providers to steal user passwords during legitimate login attempts ^[21].
More than 80,000 AI relay servers are being used to mask Chinese access to frontier AI models in the US, likely to facilitate model cloning ^[31].
A proof-of-concept zero-day tool, BigDiskBuster, was released that can block Microsoft Defender updates by filling available disk space ^[16].
The Cybersecurity and Infrastructure Security Agency (CISA) published guidance on deception techniques to help organizations set traps for cybercriminals ^[34].
Shadow IT remains a challenge, with tools like Wazuh recommended to improve visibility of unmanaged endpoints and unauthorized assets ^[26].
Honeywell research indicates that while 88% of OT security leaders consider their programs mature, only 21% have a complete OT asset inventory, and full autonomy in OT security remains rare ^[42].

Regulatory or Policy Developments Affecting the Security Industry

Sweden’s IMY imposed a significant fine on Miljödata for inadequate data protection, reinforcing regulatory expectations for IT service providers handling large volumes of personal data ^[22].

Sources

ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants - thehackernews.com
ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach - bleepingcomputer.com
ShinyHunters Claims FBI Hack, Demands Retraction of Threat Report - securityweek.com
ShinyHunters claims FBI breach was revenge for “false” report - malwarebytes.com
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data - darkreading.com
Sweden fines Miljödata $183,000 over breach affecting 2.2 million - bleepingcomputer.com
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers - thehackernews.com
F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks - bleepingcomputer.com
Critical F5 BIG-IP Vulnerability Exploited as Zero-Day - securityweek.com
Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks - thehackernews.com
Check Point warns of Management Server zero-day exploited in attacks - bleepingcomputer.com
Check Point Patches Exploited Management Server Zero-Day - securityweek.com
Arista patches actively exploited VeloCloud Orchestrator zero-day - bleepingcomputer.com
Arista Urges Immediate Patching of Exploited VCO Zero-Day - securityweek.com
New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control - thehackernews.com
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials - thehackernews.com
Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape - thehackernews.com
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers - thehackernews.com
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input - thehackernews.com
Adobe Patches Critical Flaws in Connect, AEM Forms - securityweek.com
Chrome 154 Patches 108 Vulnerabilities - securityweek.com
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware - thehackernews.com
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data - bleepingcomputer.com
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises - thehackernews.com
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts - bleepingcomputer.com
Microsoft Disrupts EvilTokens Device Code Phishing Service - darkreading.com
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft - securityweek.com
Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials - thehackernews.com
New ClosedQuorum Windows malware uses AI for attack decisions - bleepingcomputer.com
Ryuk ransomware member sentenced to 24 months in prison - bleepingcomputer.com
AI-Assisted Phishing Campaign Sent Over A Million Personalized Emails - blog.knowbe4.com
545 Hackers Tested It First. Now XRanges for AI Scores Your Security Agent - thehackernews.com
Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests - thehackernews.com
Amid Ongoing Rogue Incidents, Debate Over AI Safety Gets Real - darkreading.com
Outerlimit Raises $16 Million to Stop Rogue AI Agents From Causing Harm - securityweek.com
Rogue external MFA providers can steal passwords during logins - bleepingcomputer.com
Relays Are Masking Chinese Access to Frontier AI Models in the US - darkreading.com
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates - thehackernews.com
Deception by Design: CISA's Guide to Tricking Cybercriminals - darkreading.com
Reducing shadow IT visibility gaps with Wazuh - bleepingcomputer.com
Honeywell: OT Security Teams Embrace AI, but Autonomy Still Rare - securityweek.com

Cybersecurity Brief – 2026-03-04

Wed, 04 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

AkzoNobel, a multinational paint company, confirmed a cyberattack that breached the network of one of its U.S. sites.
LexisNexis Legal & Professional confirmed a data breach involving unauthorized access to customer and business information, with stolen files leaked by attackers.
Cloud Imperium Games (developer of Star Citizen) disclosed a breach in January affecting systems containing user personal data.
The University of Hawaii Cancer Center reported a ransomware attack in August 2025 that compromised personal and health data of nearly 1.2 million individuals.
Amazon confirmed that drone strikes damaged three AWS data centers in the United Arab Emirates and one in Bahrain, resulting in significant outages.
Facebook experienced a worldwide outage, rendering accounts inaccessible for a period.
Interpol, with support from private threat hunters, dismantled an African cybercrime syndicate, resulting in 574 arrests and the recovery of over $3 million.

