Author: HackWatchit

Could Your Legacy IAM Be The Achilles Heel of Your Cybersecurity? When security breaches and data leaks proliferate, organizations grapple with the rising challenge of protecting their digital assets. This is particularly true for organizations with legacy Identity and Access Management (IAM) systems. While these systems have served us well in the past, could they be turning into liabilities? If a new generation of Non-Human Identities (NHIs) becomes central to the digital environment, the pressing question becomes: How can legacy IAM systems be updated to support NHIs? The Role of NHIs in Modern Cybersecurity NHIs are machine identities employed. These…

previous article on organizing for AI (link), we looked at how the interplay between three key dimensions — ownership of outcomes, outsourcing of staff, and the geographical proximity of team members — can yield a variety of organizational archetypes for implementing strategic AI initiatives, each implying a different twist to the product operating model. Now we take a closer look at how the product operating model, and the core competencies of empowered product teams in particular, can evolve to face the emerging opportunities and challenges in the age of AI. We start by placing the current orthodoxy in its historical…

Zero-day broker Operation Zero offers up to $4 million for Telegram exploits Pierluigi Paganini March 22, 2025 Russian zero-day broker Operation Zero is looking for exploits for the popular messaging app Telegram, offering up to $4 million for them. Operation Zero, a Russian zero-day broker, is offering up to $4 million for Telegram exploits, the news was first reported by Tech Crunch. The Russian firm seeks up to $500K for one-click RCE, $1.5M for zero-click RCE, and $4M for a full-chain exploit that could allow full device compromise. The company exclusively sells exploits to the Russian government and local firms.…

ORIGINALLY AIRED ON JUNE 20, 2022 Articles discussed in this episode: 00:00 – BHIS – Talkin’ Bout [infosec] News 2022-06-20 01:31 – Story # 1: Internal TikTok Meetings Shows That US User Data Accessed From China – https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-tapes-us-user-data-china-bytedance-access 05:14 – Story # 2: Mullvad VPN Removes Ability to Create New Subscriptions – https://www.pcmag.com/news/mullvad-vpn-removes-ability-to-create-new-subscriptions 09:23 – Story # 3: Flagstar Bank discloses data breach impacting 1.5 million customers – https://www.bleepingcomputer.com/news/security/flagstar-bank-discloses-data-breach-impacting-15-million-customers/ 13:25 – Story # 4: Russia-linked APT targets Ukraine by exploiting the Follina RCE vulnerability – https://securityaffairs.co/wordpress/132227/apt/cert-ua-sandworm-follina-rce.html 17:39 – Story # 5: Tesla cars barred for 2 months in Beidaihe, site…

A vulnerability (CVE-2024-48248) in NAKIVO Backup and Replication, a backup, ransomware protection and disaster recovery solution designed for organizations of all sizes and managed service providers (MSPs), is being actively exploited. The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog on Wednesday, but it’s yet unknown whether the flaw is being leveraged by ransomware attackers, who often try to delete existing backups to make it more likely for victim organizations to pay a ransom. About CVE-2024-48248 CVE-2024-48248 is an absolute path traversal vulnerability that may allow remote, unauthenticated attackers to read…

The Securities and Exchange Commission’s (SEC) Crypto Task Force held the first of what is to be a series of roundtables focused on different aspects of the regulation of crypto assets. The Friday (March 21) roundtable was titled, “How We Got Here and How We Get Out — Defining Security Status” and focused on the legal issues involved in classifying crypto assets under federal securities laws. SEC Acting Chairman Mark T. Uyeda said in his remarks at the roundtable that because it’s not unusual to see differences in opinions among various courts, the SEC and its staff have stepped in to provide guidance in the past when dealing with other…

Researchers have determined that Coinbase was the primary target in a recent GitHub Actions cascading supply chain attack that compromised secrets in hundreds of repositories. According to new reports from Palo Alto Unit 42 and Wiz, the attack was carefully planned and began when malicious code was injected into reviewdog/action-setup@v1 GitHub Action. It is unclear how the breach occurred, but the threat actors modified the action to dump CI/CD secrets and authentication tokens into GitHub Actions logs. As previously reported, the first stage of the breach involved the compromise of the reviewdog/action-setup@v1 GitHub Action. It is unclear how the breach…

The recent arrival of DeepSeek AI not only sent shockwaves throughout Silicon Valley but once again brought some very important data privacy issues back to the surface. Authorities in the Netherlands, Australia, Ireland and France have already begun examining the vendor’s data practices, with privacy worries front and center. In Italy, the regulator has already asked the government to ban the app to protect the data of Italian users. AI tools aside, these issues are perennial headline-grabbers across the business ecosystem, with organizations everywhere struggling to build strategies that give stakeholders and regulators the certainty they need. The underlying paradox…

Water is the essence of life, but in today’s digital world, it’s also an increasingly attractive target for cyber criminals. Water treatment plants and distribution systems rely on digital controls, which, if compromised, can lead to disastrous consequences, including contamination, service disruptions, and threats to public health.​ A 2024 assessment by the U.S. Environmental Protection Agency (EPA) found that 97 drinking water systems, serving approximately 26.6 million people, had critical or high-risk cyber security vulnerabilities. ​According to Check Point Research, thus far in 2025, the energy & utilities (including water) industry has suffered on average 1872 weekly attack attempts per…