Covers: Vulnerabilities & PatchingGovernance, Risk & ComplianceCloud SecurityData BreachesAI SecurityThreat Actors & Nation-StateSupply Chain & AppSecDetection & ResponseZero-Days & ExploitsEndpoint & Network Security
Microsoft's January 2025 Patch Tuesday addressed 159 vulnerabilities, including 10 critical and 149 important severity flaws, and fixed eight zero-day vulnerabilities, three of which were actively exploited in attacks. Adobe released five advisories...
Qualys' Threat Research Unit reported an ongoing Mirai variant it calls Murdoc Botnet, active since July 2024, exploiting CVE-2024-7029 and CVE-2017-17215 to compromise AVTECH cameras and Huawei HG532 routers. The researchers found roughly 1,300 active...
Qualys reports that over 1,255 organizations have deployed AI/ML software across 2.8 million assets, with 6.2 percent of those assets, roughly 175,000, classified as critical and at high risk. The post cites research that 55 percent of data leaders rank...
Qualys tested the distilled DeepSeek-R1 LLaMA 8B variant on its TotalAI platform and found the model failed 61% of 891 knowledge-base assessments, performing worst in Misalignment and best in Sexual Content. It also failed 58% of 885 jailbreak attacks...
Qualys announced the mROC Partner Alliance, an invite-only program for MSSPs to deliver managed risk services built on its Enterprise TruRisk Management platform, the cloud Risk Operations Center it launched in October 2024. The program covers advisory,...
Qualys outlines six AI security policies enterprises should implement: risk assessment, data security, access control with RBAC and MFA, an incident response plan, transparency and explainability, and regular monitoring and audits. The article names four...
This Qualys blog post describes privacy risks from generative AI tools, including data exposure, sharing with third parties without consent, training on unsecured personal data, and adversarial attacks that extract or reconstruct sensitive information. It...
Microsoft's February 2025 Patch Tuesday addressed 67 vulnerabilities, including three critical and 53 important severity flaws, plus four zero-day vulnerabilities of which two were actively exploited and two were publicly disclosed. Adobe released seven...
Qualys' Threat Research Unit identified two OpenSSH vulnerabilities: CVE-2025-26465, an active machine-in-the-middle attack on the client when VerifyHostKeyDNS is enabled (introduced December 2014, before OpenSSH 6.8p1), and CVE-2025-26466, a...
Qualys is adding a database assessment feature to its Cloud Agent that connects directly to a vault provider such as CyberArk Vault to fetch credentials and authenticate Oracle and MS SQL databases, checking them against CIS, DISA, NIST and other benchmark...
Qualys announced that its TotalCloud Kubernetes and Container Security product has achieved the Red Hat Vulnerability Scanning Certification, extending its scanning across Red Hat OpenShift, Quay.io, RHEL, and CoreOS. The company says its methodology...
Qualys cites the National Vulnerability Database as documenting over 280,000 vulnerabilities as of early 2025, with 33% rated high to critical, and notes 28,817 disclosures in 2023 and 22,254 by mid-2024, a 30% increase over the same period the prior year....
Microsoft's March 2025 Patch Tuesday addressed 67 vulnerabilities, including six critical and 51 important, and fixed seven zero-day flaws, six of which were actively exploited and one publicly disclosed. Adobe released seven advisories covering 38...
A Dark Reading and Qualys study of more than 100 security and IT practitioners found that 28% of organizations suffered a cloud- or SaaS-related data breach in the past year, and 36% of those affected had multiple breaches. The research attributes the top...
Qualys describes its Vulnerability Score (QVS) and Detection Score (QDS), components of TruRisk, as aggregating over 25 sources of threat intelligence to measure the likelihood of vulnerability exploitation. The post states that over half of all...
Oracle's April 2025 Critical Patch Update addressed 378 security vulnerabilities across its product families, with Oracle Communications receiving the most at 103 patches, followed by Oracle MySQL with 43 and Oracle Communications Applications with 42. Of...
Qualys describes security posture management for AI as an ongoing process of monitoring, assessing, and enhancing the security of AI models, data, and infrastructure, covering machine learning models, large language models, and automated decision systems....
Cloud Workload Protection (CWP) is defined here as securing applications and data hosted in cloud environments by continuously monitoring cloud workloads and containers and identifying threats, vulnerabilities, and misconfigurations. The source states that...
SSPM is a category of automated tools that track and manage security threats within SaaS applications by detecting misconfigurations, unused user accounts, excessive user rights, and compliance risks. Qualys describes SSPM as continuously monitoring cloud...
Qualys defines LLM security as protecting AI systems that generate human-like text, such as ChatGPT, from misuse and attacks, including data leaks and being tricked into harmful actions. The article states that LLMs are trained on huge amounts of text data...
Qualys describes generative AI risk mitigation as building an AI risk management framework to identify, assess, and reduce threats such as misuse, data leaks, and ethical concerns across the AI lifecycle. The article lists deepfakes and sophisticated scams...
Qualys describes data leakage prevention in AI as safeguarding confidential data such as customer details, financial records, and proprietary information during model development, training, and use. The article attributes many leaks to human error, citing...
The 2025 Verizon DBIR, analyzing 12,195 confirmed breaches, found vulnerability exploitation as the initial access vector rose to 20%, a 34% increase that approaches credential abuse at 22%, while edge devices and VPNs accounted for 22% of exploitation...
Qualys cites a recent study finding 72% of CISOs are concerned generative AI could introduce security breaches, while nearly 70% of enterprises plan to deploy LLMs in production within the next year. The post describes threats including prompt injection,...
Microsoft's May 2025 Patch Tuesday addressed 76 vulnerabilities, including five critical and 66 important severity issues, plus five zero-day vulnerabilities exploited in the wild and one publicly disclosed vulnerability. Adobe released 13 advisories...
Qualys published a blog describing how its Enterprise TruRisk Platform maps to the EU's Digital Operational Resilience Act, which sets a unified framework for managing technology risk at banks, insurers, investment firms, and payment providers, along with...
The UK's Cyber Essentials framework, developed by the NCSC and administered by IASME, was updated in April 2023 with a version addressing cloud security, multi-factor authentication, and secure remote work, and defines five technical controls: firewalls...
Qualys VMDR added a Vulnerability Detection Sources feature that records whether each vulnerability was found by a Cloud Agent, perimeter scan, internal scanner, or another supported method, and shows it in a new Sources column, a Group by filter, QQL...
Qualys TRU discovered two race-condition, local information-disclosure vulnerabilities: CVE-2025-5054 in Ubuntu's Apport core-dump handler and CVE-2025-4598 in systemd-coredump, the default handler on RHEL 9, RHEL 10, and Fedora. Qualys developed proofs of...
Microsoft's June 2025 Patch Tuesday addressed 69 vulnerabilities, including 10 rated critical and 57 important, plus one zero-day exploited in the wild and one publicly disclosed. Adobe released seven advisories covering 254 vulnerabilities across products...