Cybersecurity

Global – November 05, 2026 -- CIQ patched every affected kernel stream, more than a dozen across three major releases, within 72 hours of the first customer report on critical Linux vulnerability CVE-2026-98432, which carries a CVSS score of 9.8. The first fixed kernels reached CIQ repositories about 45 hours after the first customer questions.

Anthropic exploit demonstration raised the vulnerability's priority

On Tuesday, October 27, Anthropic reported a working proof-of-concept exploit for the flaw. Many CVEs are patched without proof of exploitability, so a demonstrated exploit raised the priority beyond what the severity score alone indicated. The kernel's CVE Numbering Authority assigned the 9.8 score.

The bug is a use-after-free in the Linux kernel's IPv4 TCP code, triggered by IP options on incoming connections. A network-based attacker can exploit the kernel's continued use of memory it has already released.

MUNICH – – November 05, 2026 -- Industrial Defender has added internal network security monitoring (INSM) and a remediation tool called Risk Signal to its OT cybersecurity platform, targeting critical infrastructure operators in Europe, the Middle East and Africa.

The release pairs the company's endpoint visibility with network traffic monitoring. It gives OT and ICS operators one workflow from anomaly detection to prioritized remediation. The platform is aligned to IEC 62443 and NIST CSF. Industrial Defender positions it for operators working under the EU's NIS2 Directive and Saudi Arabia's NCA Operational Technology Cybersecurity Controls (OTCC).

Dusseldorf – November 05, 2026 -- Only 25.8% of German industrial companies actively and consistently demand Cyber Resilience Act (CRA) compliance from their suppliers, according to the ONEKEY IoT & OT Cybersecurity Report 2026. A further 33.3% do so only partially, and 20.8% have not yet acted. The report is based on a survey of 200 industrial companies in Germany.

The CRA makes cybersecurity a condition of EU market access for connected hardware and software. Manufacturers must assess risks from supplied software, firmware and pre-products, not only from their own code.

Suppliers lag on CRA readiness, and manufacturers lack visibility

Only 17.5% of suppliers have consistently prepared for the CRA and deliver the required information. Another 44.2% address the requirements in part, and 13.3% are barely prepared. For 25.0% of suppliers, manufacturers do not know the state of CRA preparation.

Knutsford – November 05, 2026 -- PortSwigger, the company behind Burp Suite, has made Burp AT available to enterprises. The agentic pentesting product lets security teams delegate anything from guided investigations to autonomous execution of defined tests, while Burp's tooling layer, not the AI model, enforces scope and permissions.

Burp AT gives AI agents professional pentesting tools and research-led methods

Burp AT combines specialist Burp tools, pentesting skills developed with PortSwigger Research, and application context. Agents plan their testing approach, use Burp's web security testing tools, and adapt as they learn. The tools are built to handle the malformed traffic and unusual behaviour inherent to security testing.

An orchestration layer ties the tools into a complete test, and agents follow defined pentesting methodologies. PortSwigger says this produces consistent, comparable results across every application tested.

San Francisco – September 18, 2026 -- Corelight has launched the Agent Builder Library and Natural Language Query, two tools designed to let security operations centers match the speed of AI-driven cyberattacks without losing auditability over investigation logic.

Attackers now exploit vulnerabilities in roughly five days, far outpacing patch cycles

Enterprise patching cycles typically run 60 to 150 days, but the median time to exploit has dropped to approximately five days, according to Corelight. The company warns that with emerging Mythos-class AI models, attackers may exploit vulnerabilities before defenders even know a flaw exists, making faster patching an inadequate defense on its own.

Zurich, Switzerland – September 18, 2026 -- Ontinue, a managed detection and response (MXDR) provider, has published its 2025 greenhouse gas emissions inventory, reporting a 2.5% year-over-year reduction in Scope 2 emissions to 12.59 tCO2e on a location-based basis, driven by consolidation of its global office footprint.

Total company-wide emissions rose approximately 3% versus 2024

Ontinue attributes the overall increase to two factors: higher employee business travel tied to company growth, and a planned methodology shift from spend-based to activity-based accounting for fuel and energy-related activities. The company frames the accounting change as an improvement in data precision rather than an operational setback.

New York – September 18, 2026 -- Zip Security has joined Project QuiltWorks, the CrowdStrike-led coalition defending organizations against frontier AI-driven cyber risk, extending enterprise-grade protection to small and mid-sized businesses that lack dedicated security teams.

Frontier AI models have cut attack costs while defense costs stay flat for SMBs

Frontier AI has changed the economics of cyber risk, giving attackers tools to discover software vulnerabilities that earlier reviews missed. Small and mid-sized businesses now face sophisticated threats without the resources enterprises use to counter them, according to the companies.

Atlanta and Washington – September 18, 2026 -- Global cybersecurity exposure tied to artificial intelligence could reach as much as $3 trillion, according to Michael Gargiulo, CEO of VPN.com, a company specializing in cybersecurity and domain name brand protection.

Palo Alto Networks flagged $1 trillion in cybersecurity debt

On a recent earnings call, Palo Alto Networks CEO Nikesh Arora said approximately $1 trillion in global cybersecurity infrastructure must be modernized to counter automated threats that operate instantaneously.

Los Angeles – September 18, 2026 -- IDrive has added Microsoft Entra ID Backup to its Microsoft Office 365 Backup solution, extending data protection to identity and access management systems for $10 per Entra ID seat per year with unlimited storage.

Native Microsoft recovery tools leave identity data exposed to gaps

Microsoft Entra ID functions as the central control plane for workforce identities, applications, and privileged access across organizations. IDrive states that native retention and recovery capabilities may not fully protect critical Entra ID configurations, meaning the loss or modification of users, groups, applications, roles, policies, or devices can disrupt sign-ins and force time-consuming manual reconstruction.

San Ramon, Calif. – September 18, 2026 -- SnippetSentry has entered a partnership with Knox Systems to pursue Federal Risk and Authorization Management Program (FedRAMP) Moderate Authorization, targeting federal agencies that need compliant capture of mobile messaging communications.

Federal agencies must archive mobile messages but lack purpose-built tools

Government agencies are legally required to preserve mobile communications for records retention, audits, investigations, litigation, and eDiscovery. Most existing compliance tools were designed for email and have not adapted to how federal employees now communicate via mobile apps.