Kirsten Doyle
Verified
Consulting editor at ITWeb. Special interest, cyber security.
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Kirsten Doyle
Best vulnerability scanning tools for compliance 2026
Compliance frameworks do not all ask security teams to test their systems in the same way. PCI (News - Alert) DSS separates vulnerability scanning from penetration testing. DORA requires digital operational resilience testing and, for certain financial entities, Threat-Led Penetration Testing (TLPT). NIS2 requires organizations to assess the effectiveness of their cybersecurity measures, while ISO 27001 expects technical vulnerabilities to be identified, evaluated, and addressed.
From Vulnerability Management to Exposure Management: A Practitioner’s Roadmap
A good vulnerability management (VM) program can tell you which software vulnerabilities need attention and help get them fixed. As environments have expanded across cloud, identity, operational technology (OT), applications, and other systems, VM teams have gained access to much more information that can affect those decisions. Technical severity does not always reflect the risk a vulnerability presents in a particular environment.
SIEM needs exposure context to keep pace with AI-era threats
Security information and event management (SIEM) platforms give security operations center (SOC) teams a central place to collect and analyze security telemetry, detect suspicious activity, and investigate potential threats. That job is getting harder as artificial intelligence (AI) changes the speed of vulnerability research.
Rogue AI agents put trusted access under scrutiny
Two newly disclosed incidents involving rogue AI agents are raising questions about what happens when autonomous software operates through apparently legitimate access. In both cases, agents were able to use valid accounts or credentials and continue searching for ways into systems and data beyond the access they had been given. OpenAI this week disclosed more details from its continuing review of the Hugging Face incident and other unexpected activity by its models.
Texas utility CenterPoint confirms breach after attacker leaks customer data
Texas utility CenterPoint Energy has confirmed a data breach after a threat actor published customer information online and claimed to have stolen around 7.5 million records. CenterPoint said an unsanctioned third party accessed personal information through one of its external-facing systems. The company has brought in cybersecurity experts to investigate the breach.
AI SOC vs. SOAR: Augmentation or Replacement?
Security operations teams have been trying to solve the same problem for years. Alert volumes keep rising, but headcount cannot keep pace. SOAR was one answer, but AI SOC is now competing for many of the same budgets. For SOC leaders approaching a SOAR renewal or weighing another investment in automation, the question is how much of the work currently handled by SOAR still needs to be handled that way. This is already playing out in the market.
Prophet Security research finds AI is cutting SOC investigation times, but nearly half of in-house builds fail to stick
Security teams are turning to AI as they struggle to investigate the volume of alerts coming into the SOC, according to new research from Prophet Security. The State of AI in Security Operations 2026 report surveyed 250 IT and cybersecurity professionals. Forty percent said AI is already part of their day-to-day SOC workflow, and 56% are evaluating or piloting it. Only 4% have no current plans to use AI. Among teams already using AI, 72% said it had cut alert investigation time by at least 25%.
A reverse image search platform exposed more than 9 million facial images
AI Summary Basic summary A publicly accessible database linked to reverse image search service ClarityCheck exposed more than nine million images, including photographs of adults, teenagers, and children. Cybersecurity researcher Jeremiah Fowler discovered the database, which was neither password-protected nor encrypted. It contained approximately 9,042,977 image files, amounting to 450.2GB of data.
Post-DEF CON phishing campaign delivered AMOS and NetSupport malware
AI Summary Basic summary A phishing campaign targeting attendees of Black Hat and DEF CON conferences involved distributing information-stealing malware and remote access malware via a malicious Google Doc and fake DocSend installers for macOS and Windows. The Huntress team learned about the phishing attack after one of its researchers received a direct message on X on August 9.
AI agents taking unsanctioned action during cyber testing
The UK’s AI Security Institute (AISI) has disclosed a security incident in which frontier AI agents took unsanctioned actions against real people and organisations during a controlled cybersecurity evaluation. This included attempts to socially engineer software maintainers and insert malicious code into an open-source project.