Newly Discovered Vulnerabilities

VMware Aria Operations (CVE-2026-22719): A remote code execution vulnerability is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog.
Android/Qualcomm Zero-Day (CVE-2026-21385): An actively exploited high-severity memory corruption flaw in Qualcomm display components was patched in the latest Android update.
MS-Agent AI Framework: A vulnerability in Microsoft’s AI framework allows attackers to achieve full system compromise through improper input sanitization, exploitable via the Shell tool.
Chrome Extension Flaw: A now-patched vulnerability allowed Chrome extensions to inherit Gemini’s camera, microphone, and file access permissions.
AirSnitch Wi-Fi Attack: Researchers disclosed a Wi-Fi vulnerability (“AirSnitch”) that allows nearby attackers to intercept sensitive data and perform machine-in-the-middle attacks, demonstrating that Wi-Fi client isolation may not provide adequate protection.
Honeywell IQ4 Building Controllers: Dispute over the impact of vulnerabilities in internet-exposed building management controllers, with researchers claiming thousands are at risk.
CrushFTP: Ongoing brute-force scans reported against CrushFTP instances, which have a history of serious vulnerabilities.

Notable Threat Actor Activity

Fake IT Support/Havoc C2: Threat actors are using fake tech support spam to deploy customized Havoc command-and-control (C2) frameworks inside organizations, enabling data exfiltration and persistence.
OAuth Redirect Abuse: Microsoft warned of phishing campaigns abusing OAuth URL redirection and error flows to bypass email and browser phishing protections, delivering malware to government targets.
Starkiller Phishing Suite: A new phishing toolkit, Starkiller, uses adversary-in-the-middle (AitM) reverse proxy techniques to bypass multi-factor authentication.
Compromised Site Management Panels: Sale of compromised cPanel credentials is surging in cybercrime markets, facilitating plug-and-play phishing and scam operations.
Pro-Iranian Cyber Activity: Increased hacktivist campaigns and cyberattacks attributed to pro-Iranian actors in response to US-Israeli military actions, with an emphasis on causing economic and physical disruption.
Iranian Targeting of IP Cameras: Iranian-linked cyber operations are targeting IP cameras in conjunction with physical warfare in the Middle East.
Silver Dragon: A Chinese-aligned threat group, “Silver Dragon,” is targeting organizations in Southeast Asia and Europe, demonstrating operational links to broader campaigns.
AI-Driven FortiGate Attacks: Threat actors are leveraging the open-source CyberStrikeAI platform in AI-assisted attacks targeting Fortinet FortiGate appliances across 55 countries.
Coruna iPhone Hacking Toolkit: A sophisticated iPhone exploitation toolkit, believed to have originated from a US government contract, is now in the hands of foreign spies and criminals and has likely compromised tens of thousands of devices.

Trends, Tools, or Tactics of Interest

RMM Tool Phishing: Fake video meeting invites are being used to trick users into installing remote monitoring and management (RMM) tools, enabling unauthorized access.
AI Agent and Identity Risks: The rise of Model Context Protocol (MCP) and AI agents is introducing new, unmanaged workload identities, increasing the complexity of identity management and potential attack surfaces.
Quantum Threat to RSA: Recent developments indicate quantum decryption of RSA may be achievable sooner than previously expected, raising concerns over the security of current cryptographic standards.
AI in Security Testing: The deployment of open-source, AI-native security testing platforms is being observed in active cyberattacks, particularly against network appliances.
cPanel Marketplaces: The commoditization of compromised site management credentials is enabling scalable, automated phishing attacks.
Wi-Fi Client Isolation Limitations: AirSnitch research demonstrates that Wi-Fi client isolation may not prevent interception or manipulation of sensitive data.
Vehicle Tire Pressure Sensors: Research shows tire pressure sensors can leak data enabling silent tracking of vehicles.
Journalistic Operations in Censored Environments: Journalists in Iran are relying on satellite communications and encrypted apps to circumvent internet blackouts.

Regulatory or Policy Developments

CISA Action: The addition of VMware Aria Operations CVE-2026-22719 to CISA’s Known Exploited Vulnerabilities catalog mandates urgent mitigation for US federal agencies and highlights the vulnerability’s significance.
Pentagon AI Procurement: The US Department of Defense has dropped Anthropic AI from certain projects over security risks, with OpenAI taking over, reflecting ongoing scrutiny of AI model integration in sensitive environments.
Google Chrome Release Cycle: Google Chrome will move to a two-week release cycle, enabling faster deployment of security patches and features.

Cybersecurity Brief – 2026-02-19

Thu, 19 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Figure Technology Solutions suffered a data breach impacting nearly one million accounts, exposing personal and contact information.
Betterment’s data breach is more severe than initially reported, with leaked data including sensitive personal and financial details.
A vast online database containing billions of records, including Social Security Numbers, was found exposed and accessible, posing significant identity theft risks.

Newly Discovered Vulnerabilities

Grandstream GXP1600 series VoIP phones are affected by a critical unauthenticated remote code execution vulnerability (CVE-2026-2329), allowing attackers root-level access and enabling call interception, toll fraud, and user impersonation.
Four widely used Microsoft Visual Studio Code extensions (collectively over 125 million installs) were found to contain multiple vulnerabilities, potentially enabling threat actors to compromise developer environments.
Multiple Honeywell CCTV products used in critical infrastructure are vulnerable to an authentication bypass flaw, allowing unauthorized access to video feeds and account hijacking.
Dell RecoverPoint for Virtual Machines is affected by a maximum severity zero-day vulnerability (CVE-2026-22769), exploited since mid-2024 by a China-linked threat group (UNC6201) for lateral movement, persistence, and malware deployment.
Foxit and Apryse PDF platforms contained 16 vulnerabilities that could be exploited for account takeover and data exfiltration via malicious documents or URLs.
CISA has added a vulnerability in TeamT5’s ThreatSonar Anti-Ransomware to its Known Exploited Vulnerabilities (KEV) catalog; the issue was patched in 2024 but is being actively exploited.

Notable Threat Actor Activity

The China-nexus threat actor UNC6201 has exploited Dell RecoverPoint for VMs zero-day since mid-2024.
Kenyan authorities reportedly used Cellebrite’s forensic extraction tool against a dissident’s mobile device while in custody.
Telegram underground channels rapidly weaponized SmarterMail vulnerabilities (e.g., CVE-2024-XXXX), sharing PoCs and stolen credentials shortly after public disclosure.
New Keenadu Android malware has been found preinstalled on thousands of devices and distributed via Google Play and other app stores.
Hackers are actively exploiting a vulnerability in TeamT5’s ThreatSonar Anti-Ransomware product.
AI platforms such as Grok and Microsoft Copilot are being abused as covert communication channels for malware command-and-control (C2) activity.

Trends, Tools, or Tactics of Interest

AI and quantum advancements are driving recommendations for substantially longer passwords (25+ characters) to withstand brute-force and future cryptanalytic attacks.
AI-powered chatbots are being weaponized for scams, including a fake “Gemini” chatbot used to pitch fraudulent “Google Coin” schemes.
Phishing campaigns are leveraging fake Google Forms sites to harvest Google login credentials from job seekers.
Anti-phishing heuristic rules in Microsoft Exchange Online mistakenly blocked legitimate emails and Teams messages, disrupting business communications.
Microsoft 365 Copilot bug has caused confidential emails to be summarized by the AI assistant, bypassing organizations’ data loss prevention policies.
A significant percentage (over 40%) of South Africans reported being scammed in 2025, highlighting the prevalence of scalable, low-friction scams.
Underground threat communities are accelerating the weaponization of disclosed vulnerabilities, as evidenced by rapid exploitation of SmarterMail flaws.
Malware campaigns are increasingly using steganography, such as embedding payloads in image files.

