ADMIN.FOUNDATION – Page 292 – cybersecurity / defense / intelligence

AI-Assisted Cybersecurity Leadership Services For Small And Mid-Sized Businesses (SMBs)

·

Blogs
This week in cybersecurity from the editors at Cybercrime Magazine

Sausalito, Calif. – May. 15, 2026

–Read the full story in SC Media

According to the 2026 CISO Report from Cybersecurity Ventures, sponsored by Sophos, there are now about 35,000 full-time CISOs worldwide. Most of them are employed by larger enterprises.

Small to mid-sized businesses (SMBs) typically can’t justify the salary, staffing, and operational support required for a full-time executive-level security leader. But there are alternatives that enable SMBs to rent a CISO.

A virtual CISO typically operates remotely to serve multiple customers, offering broad expertise and scalability. This model gives clients access to seasoned professionals who understand compliance frameworks, governance, and incident.

However, vCISOs may lack deep familiarity with an organization’s culture, workflows, and business priorities. And because they support multiple clients simultaneously, incident-response times during emergencies may vary.

Fractional CISOs also serve multiple customers but attempt to solve some of these limitations by embedding more deeply into each client organization on a part-time basis. A fractional CISO may attend leadership meetings, develop closer operational relationships, and align security decisions more directly with business strategy.

But fractional models also have tradeoffs. Availability can still be limited, especially when a widespread incident hits multiple clients at once. In practice, many SMBs that employ virtual or fractional CISOs find themselves balancing cost, continuity, and strategic depth.

A recent SC Media article dives into a promising new category for SMBs: AI-assisted security leadership services which aims to combine AI-driven analytics, continuous control validation, threat intelligence, and human oversight delivered through managed security providers (MSPs) and managed security service providers (MSSPs).

Read the Full Story

Cybercrime Magazine is Page ONE for Cybersecurity. Go to any of our sections to read the latest:
- SCAM. The latest schemes, frauds, and social engineering attacks being launched on consumers globally.
- NEWS. Breaking coverage on cyberattacks and data breaches, and the most recent privacy and security stories.
- HACK. Another organization gets hacked every day. We tell you who, what, where, when, and why.
- VC. Cybersecurity venture capital deal flow with the latest investment activity from various sources around the world.
- M&A. Cybersecurity mergers and acquisitions including big tech, pure cyber, product vendors and professional services.
- BLOG. What’s happening at Cybercrime Magazine. Plus the stories that don’t make headlines (but maybe they should).
- PRESS. Cybersecurity industry news and press releases in real time from the editors at Business Wire.
- PODCAST. New episodes daily on the Cybercrime Magazine Podcast feature victims, law enforcement, vendors, and cybersecurity experts.
- RADIO. Tune into WCYB Digital Radio at Cybercrime.Radio, the first and only round-the-clock internet radio station devoted to cybersecurity.
Contact us to send story tips, feedback and suggestions, and for sponsorship opportunities and custom media productions.

The post AI-Assisted Cybersecurity Leadership Services For Small And Mid-Sized Businesses (SMBs) appeared first on Cybercrime Magazine.
¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Shai-Hulud Worm Steals Dev Secrets Across npm, GitHub, AWS & Kubernetes

·

AWS, cyber security, Cyber Security News, GitHub

Shai-Hulud is a major cybersecurity threat targeting the open-source software supply chain. Security researchers are raising alarms over “Shai-Hulud,” a self-propagating npm worm designed to steal sensitive developer credentials from GitHub, AWS, Kubernetes, and local environments. The campaign, tracked by SlowMist’s MistEye threat intelligence platform, is already being described as one of the largest npm […]

The post Shai-Hulud Worm Steals Dev Secrets Across npm, GitHub, AWS & Kubernetes appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Google Project Zero Details Pixel 10 Zero-Click Exploit Chain

·

cyber security, Cyber Security News, Google, Mobile Attacks, vulnerability

A powerful zero-click exploit chain for the Pixel 10 that can take an attacker from a remote Dolby decoding bug to full kernel control through a single vulnerable video processing driver. The work shows both how quickly Google can now patch critical issues and how shallow mistakes in vendor drivers can still undermine Android’s security […]

The post Google Project Zero Details Pixel 10 Zero-Click Exploit Chain appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Hackers Exploit OAuth Device Flow to Steal Microsoft 365 Tokens

·

cyber security, Cyber Security News, Microsoft

Hackers are rapidly weaponizing a little-known Microsoft authentication feature to hijack enterprise accounts, as device code phishing surges across the threat landscape. The spike in activity is closely tied to the public release of criminal toolkits and phishing-as-a-service (PhaaS) platforms, making the once obscure technique widely accessible. New kits are appearing almost weekly, many seemingly […]

The post Hackers Exploit OAuth Device Flow to Steal Microsoft 365 Tokens appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
PraisonAI Vulnerability Actively Exploited Within Hours of Being Made Public

·

CVE/vulnerability, cyber security, Cyber Security News, vulnerability

A high-severity vulnerability in PraisonAI is drawing urgent attention after security researchers observed exploitation attempts within hours of public disclosure. The flaw, tracked as CVE-2026-44338 and documented in the GitHub advisory GHSA-6rmh-7xcm-cpxj, exposes a critical authentication bypass in the platform’s legacy API server, potentially allowing attackers to execute AI workflows without credentials. PraisonAI Vulnerability The […]

The post PraisonAI Vulnerability Actively Exploited Within Hours of Being Made Public appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
What 45 Days of Watching Your Own Tools Will Tell You About Your Real Attack Surface

·

In Your Biggest Security Risk Isn’t Malware — It’s What You Already Trust, we made a simple argument: the most dangerous activity inside most organizations no longer looks like an attack. It looks like administration. PowerShell, WMIC, netsh, Certutil, MSBuild — the same trusted utilities your IT team uses every day are also the preferred toolkit of modern threat actors. Bitdefender’s analysis

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
TanStack Supply Chain Attack Hits Two OpenAI Employee Devices, Forces macOS Updates

·

OpenAI has disclosed that two of its employee devices in its corporate environment were impacted via the Mini Shai-Hulud supply chain attack on TanStack, but noted that no user data, production systems, or intellectual property were compromised or modified in an unauthorized manner. “Upon identification of the malicious activity, we worked quickly to investigate, contain, and take steps to

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
OrBit Rootkit Targets Linux to Steal SSH and Sudo Credentials

·

cyber security, Cyber Security News, Linux

Hackers are continuing to abuse a stealthy Linux rootkit known as OrBit to harvest SSH and sudo credentials, with new research showing the threat has quietly evolved over four years while remaining active in the wild. First analyzed in 2022, OrBit was initially believed to be a custom-built Linux userland rootkit. It operates by hijacking […]

The post OrBit Rootkit Targets Linux to Steal SSH and Sudo Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
CalPhishing Scam Uses EvilTokens Kit, Outlook Invites to Steal M365 Sessions

·

CalPhishing, Cyber Attack, Cyber Crime, cybersecurity, EvilTokens, Fortra, M365, Outlook, Outlook Invite, Phishing, Phishing Scam, Scams and Fraud, Security

Hackers are exploiting Outlook calendar invites and device code phishing to steal M365 session tokens, bypass MFA and breach enterprise accounts.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Microsoft Warns HPE Operations Agent Abused in Malware-Free Attacks

·

cyber security, Cyber Security News, Malware, Microsoft

Microsoft has revealed a stealthy intrusion campaign where attackers bypassed traditional malware and exploits, instead abusing trusted enterprise tools to silently infiltrate networks. The technique highlights a growing shift in cyberattacks where adversaries rely on legitimate software and existing trust relationships to evade detection. Notably, no vulnerability in HPE OA was exploited. Instead, threat actors […]

The post Microsoft Warns HPE Operations Agent Abused in Malware-Free Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

This week in cybersecurity from the editors at Cybercrime Magazine