Who Owns the Risk When Your AI SOC Gets It Wrong?
The biggest unanswered question in agentic SOC deployments is who owns the decisions AI makes when they turn out to be wrong. Picture the call every CISO hopes never to receive. At 2:07 a.m., an AI agent identifies what it believes is malicious lateral movement. It isolates a production server, revokes privileged credentials, and closes the investigation because the threat has been contained. By sunrise, the security team has worked out what happened. It was scheduled maintenance. The AI was wrong.
Is an AI SOC Better Than MDR? What Security Teams Should Weigh
Security teams are expected to investigate more alerts than they have people to handle. IBM's 2025 Cost of a Data Breach Report puts a number on what that gap costs: organizations take an average of 158 days to identify a breach, and a further 83 days to contain it. That is 241 days of exposure, the fastest pace in nine years, and still measured in months. For most SOC teams, the bottleneck was never finding threats. It was having enough people to do anything about them.
Expert panel: AI is writing the code. Who is defending it?
AI is changing the way software is being developed. From generating code, helping developers make sense of new frameworks, reviewing pull requests, and even suggesting solutions for existing vulnerabilities, AI is playing an increasingly active role in the software development process. There is an upside here, too. AI is speeding up development, eliminating redundant efforts, and helping organisations fix problems faster.
One-click Claude Desktop flaw could enable hidden prompt injection and code execution
AI Summary Basic summary Security researchers at Oasis Security have disclosed a vulnerability in Claude Desktop that could allow attackers to execute hidden prompts, access local files, exfiltrate conversation history, or execute code with a single click on a malicious link. The vulnerability, dubbed PromptFiction, affects the way Claude Desktop handled claude:// links.
Russian state attackers exploiting misconfigured routers, new multi-nation advisory warns
Russian state-sponsored actors are compromising poorly secured routers and networking devices around the world, with critical infrastructure organisations among the primary targets, reveals a new joint cybersecurity advisory from 20 government agencies.
Americans are ignoring scam calls, but phishing emails still fool many
AI Summary Basic summary Americans are becoming more effective at avoiding spam calls and texts, but new research suggests that the strategy comes with an unexpected cost. A new survey of 1,000 Americans from privacy company Cloaked, revealed that two-thirds of respondents have missed an important phone call because they ignored an unknown number.
AI-assisted software engineering is creating a new delivery paradox
AI can generate code faster than most software organizations can absorb it. This should be a productivity breakthrough, but it also exposes a larger problem: many of the processes surrounding software delivery still happen at human speed. A new white paper from code4thought looks at what happens when AI changes how quickly teams write software, and what software engineering produces, how organizations govern it, and where engineers add the most value.
Sysdig uncovers first documented agentic ransomware operation
Security researchers at Sysdig have documented what they believe is the first documented case of an AI agent running a ransomware operation from end to end. Dubbed JADEPUFFER, the operation used a large language model (LLM) to automate an attack that began with the exploitation of an internet-facing Langflow instance and ended in destructive database extortion.
Klue supply chain breach exposes Salesforce data at several security firms
AI Summary Basic summary A supply chain attack targeting Klue, a competitive intelligence platform, has lead to the theft of Salesforce data from multiple entities, including several cybersecurity vendors. Klue disclosed that threat actors had gained unauthorized access to part of its integration infrastructure in June after compromising a legacy credential linked to a backend system.
ShinyHunters targets Oracle PeopleSoft customers through critical zero-day
AI Summary Basic summary Oracle has issued a security alert to customers about a critical vulnerability affecting PeopleSoft environments after the notorious threat actor ShinyHunters claimed it used a previously unknown flaw to compromise over 100 entities. The vulnerability CVE-2026-35273 is in Oracle PeopleSoft PeopleTools, and has a CVSS score of 9.8/10. “Oracle PeopleSoft Enterprise Applications customers may also be affected by this vulnerability.
