Details have been published of a critical flaw in the programming language PHP, which is the backbone of more than 70% of all websites. Left unfixed, the flaw would allow hackers to easily take over and compromise millions of websites and the information held on their servers. In response, multiple European governments and operators including the Port of Rotterdam have taken websites offline.
Updating WordPress, Drupal or a plugin will not close the PHP flaws that took government websites offline this week. The vulnerable code sits in the PHP engine underneath them, so every server, appliance and hosting platform running PHP has to be found and updated.
Attackers have used a stolen credential from a Microsoft 365 backup service to sign in to hundreds of customer tenants. Because backup tools need broad access to mail, files and directories, the attackers inherited that access.
Data concerns have delayed or derailed AI projects at 86 per cent of organisations in the past 12 months. That is despite 95 per cent naming better use of data to improve business outcomes as a top priority.
A quarter of enterprise security breaches will trace back to AI agent abuse by 2028, Gartner predicts. It blames unmanaged machine privileges and legacy credential practices.
Australian organisations will no longer be able to summarise their cyber security posture with a single Essential Eight maturity level. The Australian Signals Directorate (ASD) has released a principles-based replacement that rates security area by area.
Origin Energy has seen no evidence that customer data taken in its July cyber incident has been published online, but chairman Scott Perkins has told shareholders the risk remains and affected customers must stay alert to scams.
Microsoft is undertaking the biggest restructuring of its Copilot strategy since it began embedding OpenAI's technology across its software three years ago, a move triggered by leaked internal figures showing that very few of its commercial customers pay for the assistant or use it regularly.
For most of the last two years, enterprise AI conversations started with the model. Organisations debated which foundation model to use, how to fine-tune it, and which orchestration framework would deliver the best results.
Elastic has expanded its collaboration with OpenAI to help organisations build production AI applications that draw on their own enterprise data. For organisations that deploy the two together, Elasticsearch acts as the retrieval and governance layer feeding OpenAI's reasoning models.
A single compromised email account, paired with an AI assistant, can be escalated into chief executive impersonation and a $250,000 wire transfer scam. A controlled attack by Barracuda's red team has shown how.
Almost two thirds of Victorian local government officers are using artificial intelligence without clear governance behind them, a new survey has found. The gap exposes councils to privacy, accountability and compliance risk.
One in four malicious data breaches over the past year was AI-enabled, and those breaches cost an average of US$6 million, about US$1 million more than the global average.
The UK government has abandoned its controversial national digital ID card, with reports that incoming prime minister Andy Burnham is dropping the scheme announced by the previous administration. Savings will be redirected to a tax cut aimed at lowering household electricity bills. https://insight.scmagazineuk.com/news-briefs/uk-government-scraps-controversial-digital-id-card-scheme
A UK parliamentary inquiry has found the catastrophic 2022 Afghan data breach was a foreseeable systemic failure caused by inappropriate tools, weak procedures and a poor data protection culture, not a single employee's mistake.
Singapore has clarified when and how organisations can use personal data to build and improve generative AI models, including when publicly available data may be scraped from the web without consent.
AI systems are increasingly returning sensitive information to people and agents who are not authorised to see it, with these "downstream" violations more than doubling over the past year.
