In today’s cybersecurity news…
Cisco posts urgent Webex Services warning
Cisco has “released security updates to patch four critical vulnerabilities, including a fixed improper certificate validation flaw in the company’s cloud-based Webex Services platform. This also requires further customer action. The CVE-numbered vulnerability (CVE-2026-20184), was “found in the single sign-on (SSO) integration with Control Hub.” A successful exploit could have allowed unauthorized access to legitimate Cisco Webex services, the company said. Customers need to help with the fix, though. Specifically, they must upload a new SAML certificate for their identity provider (IdP) to Control Hub to avoid service interruption. The CVE numbers for this flaw and three others patched on Wednesday are available in the show notes to this episode.
Splunk issues fixes for Enterprise vulnerability
This was a high-severity flaw in Splunk Enterprise and Cloud Platform, (CVE-2026-20204) which could have led to remote code execution for low-privileged users. Splunk explained that the bug existed because temporary files are improperly handled and are not sufficiently isolated in its temporary directory. The company also addressed two medium-severity issues on the same platform. Customers are of course advised to ensure they have applied updates.
Git identity spoof tricks Claude into approving bad code
According to a blog published this week from Manifold Security, Anthropic’s Claude can “be tricked into approving malicious code with just two Git commands by spoofing a trusted developer’s identity.” By setting a fake author name and email in Git, the research team “made a commit appear to originate from a trusted source, then passed it through an automated review flow where the model approved it.” In this instance, the researchers say, “this is not a Git vulnerability…the problem arises when that metadata is treated as a signal of trust. In this case, the model appeared to give weight to the author’s claimed identity rather than independently assessing whether the change itself was sound.”
Big tech companies fail to opt-out users who request it
Researchers from privacy organization webXray showed that “several large tech firms are putting ad cookies in user browsers even if they have declined to be tracked,” which contravenes California law. After studying California web traffic in March, the company found that “194 online advertising services ignore legally defined, globally standard, opt-out signals endorsed by regulators.” Companies on webXray’s list include Google, Microsoft, and Meta.
Huge thanks to our sponsor, Conveyor
The teams that have fully automated their customer security reviews didn’t just get a better trust center.
They switched to an AI platform built for the whole workflow.
Conveyor handles trust center, questionnaire automation, and self-serve for sales, all in one place, with AI keeping the knowledge base current so answers are always accurate. Learn why enterprise SaaS teams choose Conveyor at conveyor.com.
JanaWare ransomware targets Turkish citizens
Researchers from cybersecurity firm Acronis are warning that cybercriminals are using this new ransomware strain to target people in Turkey. The ransomware enforces execution constraints based on system locale and external IP geolocation. Its ransom demands are very low, around $200 to $400, and this “regional focus and relatively small-scale operations helped it remain largely unnoticed.” The researchers warn that “this case demonstrates how targeted, localized ransomware campaigns can quietly persist in the threat landscape.”
NIST’s NVD changes vulnerability assessment rules
According to Harold Booth, a computer scientist at NIST, the team that runs the U.S. National Vulnerability Database (NVD), hosted by NIST, just cannot keep up with the explosion of new reported vulnerabilities. Speaking at VulnCon26 in Scottsdale, Arizona, last Wednesday, he said the NVD had to “make operational adjustments in how its data analysts enrich vulnerabilities to address the “record growth” of reported common vulnerabilities and exposures (CVEs).” The data analysis will shift to a “risk-based approach that will guide how they prioritize which CVE to process and enrich first.” This change will include dropping enrichment for all vulnerabilities reported before March 1, 2026, but will retain prioritization of vulnerabilities found in software used by the U.S. federal government or in critical software.
Tennessee hospital announces data breach
This attack happened at the Cookeville Regional Medical Center on July 14 last year, and a subsequent investigation has revealed a significant data breach. The stolen data could include PII plus financial account number, medical treatment information, and health insurance policy information of more than 337,000 individuals. The Rhysida ransomware group announced the theft on its leak website in August, hoping to sell the data for 10 bitcoin, then worth roughly $1 million. They apparently did not find a buyer and then made the data freely available for download.
Fashion retailer Express exposed customers’ personal data on the internet
The fashion giant has now patched its website, fixing a security flaw that allowed anyone online to view other people’s order details and personal information. “At least a dozen of Express’ customer orders had been publicly listed in web search engine results.” The flaw was accidentally discovered by a security resumé, Rey Bango who “was investigating a fraudulent purchase on a family member’s account but found no way to report the flaw to Express.” TechCrunch verified that Express uses order numbers that are largely sequential, which made it easy to cycle through thousands of orders by changing the order number in the web address using automated web tools.