AI-Powered Attacks Become Top Concern for Security Professionals, New Filigran Survey Reveals
AI Summary Basic summary AI-powered attacks are the biggest cybersecurity concern among security professionals. Forty-one percent identified AI-powered attacks at scale as their biggest security concern, nearly double the number citing supply chain risk (21%) or unknown threats (21%). AI-driven threats and what security professionals are doing about them is also the top concern for nearly one in three boards (32%).
What makes a cybersecurity AI partnership worth paying attention to? Original
Most cybersecurity AI partnerships are announcements, not integrations. Almost every major vendor now claims some connection to a large language model provider, an AI startup, or a foundation model developer. The majority of these announcements change nothing. While they make for interesting news and discussions at conferences and even create marketing campaigns, they usually have no effect on how security operations teams go about doing their job.
Detection Engineering Isn’t About Coverage, It’s About Making Trade-offs Explicit
Exponential Interactive, Inc d/b/a VDX.tv Cookie duration: 90 (days). Data collected and processed: IP addresses, Device identifiers, Probabilistic identifiers, Browsing and interaction data, Non-precise location data, Users’ profiles, Privacy choices more Cookie duration resets each session. View details | Storage details | Privacy policy Consent Cookie duration: 365 (days).
SIG report: AI-generated code is linked to twice the security risk and rising technical debt
AI Summary Basic summary AI-supported coding has progressed from experimental to the norm in organizations, yet technical debt, security risks, and costs could be piling up much faster than anyone realizes. This is one of the key takeaways from the Software Improvement Group (SIG) 2026 State of Software report, which analyzed more than 30,000 software systems and more than 400 billion lines of code.
Miasma worm spreads from Red Hat packages to Microsoft repositories
A rapidly developing software supply chain attack known as Miasma is one of the latest to move from targeting Red Hat npm packages to infecting numerous Microsoft GitHub repositories. Cloudsmith researchers described the Miasma attack, noting it began after the compromise of the GitHub account of a Red Hat employee, which enabled attackers to use the GitHub OIDC token to deploy malicious packages in the @redhat-cloud-services namespace.
Dutch police, NCSC take down major botnet
A collaboration between the Dutch National Police and the National Cyber Security Centre (NCSC), has seen a large botnet being shut down. In this operation, 200 servers were identified and addressed as well. These servers controlled millions of infected devices, from computers to phones, and were used to carry out cyberattacks. A security researcher first identified the network and notified the NCSC. The NCSC then alerted the police, and together they dug into the matter.
Palo Alto warns of active exploitation of GlobalProtect authentication bypass flaw
Palo Alto Networks has alerted customers about the ongoing exploitation of the authentication bypass vulnerability in PAN-OS GlobalProtect. The vulnerability, tracked as CVE-2026-0257, lets unauthenticated actors bypass security measures and set up unsanctioned connections to vulnerable GlobalProtect portals and gateways. A high CVSS score of 7.8 was assigned for this vulnerability.
CrowdStrike, Google, and Shadowserver Foundation disrupt Glassworm botnet
CrowdStrike has shared details of a coordinated operation used to disable the Glassworm botnet, which targets software developers and leverages open-source ecosystems to deploy malware. The CrowdStrike Counter Adversary Operations team, in partnership with Google and the Shadowserver Foundation, took down all four C2 centers of the Glassworm network on 26 May by disrupting all lines of communication between Glassworm’s controllers and infected systems.
Threat Actors Deploy Tiflux RMM for Persistent Remote Access
Threat actors are abusing legitimate RMM tools as a means of creating persistence inside victims’ systems, using the Tiflux RMM tool. Tiflux is a reputable Brazilian software platform used by IT departments and Managed Service Providers (MSPs) for managing IT assets, tickets, teams, and remote monitoring. As reported by Huntress, the campaign is using Tiflux RMM as part of phishing attacks that deploy fake documents followed by remote access tools like Splashtop, UltraVNC, and ScreenConnect.
