Today’s news has some real consequences. |
As a former nurse, I’m watching the Boston Scientific outage closely. OpenAI also released its technical report on the Hugging Face incident, while CISA warned of attacks targeting more than 100 U.S. water systems. Just another day in cybersecurity… - Ken Read past newsletters here. | |
|
|
Here’s what you need to know: |
|
|
|
Meta Agrees to Nearly $18B Teen Safety Settlement |
My Take: I think another issue here is how to verify age without creating another repository of sensitive identity data for threat actors to target.
Organizations should minimize and encrypt age-verification data, limit retention, and avoid storing identity documents when possible. |
Cyberattack Disrupts Boston Scientific Operations Worldwide |
I’m following the Boston Scientific cyberattack that knocked IT systems offline and disrupted customer orders and shipments worldwide. For medical device manufacturers, disruptions can affect patient care when hospitals depend on timely access to devices for medical procedures. My Take: Having worked as a nurse with pacemaker and defibrillator patients, I’ve seen how critical these devices are for managing heart conditions. Incidents like this show how an IT outage can potentially impact quality of life. Medical device manufacturers should segment OT from enterprise IT networks and test manual failover procedures for fulfillment during outages. |
274 Zimbra Servers Compromised in Active Attacks |
I’m watching the active campaigns exploiting CVE-2026-73570 that have compromised at least 274 internet-facing Zimbra servers, according to CISA. The flaw allows unauthenticated remote command execution.
My Take: Patching an actively exploited vulnerability is only half the battle. Apply the patch or use compensating controls if patching isn’t possible. If you suspect a system may have been compromised, isolate it and investigate for indicators of compromise. |
|
|
|
Claude Is Already Inside Your Organization. Do You Control How It Is Being Used?
Your employees are using Claude right now through personal subscriptions, browser extensions, and SaaS tools your security team never approved. Traditional DLP and access controls were not built for this risk vector. Airia's guide gives CIOs and security leaders a framework to take control without blocking productivity. Gain full visibility across every Claude access surface • Enforce real-time controls on sensitive data leaving your environment • Build governance that scales with AI adoption |
|
|
|
OpenAI Reveals How AI Agents Breached Hugging Face |
I’ve been digging into OpenAI’s recent report on how their AI agents escaped testing boundaries and attacked Hugging Face systems. The agents used exposed API tokens and SSRF to find weaknesses, share discoveries, and expand access with limited human direction. |
My Take: The biggest concern for me is that the machine speed of autonomous agents leaves less time for human-driven containment.
Security teams should pair fundamentals like least privilege and segmentation with defensive AI agents that can detect, investigate, and contain threats at machine speed. |
Threat Actors Target 100+ U.S. Water Systems |
I’m following CISA’s recent warning that attackers targeted more than 100 internet-exposed systems at U.S. water utilities in July In some cases, they changed device settings and disrupted utilities’ ability to manage those systems.
My Take: What concerns me most is that utilities may not know every PLC or OT device exposed to the internet, especially equipment managed by third parties. Smaller municipalities also often lack the staff and resources to secure these systems, which is why recently proposed federal support is so important. |
|
|
|
Is Your AI Risk Under Control? |
AI risk is growing as models and autonomous agents gain greater access to sensitive data and systems, requiring security teams to rethink access controls and agent trust. |
- Establish AI governance by defining approved use cases, data policies, ownership, and security requirements.
-
Rethink agent trust by enforcing least privilege and requiring human approval for sensitive actions.
- Monitor and test AI by logging agent activity and testing guardrails for unauthorized access and data exposure.
|
As AI agents gain more autonomy, security teams should focus on limiting blast radius and ensuring anomalous behavior can be detected and contained quickly. |
|
|
|
Security Tools You Can Use |
|
|
|
Will Meta’s nearly $18B settlement change Big Tech privacy? |
|
|
|
Yesterday's Pulse Check Results |
How confident are you in your repository security? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