Regulatory or Policy Developments Affecting the Security Industry

CISA has issued warnings regarding active exploitation of vulnerabilities in Honeywell CCTV products and TeamT5 ThreatSonar Anti-Ransomware, urging immediate patching and mitigation.
CISA’s KEV catalog continues to expand with newly exploited vulnerabilities, reinforcing mandatory remediation timelines for federal and critical infrastructure entities.

Cybersecurity Brief – 2025-08-13

Wed, 13 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Hackers leaked data stolen from Allianz Life in ongoing Salesforce data theft campaigns, exposing 2.8 million records containing sensitive information on business partners and customers.
Over 275 million patient records were breached in the healthcare sector in 2024, primarily due to weak or stolen passwords.
Researchers identified Docker images on Docker Hub still containing the XZ Utils backdoor, more than a year after its public disclosure. At least 35 Linux images remain affected, posing ongoing supply chain risks.
The U.S. Department of Justice seized approximately $1 million in cryptocurrency from the BlackSuit ransomware gang.
Over 3,300 Citrix NetScaler devices remain unpatched against the actively exploited “CitrixBleed 2” vulnerability, leaving organisations at risk of authentication bypass attacks.

Newly Discovered Vulnerabilities

Microsoft’s August 2025 Patch Tuesday addressed 107–111 vulnerabilities, including 13–17 rated as critical. One publicly disclosed zero-day vulnerability in Windows Kerberos was patched, alongside several elevation-of-privilege flaws.
Adobe released security updates fixing over 60 vulnerabilities across 13 products, including Commerce, Substance, InDesign, FrameMaker, and Dimension.
SAP patched a critical vulnerability in S/4HANA as part of its August 2025 security notes.
Major industrial control system (ICS) vendors (Siemens, Schneider, Aveva, Honeywell, ABB, Phoenix Contact) issued advisories for code execution vulnerabilities.
Citrix NetScaler ADC products are being actively exploited via CVE-2025-6543, a critical security flaw confirmed by the Dutch National Cyber Security Centre (NCSC-NL).
A vulnerability in Erlang/OTP (CVE-2025-32433) has been widely exploited in operational technology (OT) networks since early May.
A now-patched WinRAR vulnerability has been exploited by at least two separate threat groups.

Notable Threat Actor Activity

The Charon ransomware family, employing APT-level evasion tactics, has been deployed in targeted attacks against public sector and aviation organisations in the Middle East. The campaign may be linked to China’s state-sponsored Earth Baxia group.
Cybercrime groups ShinyHunters and Scattered Spider have joined forces in data extortion campaigns, initially targeting Salesforce customers, with indications of expansion towards financial services and technology providers. ShinyHunters’ tactics now mirror those of Scattered Spider.
The newly identified Curly COMrades APT group has targeted government entities in Georgia and Moldova using custom backdoor malware and NGEN COM hijacking for persistent access.
Fortinet SSL VPN devices experienced a significant spike in brute-force attacks globally, with attackers later shifting focus to FortiManager.
Researchers report ongoing exploitation of Microsoft Teams in social engineering attacks to facilitate credential theft and malware delivery.

Trends, Tools, or Tactics of Interest

Supply chain risks persist as malicious Docker images with the XZ Utils backdoor remain available on Docker Hub.
Threat actors continue to abuse business logic flaws and leverage dark web marketplaces to sell enterprise network access, streamlining cybercrime operations.
Social engineering remains a prominent attack vector, with attackers exploiting communication platforms (e.g., Microsoft Teams) and using tactics such as tax office or Amazon recall impersonation scams.
APT actors are leveraging advanced persistence techniques, such as NGEN COM hijacking and scheduled tasks, to maintain long-term access in targeted environments.
The debate between enterprise browsers and secure browser extensions is highlighted as a key consideration for mitigating browser-based risks.
Elevation-of-privilege vulnerabilities dominated Microsoft’s August 2025 Patch Tuesday, reflecting ongoing attacker interest in privilege escalation.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced end-of-support for Windows 11 23H2 Home and Pro editions in November 2025.
Android’s protected Kernel-based Virtual Machine (pKVM) achieved SESIP Level 5 security certification, the highest level for IoT and mobile platforms.
The Dutch NCSC issued an alert regarding active exploitation of Citrix NetScaler CVE-2025-6543 in critical sectors.
Chinese authorities have publicly questioned the security of AI chips from Nvidia and AMD, citing concerns about potential backdoors.

Cybersecurity Brief – 2025-08-01

Fri, 01 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

A Florida correctional institution inadvertently leaked the names, email addresses, and telephone numbers of all facility visitors to every inmate.
North Korea-linked threat actor UNC4899 targeted two organizations to steal millions in cryptocurrency by luring employees via LinkedIn and Telegram, leveraging cloud account access and malware.
Financially motivated threat actor UNC2891 breached ATM networks using a 4G-equipped Raspberry Pi device and attempted to deploy the CAKETAP rootkit for fraudulent activity.

Newly Discovered Vulnerabilities

Multiple critical and high-severity vulnerabilities were patched in Honeywell Experion PKS, an industrial process control and automation product, which could have allowed manipulation of industrial processes.
Malicious connectors in Microsoft 365 were highlighted as a serious and growing email threat vector, potentially impacting hundreds of millions of users.

Notable Threat Actor Activity

The Russian state-affiliated group Secret Blizzard (also known as Turla) was observed using adversary-in-the-middle (AitM) attacks at the ISP level to deploy malware against foreign embassies in Moscow, leveraging local ISP access to intercept and manipulate web traffic.
Scattered Spider, a threat actor known for social engineering, continues to use techniques that mimic legitimate IT support to gain access to target networks, as noted in a recent CISA advisory update.
SentinelLabs reported links between Chinese state-sponsored hackers and Chinese companies developing intrusion tools used in offensive operations.

Trends, Tools, or Tactics of Interest

Researchers identified a multi-layer redirect phishing tactic targeting Microsoft 365 users, which abuses link wrapping services from Proofpoint and Intermedia to bypass security defenses and steal login credentials.
ClickFix and FileFix were profiled as social engineering attacks that start in the browser and use clipboard or File Explorer hijacking to deliver malware.
Analysis revealed that in approximately 80% of cases, spikes in malicious activity such as network reconnaissance and targeted scanning precede the public disclosure of new security vulnerabilities (CVEs).
LayerX demonstrated that browser extensions can be exploited to compromise generative AI tools via a technique dubbed ‘man-in-the-prompt’, posing a significant risk to sensitive data.
BrainDamage, a new payload generator and encrypted shell stager toolkit, was released for red team operations, focusing on stealth and remote command delivery.
Kali Linux is now supported in Apple containers on macOS Sequoia, expanding virtualization options for security professionals.
CISA released Thorium, an open-source platform for malware and forensic analysis, aimed at supporting containment and eviction during incident response.
The Gartner 2025 Magic Quadrant highlights increasing adoption of AI-driven solutions in endpoint security to address complex and growing threats.
Security Operations Centers are experiencing alert fatigue and data overload, with traditional SIEMs struggling to keep pace with increasing log volumes and complexity.
Proton launched a free, standalone, cross-platform two-factor authentication app, Proton Authenticator.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced that, between October 2025 and July 2026, it will disable external workbook links to blocked file types by default in Excel.
Microsoft expanded its .NET and ASP.NET Core bug bounty program, offering rewards of up to $40,000 for eligible vulnerabilities.
Meta is sponsoring the Pwn2Own Ireland 2025 hacking competition, offering up to $1 million for a successful WhatsApp exploit.
The Trump Administration, in collaboration with 60 companies, is developing a plan for Americans to voluntarily upload their healthcare and medical data.
Significant funding rounds were announced: Noma Security raised $100 million for AI agent security solutions, Wallarm raised $55 million for API security, and Reach Security received $10 million for AI-driven exposure management solutions.