Major US telecom providers debut C2 ISAC to counter AI-driven threats
Eight of the leading communications companies in the United States have created a new cybersecurity alliance that aims to improve threat intelligence sharing within the telecommunications industry, amid growing concerns about AI cyberattacks, state-sponsored espionage, and infrastructure attacks.
Expert panel: Passwordless security and the new identity battleground
For years, passwords were the only thing that mattered for securing our online presence, but the discussion around authentication is evolving rapidly. Passkeys, biometrics, device trust, and adaptive identity management solutions are often cited as the key to the next level of security, while attackers are focusing on directly targeting our identity infrastructure.
Verizon DBIR 2026: What the experts are saying
According to the 2026 Verizon Data Breach Investigations Report, the threat environment is transforming in terms of speed, scale, and interconnected risk. For the first time in its history, vulnerability exploitation was identified as the top initial access vector, representing 31% of attacks, and the report found that ransomware, third-party attacks, and misuse of AI are all on the rise, both for attack purposes and within organizations.
Exploited Faster, Patched Slower: Verizon DBIR 2026 Shows Security Teams Losing Ground
The Verizon 2026 Data Breach Investigations Report (DBIR) reveals a threat environment moving much faster than many organizations can reasonably protect themselves against. Based on information collected from more than 31,000 security incidents and over 22,000 confirmed data breaches spanning 145 different countries, the DBIR reveals a changing face to how attackers get in, how fast vulnerabilities are exploited, and the role of AI in both attack and defense.
NCSC warns organisations not to rush into agentic AI
UK’s National Cyber Security Centre (NCSC) has advised businesses to proceed with caution when considering the implementation of agent-based AI, suggesting that agentic AI represents an entirely different kind of security problem compared to generative AI.
7-Eleven Notifies Franchise Applicants After Breach Exposes Personal Data
A security breach notification process has been initiated by 7-Eleven as a result of a security incident where an outside party was able to gain access to their systems containing franchisers’ information. According to a breach notification filed with the state of Maine, the company discovered that threat actors accessed some of its internal systems on 8 April 2026.
Microsoft discloses Exchange zero-day with no patch yet available
Microsoft has disclosed a zero-day vulnerability that affects Exchange Server 2016, 2019, and Subscription Edition. This vulnerability would give bad actors an opportunity to run arbitrary code remotely on the Exchange server. Although Microsoft has not issued any patches for this security vulnerability, they suggested two possible mitigations until a solution becomes available.
OpenAI rotates certificates after TanStack supply chain attack hits employee devices
OpenAI has confirmed that two employee devices were compromised in the recent TanStack npm supply chain attack, prompting the company to rotate code-signing certificates and require macOS users to update their applications by 12 June. In a security advisory published this week, the company said it found no evidence that customer data, production systems, or intellectual property were accessed or altered during the incident.
Cyberattack on West Pharmaceutical halts manufacturing across multiple sites
West Pharmaceutical Services has disclosed a ransomware attack that disrupted manufacturing, shipping, and receiving operations across multiple global facilities after bad actors breached the company’s network on 4 May. The pharmaceutical packaging manufacturer said attackers exfiltrated data and encrypted systems, forcing the company to proactively shut down portions of its infrastructure to contain the incident. “We continue to make good progress in the restoration of our systems.
Tenable warns AI adoption is outpacing governance as cloud exposure risks surge
A new report from Tenable is warning that organizations are creating what it describes as a growing “AI exposure gap,” as enterprises race to deploy AI tools and cloud-native services faster than security and governance teams can keep up. The “Cloud and AI Security Risk Report 2026” examined telemetry data gathered from public cloud and enterprise ecosystems from April to October 2025, while the AI-related data was taken until December 2025.
Foxconn confirms cyberattack following Nitrogen ransomware claims
Foxconn has confirmed that several of its North American factories were hit by a cyberattack, after the Nitrogen ransomware group claimed to have stolen 8TB of data comprising more than 11 million files. According to the bad actor, the information supposedly obtained contains private directives, project details, technical drawings, and related project documents that pertain to companies such as Intel, Apple, Google, Dell, and Nvidia. These claims have not been independently verified yet.
