Attack preferences keep changing

In today’s news, Verizon released the latest DBIR, Defender is targeted, and a Linux flaw enables root access.   

Help shape our TechRepublic content by taking this quick survey.  

Read past newsletters here.

Here’s what you need to know:

Zero-Day Download

Verizon DBIR Warns AI Accelerates Cyberattacks

Verizon released its latest DBIR report, which showed vulnerability exploitation overtook credential abuse as the leading initial access vector, accounting for 31% of breaches.

The report also highlights growing third-party risk (48% of breaches), 96% of ransomware attacks hitting SMBs, and layer 8 (humans) involved in 62% of incidents.

Source: Verizon

Verizon also found threat actors are increasing their use of genAI to speed up and scale attacks.

Prioritize patch management, enforce MFA across all accounts, use TPRM solutions, layer security controls, and continuously monitor for shadow AI.

Microsoft Defender Vulnerabilities Under Attack

Two vulnerabilities in Microsoft Defender are being actively exploited in the wild.

The flaws affect core Microsoft Defender components and could allow attackers to gain SYSTEM-level privileges or disrupt endpoint protections. 

Microsoft has already pushed a fix for the issues.

Ensure endpoints are updated, enable Defender Tamper Protection, enforce least privilege access, monitor for suspicious SYSTEM-level activity, and test incident response plans.

Linux Kernel Flaw Exposes SSH Keys

A Linux kernel flaw hidden for nearly nine years is drawing attention after researchers demonstrated exploits capable of stealing SSH keys and gaining root access. 

The vulnerability affects the Linux kernel’s __ptrace_may_access() function and impacts major Linux distributions running kernels dating back to 2016, with public exploit material already circulating. 

Patches have already been released for the vulnerability. 

Apply the patch for your Linux distro, restrict ptrace access, rotate SSH host keys where exposure is suspected, and monitor for suspicious privilege escalation or abnormal root-level process activity.

Share this newsletter!

Pulse Check

Would you join a Cybersecurity Insider Reddit community for news and discussions?

Yesterday's Pulse Check Results

Typosquat Trap Check: Would You Catch the Fake?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Browser-Based Threats Hit SMBs

Cybersecurity threats targeting SMBs are increasingly shifting into the browser as employees rely heavily on SaaS platforms, AI tools, and cloud-based applications. 

During a recent discussion, Palo Alto Networks warned that AI-powered phishing, malicious browser extensions, and risky AI tool usage are expanding the attack surface for SMBs.

Source: ChaGPT

Considering Verizon’s DBIR finding that 96% of ransomware attacks involve SMBs, the rise in browser-based threats against smaller organizations is concerning. 

Enforce MFA, limit unauthorized browser extensions, and use secure browser solutions that provide visibility into sensitive data access and risky browser activity.

Third-Party Risks Accelerate with AI 

Traditional annual vendor risk assessments are rapidly becoming outdated as AI adoption, cloud services, and fourth-party providers continuously reshape enterprise attack surfaces. 

During a recent discussion, Auditive CEO Daniel Faddoul warned that many organizations only assess vendors during onboarding, limiting visibility into evolving AI, technology, and data handling risks. 

Faddoul warned that as vendors expand their use of AI, connected systems, and external providers, organizations relying on manual and compliance-driven processes may struggle to maintain visibility into evolving third-party risk. 

Prioritize continuous monitoring for critical vendors first, track changes in AI usage and fourth-party dependencies, and establish clear workflows for reassessing vendors when new risk signals or security posture changes are identified.

Join live: How leading teams operationalize AI risk

AI is accelerating vendor sprawl, expanding third-party risk, and increasing the volume of controls teams need to manage.

Join Vanta CEO Christina Cacioppo and CPO Jeremy Epling on June 3rd for a virtual launch event showing how Vanta is built to handle the risk AI creates. 

You’ll walk away with a clear view of how to manage AI-driven risk across vendors, controls, and continuous monitoring.

Security Tip of the Day

Are Your Vendors Increasing Risk? 

Third-party vendors continue to expand enterprise attack surfaces as organizations adopt more AI tools, cloud platforms, and interconnected services. 

A compromised vendor can expose sensitive data, disrupt operations, and increase security risk across these connected environments.

Source: ChatGPT

How to reduce overall third-party risk:

As third-party ecosystems continue to grow, organizations should prioritize continuous vendor visibility, stronger access controls, and regular risk reviews across suppliers and external service providers. 

Meet Our Writer:

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2026 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA.