DIVD Dutch Institute for Vulnerability Disclosure’s Post

All systems down... Comprimised, hacked... You may expect, as a managing director and co-founder of this organisation, I am currently freaking out. Actually, I am not. I am surrounded by some of the best experts in Incident Response, Crisis Management and IT security. Yes, it's tough, for everyone in the team. They work so many hours, while I just sit their in the crisis team asking stupid questions. And that is the way it is supposed to be: if you are a Managing Director and you are in a cyber crisis, don't start solving problems yourselves. Just keep your most valuable partners up to date, pay stuff, sign stuff and listen well. Leave all the crisis management to the experts. If you then discover you don't have them, well, then it's time to freak out.

How many UK suppliers of digitally enabled products and services to the EU market are prepared for the EU Cyber Resilience Act? The CRA reporting regime starts today. Covered entities must report actively exploited vulnerabilities and severe incidents through the Single Reporting Platform (SRP), operated by the EU Agency for Cybersecurity (ENISA) if they manufacture or supply "products with digital elements", made available on the EU market. An example of why the regulatory burden on UK industry has not changed since we left the EU. Parava Security Solutions #cyberresilienceact #cybersecurity #nationalsecurity https://lnkd.in/eF7j9kVw

Anthropic details how it's hardening security after three Claude unauthorized-access incidents Anthropic published a candid postmortem covering three incidents in which Claude models intentionally run without cyber safeguards for evaluation gained unauthorized access to real systems, including a live-internet incident flagged by the UK AI Security Institute. Its fixes are preventive rather than forensic: classifiers that flag aggressive sandbox-probing or unexpected egress and block the action before execution, plus offline-by-default sandboxes, pre-test probing and explicit scope boundaries for third-party evaluators. The hardening list includes eliminating standing access to sensitive data, enforcing outbound access control, tightening identity rigor, retiring legacy configs and closing observability gaps. This reads like the backlog of nearly every enterprise and is exactly what AI-accelerated attackers will find first. It's a useful template for any organization contracting external AI red-teaming. Read more: https://lnkd.in/daRqbAda #CyberSecurity #InfoSec #CISO #ThreatIntel

Thomson Reuters Reveals Court Case Management System Hack | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware Media/technology company Thomson Reuters has reported a cybersecurity incident involving its case management system. The incident was detected in 11 U.S. states, as well as in Canada and the U.S. Virgin Islands and involved the company’s C-Track tool, used for managing court cases, Reuters — itself a division of Thomson Reuters — reported Thursday (Sept. 3). The company confirmed for the news outlet that it had taken containment and security steps and notified affected customers....

Anthropic found a fourth AI Cybersecurity incident 💀 The company disclosed on September 9 that an early version of Claude Opus 4.6 was involved in a cybersecurity incident back in January. Affected parties have been notified. No further details. This follows July's disclosure that Claude models hacked into three companies' systems during testing, all stemming from a setup mistake that put them on the open internet. The review that found them covered 141,006 test sessions, launched after an OpenAI-powered agent compromised Hugging Face's infrastructure. Anthropic says it missed a batch of sessions the first time through, caught them in August, and that gap is where the fourth incident was hiding. METR is now investigating with broad access, including transcripts from outside the incident windows and employees cleared to share confidential information. The independent review is the part worth watching. Self-reported incident counts are only as complete as the search that produced them, and this one has already been revised once.

“I hope that cybersecurity becomes a common language across Taiwanese society and part of our daily habits for dealing with the risks of the digital age,” said digital minister https://lnkd.in/gxYKmpB3

“Report within 24 hours.” That sounds like a regulatory requirement. But from an AI Governance perspective, it is really a control design problem. Who detects the issue? Who decides whether it is reportable? Who starts the clock? Who owns the submission? Where is the evidence? The EU Cyber Resilience Act is another reminder that effective AI Governance is increasingly about connecting regulation to operational controls. Policies describe expectations. Governance makes them executable. https://lnkd.in/egwa8H67 #AIGovernance #AIControls #CyberSecurity #GRC

The controls that would have stopped many of this quarter's biggest breaches already existed. No zero day nobody saw coming, no exotic new technique. Time after time, the control that mattered was available, affordable and well documented. It simply wasn't deployed, or the version in place wasn't the one that would have held. Two numbers from the latest research make the stakes clear. Average breakout time is now 29 minutes. That's the window between an attacker's initial access and them moving laterally through your environment. Most teams are still pulling people onto the call at the 29 minute mark, and by then it's already a race you're set up to lose. And 59% of compromised accounts already had MFA enabled. Having MFA and having phishing-resistant MFA are two very different things, and attackers have worked out which one they're up against. In the latest Anomali Dispatch, our Cyber Data Analyst Barry Cheevers walks through 7 controls that could have changed the outcome of this quarter's biggest incidents. Hint: five of the seven aren't AI. The controls that would have held were mostly boring, available, and already in your stack. It's a practical read rather than a scare piece, and a useful sanity check if you're setting control priorities for next quarter. Of the 7, which do you see missing most often in the environments you work in? Read it here: https://lnkd.in/g_cseW3V #cybersecurity #threatintel #securitycontrols #Anomali

Your attacker sold access to your network in 22 seconds. You are on day 3 of 43. Google and Mandiant analysed 500,000+ hours of incident response last year. The median time between an attacker getting in and handing that access to the next crew has collapsed from over 8 hours in 2022 to 22 seconds in 2025. Automation replaced the forum negotiation. The access broker and the ransomware operator are now the same pipeline. Meanwhile, Verizon's DBIR just recorded a 19-year first: vulnerability exploitation overtook stolen credentials as the number one way in. Across 13,000 organisations, only 26% of CISA known-exploited vulnerabilities were fully remediated. Median time to fix: 43 days. So the honest math is this. The window you think you have to triage, ticket, schedule and patch does not exist. It closed while the ticket was still in the queue. You cannot out-patch 22 seconds. Nobody can. What you can control is how much is exposed before the clock starts, and whether you know which exposed thing actually matters. That is the whole reason we built Xseth. Continuous recon across your external surface, then AI triage that ranks what is genuinely reachable, so the one engineer holding this can spend day 1 on the thing that counts instead of day 43 on a list of 400. We do not exploit it for you. We tell you what an attacker would reach first, and you decide. -> xseth.com/get-access Honest question for the practitioners here: what is your real median time to patch an internet-facing critical? Not the SLA. The real one. #Cybersecurity #InfoSec #AttackSurface #ThreatIntelligence #RedTeam #SaaSSecurity #VulnerabilityManagement #Xseth

Thomson Reuters detected a cybersecurity incident involving its C-Track platform, exposing sensitive court files & personal data across multiple regions. #CyberSecurity #DataBreach https://lnkd.in/eQ6y5ePQ