Quote for the day:
“An investment in knowledge pays the best interest.” -- Benjamin Franklin
🎧 Listen to the audio debrief on YouTube
▶ Play Audio DigestDuration: 24 mins • Perfect for listening on the go.
Brevo supply-chain attack injected ClickFix scripts on customer sites
Brevo, a popular digital marketing and customer management platform, recently
experienced a security breach affecting its website and tools embedded on
customer sites. On September 14, attackers used a compromised Cloudflare API
key, which had been mistakenly left inside the company's application code, to
alter the platform's web traffic. For about five and a half hours, the
attackers injected malicious scripts into Brevo's web forms and chat tools.
When visitors loaded a website using these tools, they saw a fake verification
screen urging them to run a harmful command, a technique known as a ClickFix
attack. Additionally, if the visitor was logged into a WordPress site as an
administrator, the script secretly attempted to install a hidden backdoor
plugin called Web Media Optimizer. Security researchers estimate this incident
may have affected up to one hundred thousand websites. Once Brevo identified
the issue, the company quickly removed the unauthorized access, deleted the
harmful files, and confirmed that core systems like email delivery and
customer data remained secure. Website administrators who were logged in
during the attack window are advised to carefully check their plugin lists for
any unauthorized additions and update their passwords to ensure their systems
remain completely safe.Abandoned IoT apps keep sending sensitive data to broken servers
A recent study by the University of Massachusetts Amherst highlights the significant security risks posed by abandoned Internet of Things (IoT) companion apps. These apps, used to control smart devices like thermostats and cameras, often remain on users' phones long after developers stop updating them. The researchers analyzed over 61,500 abandoned Android IoT apps and found that a staggering number contained software dependencies linked to known vulnerabilities. Many of these apps were still being downloaded by millions of users, despite not receiving an update in over two years. Furthermore, these apps often bundle old software libraries and hard-coded web addresses, many of which no longer function or belong to entirely different owners. This creates a dangerous scenario where sensitive data, gathered through permissions like camera and location access, is sent to broken or potentially malicious endpoints. While the study found similar rates of known vulnerabilities in both abandoned and actively maintained apps, the real issue lies in the destination of the data. Over 40% of the data sinks in abandoned apps were associated with unreachable or vulnerable endpoints, compared to less than 1% in active apps. This research underscores the need for users to regularly review and uninstall abandoned IoT apps to minimize their security exposure.Is your low code security keeping up with business speed?
Low code development platforms have transformed how organizations build
applications, often leading to a misconception that they are as unstructured
as vibe coding — the practice of relying entirely on artificial intelligence
to generate software from casual prompts. However, while low code environments
provide more structure and included guardrails than AI generated code, they
still present significant security challenges that teams cannot ignore.
Because these platforms empower everyday users to assemble functional
applications quickly using visual interfaces, they introduce risks related to
improper data handling, misconfigured permissions, and poor access controls.
Included security features within low code platforms offer a baseline of
protection, ensuring that development is not merely a chaotic environment, but
they are not a complete safety net. To maintain a secure environment, IT
departments must establish clear governance policies and conduct regular
audits of user created applications. Without proper oversight, everyday
builders might unintentionally expose sensitive company information or create
software vulnerabilities that external attackers could exploit. Ultimately,
organizations must strike a careful balance between enabling rapid, accessible
software creation and maintaining strict security standards across the board.
Relying solely on a platform's default protections is a risky approach;
continuous monitoring and proactive management remain essential to keeping
your business data truly safe.
Prioritise on the best governance, not the best model
The article from FutureCISO highlights that by mid-2026, the deployment of AI agents in Asia Pacific enterprises has significantly outpaced governance capabilities. Research shows that active AI agents have nearly tripled in a year, while the time to create them has halved. Gartner predicts that 40% of enterprise applications will feature embedded task-specific AI agents by the end of 2026. However, this rapid adoption has led to a rise in "shadow AI," with security incidents doubling year over year, according to IBM. The core issue is a lack of visibility; many organizations do not know what AI agents they have deployed. Lavy Stokhamer from Standard Chartered emphasizes that organizations need the same accountability and visibility for AI agents as they do for human employees, applications, and privileged accounts. A real-time inventory is crucial to understanding what each agent is authorized to do, the data it can access, and who is accountable. This comprehensive inventory of agent identities and permissions is fundamentally the "organizational chart for a digital workforce." Without knowing what digital actors exist and their authority, it is impossible to govern, secure, or manage risk at scale, leading to significant challenges in trust, resilience, and economics.Malicious JavaScript Evaded VirusTotal in Seven of Eight E-Commerce Storefront Attacks
A recent cybersecurity investigation has revealed that traditional malware
scanners are struggling to detect sophisticated e-commerce storefront attacks.