Microsoft patches 138 vulnerabilities as AI-driven discovery accelerates
Microsoft is poised to set a new record for yearly patching by having released patches for over 130 vulnerabilities as part of its May Patch Tuesday release, pushing Microsoft’s total number of patched vulnerabilities to over 500 in just five months in 2026. Researchers at Microsoft and other organizations said that AI-enabled vulnerability discovery systems have greatly accelerated and amplified the process of discovering security flaws.
Canvas cyberattack disrupts universities as ShinyHunters threatens massive data leak
An attack on the popular Instructure Canvas learning management system has caused major disruptions for schools and universities in the US, just as students gear up for finals. This poses a serious threat to the personal data of millions of students and teachers. Multiple institutions reported outages affecting the web-based Canvas platform on Thursday, with users encountering ransom messages posted directly to school Canvas homepages.
Zara Owner Inditex Confirms Customer Data Breach Affecting Nearly 200,000 People
Fashion retailer Inditex, the parent company of Zara, has confirmed unauthorized access to customer transaction databases hosted by a third-party provider. Data breach notification service Have I Been Pwned said approximately 197,400 unique email addresses were included in the leaked dataset. The company said it had launched security protocols and notified the relevant authorities following the incident, Reuters reports.
Online Safety Act failing to deliver “step change” for children, report warns
A new report published by Internet Matters, reveals that the Online Safety Act (OSA) in the UK, although bringing visibility of online safety tools, does not seem to be living up to expectations of providing the much-needed “meaningful protection from harm.” In their report titled The Online Safety Act: Are Children Safer Online?, Internet Matters has highlighted a dual image of success and continued vulnerability.
Trelix admits breach on a ‘portion’ of its source code repository
Trellix has disclosed unauthorized access to a portion of its source code repository. However, it did not specify which portion of its source code was accessed, nor did it provide many further details about the incident. “Upon learning of this matter, we immediately began working with leading forensic experts to resolve it. We have also notified law enforcement,” the company said in a statement.
How Entitlement Management Protects Medical Device Vendors from the Inside Out
At a Glance Many hospitals can't identify which software versions are running on their systems. Entitlement management tracks who uses what software, where, and for how long. Hospitals now evaluate vendors on software governance, not just clinical performance. A hospital has been running an AI-powered diagnostic tool for 18 months. Clinicians rely on it daily to support diagnoses and guide treatment decisions.
US weighs slashing vulnerability patching deadlines as AI-driven threats accelerate
There are discussions in US cybersecurity circles to radically shorten the time given to government agencies to fix software vulnerabilities currently being exploited, especially amid concerns about the growing use of artificial intelligence-based attacks. According to a report by Reuters, there are talks of reducing the time frame from the current two or three weeks down to just three days, dramatically raising the pace of defensive operations across government systems.
Microsoft Edge Found Holding Saved Credentials in Plaintext Memory
Security researcher Tom Jøran Sønstebyseter Rønning, posting as @L1v1ng0ffTh3L4N, has revealed that Microsoft Edge decrypts every saved password at startup and holds all of them in process memory, in cleartext, for the entire browser session. He says this includes passwords for sites the user is visiting as well as every credential the user’s ever saved. The passwords are held in memory from the moment Edge opens.
Kirsten Doyle
Home Author Team Kirsten Doyle Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre.
Copy Fail lands in CISA KEV as actively exploited Linux flaw threatens widespread privilege escalation
The Cybersecurity and Infrastructure Security Agency (CISA) has added another Linux kernel vulnerability, CVE-2026-31431, also known as Copy Fail, to the Known Exploited Vulnerabilities (KEVs). Inclusion in the list implies active real-world attacks and increases the priority of patches.
Show More
loading
Actions
Get in touch with Kirsten
Contact Kirsten, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack