A practitioner runbook for when a vendor that holds your data is breached: triage, scoping, containment, the notification ...

Which metrics a third-party risk management program can defend to a board or regulator: coverage, timeliness, evidence ...

Arista disclosed on 22 October 2026 that on-premises VeloCloud Orchestrator (VCO), the management portal for VeloCloud SD-WAN, has a SQL injection flaw, CVE-2026-114625, that it says is being ...

Versions patched on 12 October (19.4.2, 19.3.5 and 19.2.8) are still affected: each is below the fixed version for its line (19.4.3, 19.3.6 and 19.2.9). Instances below 19.4.2, 19.3.5 or 19.2.8 on the ...

The private keys of eight intermediate certificate authority (CA) certificates operated by the Indian CA eMudhra (emSign brand) have been compromised. Mozilla and the Chrome Root Program confirmed the ...

The OpenCode Console breach was the result of unauthorized access to a legacy system that was in the process of being decommissioned. This system stored API keys for third-party AI providers, ...

The breach at Nikkei Inc. was facilitated through the compromise of credentials granting access to a cloud service used for system development. According to the official disclosure and corroborating ...

Status (22 October 2026, 19:05 Cyprus time (UTC+3)): Monitoring. Bullhorn's status page shows "Partial System Outage". Bullhorn says it detected a cyber incident on the Bullhorn Platform on 17 October ...

Oracle has fixed CVE-2026-101767, a vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (EBS), in its October 2026 Critical Patch Update, released on 20 October ...

A hub for the capabilities behind modern third-party risk management - continuous monitoring, attack surface monitoring, ...

What FedRAMP requires when a cloud service provider is in a federal agency's supply chain: the FedRAMP Authorization Act (44 ...

The catch: the attackers brought their own genuine, signed copy of Siemens Software Center. Siemens lists the program appearing in start-up apps or Task Scheduler "of a PC that never had it installed" ...