Security Bulletin

Lawmaker says bipartisan infrastructure investment is essential to modernize U.S. transportation.

Here are five steps defenders can take in the wake of the Canvas breach.

The jscrambler supply chain attack involved a malicious preinstall hook within version 8.14.0 of the npm package.

The ACSC reports that malicious actors are actively scanning websites for vulnerabilities in various CMS platforms and plugins, including WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE.

The campaign reportedly centers around a website known as "GdeBenz," which has attracted over one million visitors.

The vulnerabilities, CVE-2026-48939 affecting iCagenda and CVE-2026-56291 affecting Balbooa Forms, both allow for unrestricted file uploads.

We zoom in on key exchange and its urgent "harvest now, decrypt later" threat, where attackers record encrypted traffic today to decrypt once quantum hardware matures. Then we meet the two contenders: classical Diffie-Hellman and post-quantum ML-KEM.

A look inside Cisco’s workplace transformation and the lessons we’re learning by turning connected data into smarter decisions.

The setup