CyberSecurity Updates

Sharpening the Focus on Product Requirements and Cybersecurity Risks: Updating Foundational Activities for IoT Product Manufacturers

Over the past few months, NIST has been revising and updating Foundational Activities for IoT Product Manufacturers (NIST IR 8259 Revision 1 Initial Public Draft), which describes recommended pre-market and post-market activities for manufacturers to develop products that meet their customers’ cybersecurity needs and expectations. Thank you so much for the thoughtful comments and feedback throughout this process; 400+ participants across industry, consumer organizations, academia, federal agencies, and researchers shared feedback in both the December…

Read More

The Cybersecurity Information Sharing Act Faces Expiration

The Cybersecurity Information Sharing Act (CISA) is designed to provide encouragement and protection for and while sharing threat information. A sunset clause built into the Cybersecurity Information Sharing Act 2015 (PDF) means it will expire at the end of September 2025 unless reauthorized by the US Congress. At the time of writing, it has not been reauthorized. “If you find something in your software that shouldn’t be there, and there’s some indication that it is…

Read More

CISA Strengthens Commitment to SLTT Governments

The Cybersecurity and Infrastructure Security Agency (CISA) announced that it has transitioned to a new model to better equip state, local, tribal, and territorial (SLTT) governments to strengthen shared responsibility nationwide. CISA is supporting our SLTT partners with access to grant funding, no-cost tools, and cybersecurity expertise to be resilient and lead at the local level.  CISA’s cooperative agreement with the Center for Internet Security (CIS) will reach its planned end on September 30, 2025.…

Read More

CISA and UK NCSC Release Joint Guidance for Securing OT Systems

CISA, in collaboration with the Federal Bureau of Investigation, the United Kingdom’s National Cyber Security Centre, and other international partners has released new joint cybersecurity guidance: Creating and Maintaining a Definitive View of Your Operational Technology (OT) Architecture. Building on the recent Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators, this guidance explains how organizations can leverage data sources, such as asset inventories and manufacturer-provided resources like software bill of materials to establish…

Read More

British Department Store Harrods Warns Customers That Some Personal Details Taken in Data Breach

Harrods, the luxury British department store, has warned some customers that their personal data may have been taken in a breach of its online systems. The company said late Friday that some names and contact details of its online customers were taken after one of its third-party provider systems was compromised. “We have informed affected customers that the impacted personal data is limited to basic personal identifiers including name and contact details, but does not…

Read More

In Other News: LockBit 5.0, Department of War Cybersecurity Framework, OnePlus Vulnerability

SecurityWeek’s cybersecurity news roundup provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape. Each week, we curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports.  Here are this…

Read More

Interpol Says 260 Suspects in Online Romance Scams Have Been Arrested in Africa

A crackdown on cybercrime coordinated by Interpol has led to the arrests across 14 African countries of 260 people suspected in online romance and extortion scams, the organization announced Friday. The operation took place in July and August and focused on scams in which perpetrators build online romantic relationships to extract money from targets or blackmail them with explicit images, Interpol said. Altogether the scams targeted more than 1,400 victims who lost nearly $2.8 million,…

Read More

Salesforce AI Hack Enabled CRM Data Theft

Prompt injection and an expired domain could have been used to target Salesforce’s Agentforce platform for data theft. The attack method, dubbed ForcedLeak, was discovered by researchers at Noma Security, a company that recently raised $100 million for its AI agent security platform. Salesforce Agentforce enables businesses to build and deploy autonomous AI agents across functions such as sales, marketing, and commerce. These agents act independently to complete multi-step tasks without constant human intervention. The…

Read More

CISA Directs Federal Agencies to Identify and Mitigate Potential Compromise of Cisco Devices

Today, CISA issued Emergency Directive ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices to address vulnerabilities in Cisco Adaptive Security Appliances (ASA) and Cisco Firepower devices. CISA has added vulnerabilities CVE-2025-20333 and CVE-2025-20362 to the Known Exploited Vulnerabilities Catalog.  The Emergency Directive requires federal agencies to identify, analyze, and mitigate potential compromises immediately. Agencies must: Identify all instances of Cisco ASA and Cisco Firepower devices in operation (all versions). Collect and transmit memory…

Read More

Hackers Target Casino Operator Boyd Gaming

Casino entertainment company Boyd Gaming has disclosed a data breach after hackers gained access to its internal IT systems.  Boyd Gaming said in a filing with the SEC that the cybersecurity incident has not impacted its properties and business operations.  The Las Vegas-based company is conducting an investigation with assistance from outside cybersecurity experts and law enforcement.  The probe has shown that the hackers stole some data from its systems, including employee information and the…

Read More