AI keeps showing up in places I think security teams should watch closely. |
Today, that ranges from critical enterprise flaws and AI model security to changes inside the SOC.
Meanwhile, two alleged TeamPCP members were arrested, and another employee data breach shows the usual threats aren’t going anywhere. - Ken Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Hasbro Data Breach Hits Employee Records |
I’m following the Hasbro breach that exposed employee Social Security numbers, financial information, payment card data, and driver’s license information. Hasbro has not disclosed how the account was compromised or how many employees were affected, but filings confirm 436 affected employees in Massachusetts. |
My Take: There’s still a lot we don’t know about this breach, but I think the broader lesson is to assume an account will eventually be compromised and design access controls to limit the blast radius. Security teams should restrict access to employee data, enforce phishing-resistant MFA, and alert on unusual downloads or bulk access from workforce accounts. |
ServiceNow Patches Three AI Platform Flaws |
What concerns me about three recent ServiceNow AI Platform vulnerabilities is that unauthenticated attackers could exploit them to execute code, escalate privileges, or access and modify data.
The flaws require no user interaction and have low attack complexity, although ServiceNow says it has not seen active exploitation. My Take: The lack of known exploitation shouldn’t change your patching or compensating control strategy. Self-hosted customers should patch now, then review affected instances for unexpected privilege changes or other anomalous administrative activity. |
Cisco Finds AI Reshaping Security Jobs |
I’m seeing AI reshape cybersecurity jobs as agents take on SOC triage, ticket management, and basic vulnerability testing.
Cisco-backed research found demand for AI skills in cybersecurity job postings doubled across G7 countries, alongside growing demand for ethical reasoning and systems thinking. My Take: I don’t see AI eliminating cybersecurity jobs as much as changing what skills those jobs require.
Security leaders need to invest in their teams’ technical skills so they know when to trust AI output and when human judgment needs to take over. |
|
|
|
We’d love your quick input on Qualcomm Snapdragon. This short survey will help us understand awareness and recognition of the brand.
It’s just 4 questions (with 3 optional ones if you have time) and takes 2 minutes or less. [Take the Survey] Thank you for your time and feedback! |
|
|
|
TeamPCP Suspects Arrested Over Supply Chain Attacks |
Australian authorities arrested two men allegedly tied to TeamPCP supply chain attacks that stole more than 500,000 credentials and 300 gigabytes of data. The group allegedly compromised trusted development tools and CI/CD pipelines to push malicious code into Trivy and LiteLLM. |
My Take: What stands out to me is the suspects’ poor OPSEC on reusing usernames, which ultimately helped researchers identify them.
Security teams should rotate every credential tied to a compromised environment, use short-lived and narrowly scoped publishing tokens, and pin GitHub Actions to full commit SHAs. |
NVIDIA Fixes NemoClaw Flaw That Exposes AI Models |
What caught my attention about this NVIDIA NemoClaw vulnerability is that a malicious website could reach a local Ollama server and persistently alter the model used by an AI agent. Researchers demonstrated how the attack bypassed protections around the sandboxed agent by targeting the underlying inference layer instead.
My Take: This is a good example of why AI agent security has to extend beyond the agent itself. Local inference servers should be treated as privileged infrastructure because compromising the model underneath an agent can influence its behavior without breaching the agent itself.
Teams using NemoClaw should verify NVIDIA’s fix, restrict Ollama to loopback access, and monitor model templates and configurations for unexpected changes. |
|
|
|
Where Is Your Software Supply Chain Exposed? |
Threat actors are introducing malicious software packages, compromising dependencies, and targeting build systems to reach organizations through tools they already trust in the software supply chain. |
How to strengthen your software supply chain: |
-
Pin dependencies, verify software integrity, and maintain an SBOM to identify vulnerable or compromised components.
- Use short-lived, least-privilege CI/CD credentials and scan repositories and pipelines for exposed secrets.
-
Leverage DevSecOps tools to automate security checks and monitor build environments for suspicious activity.
|
Identify which build systems and dependencies could become attack paths to production, then prioritize controls around those with the greatest downstream impact. |
|
|
|
Security Tools You Can Use |
-
Build your skills — earn your CompTIA CSIE with CySA+, CASP, Security+, and Pentest+ training for 74% off.
-
Start your cybersecurity career for free — enroll in Microsoft’s 9-course Analyst Certificate series on Coursera today.
-
Protect your business from threats — get 30% off Bitdefender’s powerful cloud and on-premise protection today.
|
|
|
|
AI Career Check: What’s changing most on your security team? |
|
|
|
Yesterday's Pulse Check Results |
Will Meta’s nearly $18B settlement change Big Tech privacy? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