Security researchers identified four distinct malicious JavaScript operations
actively targeting online retailers. Across these campaigns, they found eight
unique payloads designed to run quietly in a shopper's browser. Remarkably,
when these payloads were tested against standard security tools, seven of the
eight completely evaded detection by VirusTotal, and none were flagged as
malicious by URLScan. These attacks succeed because they do not break the
website. A modern storefront can look and function perfectly normally while
the hidden script secretly siphons affiliate revenue, hijacks clicks,
manipulates analytics, or opens a backdoor for remote access. To avoid
detection, the malicious code uses clever evasion tactics, such as waiting for
specific mobile devices, operating only during certain hours, or staying
dormant until particular product buttons load on the page. Because these
scripts only execute under exact conditions, traditional signature-based
scanners often miss them during routine checks. This incident underscores a
critical shift in e-commerce security. Relying solely on standard vendor trust
or basic scans is no longer enough. Protecting online storefronts now requires
advanced, behavior-based monitoring to catch these elusive threats in live
traffic.
Rethinking Disaster Recovery Planning Using Optimized Sequencing
This article from Disaster Recovery Journal focuses on how organizations can improve their IT disaster recovery plans by optimizing their recovery sequences. When a widespread system outage occurs, simply restoring applications one by one based on a static list isn't always effective. Systems rely on each other—for example, an essential business app might need its database and identity services to be brought back online first. The author argues that companies need to look at multiple factors when deciding what to restore first. These include technical dependencies, recovery time objectives, and the potential impact on revenue and critical services. Because tech environments are always changing, with new applications and integrations being added, a fixed recovery sequence can quickly become outdated. To handle this, organizations can adopt recovery optimization. This approach uses existing data on dependencies and business priorities to compute the best recovery sequence for a specific situation. It allows teams to adjust their strategy based on current needs, whether that means prioritizing strict recovery timelines or protecting revenue. Ultimately, using an explainable, data-driven method helps teams make better decisions during a crisis and improves the value of their disaster recovery exercises.Zombie Workloads Haunt Data Center Efficiency Efforts
Zombie workloads, such as unused applications or abandoned storage volumes,
are creating notable challenges in data center efficiency. According to recent
findings from the International Data Center Authority, up to 13% of US cloud
usage is attributed to these idle workloads. The issue stems from scenarios
like incomplete post-merger integrations and employees leaving apps active.
The problem is becoming more critical with the rise of AI and GPUs, as the
cost of idle time rises steeply compared to traditional CPU workloads. To
address this, organizations are relying on Cloud FinOps tools and
observability tools that find inactive resources. While features like
scale-to-zero in serverless architectures offer some relief, they bring
challenges like cold starts. The complexities of AI workloads also make
hunting for zombies difficult, because they introduce issues like abandoned
GPUs and mid-flight pipeline crashes. Effective management is built upon
having sound policies. Clear guidelines, automated reminders, and routine
scans are important in curbing zombie workloads. The cost of failing to
decommission these idle assets has severe implications.
A Framework for Taming Unstructured Data at Scale
The provided article from CDO Magazine discusses the critical need for a framework to manage unstructured data, which constitutes 80% to 90% of corporate information. This "dark matter" includes emails, PDFs, and Teams messages, often lacking visibility and posing significant risks. The author, Lana DeMaria, highlights two main drivers for this urgency: the rise of "shadow AI," where employees might unknowingly feed sensitive data into public models, and the evolution of ransomware into "double extortion" tactics that target valuable unstructured data. Traditional governance methods, such as manual classification and reliance on regular expressions, fail because they are not scalable and treat governance as a one-time event rather than a continuous process. To address these challenges, the article proposes a cyclical, automated framework centered on three layers: Discovery (indexing data in place), Classification (using AI for semantic analysis), and Continuous Compliance (automating lifecycle management, including defensible deletion). By leveraging AI, organizations can better understand their data, manage risks, and ensure that governance scales effectively. Ultimately, implementing this framework allows leaders to turn unstructured data from a liability into a strategic asset for the enterprise.The Standard BI Playbook Wasn't Built for the Physical Economy
The standard business intelligence approach often fails when applied to the
physical economy, which includes industrial distribution, manufacturing, and
marine transportation. These sectors do not suffer from a lack of information
but rather struggle with making that information accessible across the
organization. Traditional advice assumes data is already organized in a
central location, but industrial companies typically rely on fragmented legacy
systems, isolated applications, and numerous manual spreadsheets. To make any
meaningful progress, companies must first do the practical work of gathering
this scattered data into one unified platform. Furthermore, the typical
strategy assumes teams are eager for new reports and have dedicated analysts
ready to use them. In reality, operational teams are deep domain experts who
are often overwhelmed by manual reporting tasks and naturally skeptical of new
tools. They need immediate, reliable answers to handle their daily operations,
not long-term analytical deep dives. Success in this environment should not be
measured by how many reports are created, but by how many hours of manual work
are eliminated. By focusing on centralizing information, sharing knowledge
across departments, and automating tedious processes, industrial organizations
can give employees their time back and significantly improve how they operate
on a daily basis.
No comments:
Post a Comment