McLean, Virginia, United States, 15th January 2026, CyberNewsWire
The post AppGuard Critiques AI Hyped Defenses; Expands its Insider Release for its Next-Generation Platform appeared first on Security Boulevard.
A new Harmonic Security report reveals a sharp rise in sensitive data shared with generative AI tools like ChatGPT, increasing the risk of security breaches, compliance violations, and data exposure across global organizations.
The post Report: Massive Amounts of Sensitive Data Being Shared with GenAI Tools appeared first on Security Boulevard.
Delinea announces the acquisition of StrongDM to enhance its privileged access management platform, offering just-in-time access for IT infrastructure and improving cybersecurity for human and non-human identities.
The post Delinea Acquires StrongDM to Secure Access to IT Infrastructure appeared first on Security Boulevard.
API security is becoming more important by the day and skilled practitioners are in high demand. Now’s the time to level up your API security skillset. Wallarm University, our free training course, provides security analysts, engineers, and practitioners with hands-on skills you can’t get from documentation, videos, or traditional courses. Run real attacks, investigate real [...]
The post 7 Reasons to Get Certified in API Security appeared first on Wallarm.
The post 7 Reasons to Get Certified in API Security appeared first on Security Boulevard.
Digital devices now shape daily instruction in K–12 classrooms. Laptops, tablets, and phones support research, collaboration in the classroom, and blended learning. Many schools also cater for bring your own device (BYOD) environments. These tools can unlock engagement and creativity, but they also create challenges when teachers must balance lesson flow, monitoring, and behavior expectations. ...
The post Classroom Device Management: 8 Strategies for K-12 Success appeared first on ManagedMethods Cybersecurity, Safety & Compliance for K-12.
The post Classroom Device Management: 8 Strategies for K-12 Success appeared first on Security Boulevard.
A new Arcjet SDK lets Python teams embed bot protection, rate limiting, and abuse prevention directly into application code.
The post Arcjet Python SDK Sinks Teeth Into Application-Layer Security appeared first on Security Boulevard.
Nisos
Modern Executive Protection: Digital Exposure & Physical Risk
Executive protection has long focused on physical security measures such as trained personnel, secure travel, and site assessments...
The post Modern Executive Protection: Digital Exposure & Physical Risk appeared first on Nisos by Nisos
The post Modern Executive Protection: Digital Exposure & Physical Risk appeared first on Security Boulevard.
A short time ago, we announced our integration of OWASP ASVS into our cyber risk management platform. At a high level, this allows organizations to run more structured, repeatable security assessments for web applications and cloud-based services, while also giving security and procurement teams a consistent way to evaluate internally developed and third-party software. This […]
The post How the OWASP Application Security Verification Standard Helps Improve Software Security appeared first on Centraleyes.
The post How the OWASP Application Security Verification Standard Helps Improve Software Security appeared first on Security Boulevard.
Microsoft and law enforcement agencies in Europe disrupted the operations of RedVDS, a global cybercrime service that sold cheap and disposable dedicated virtual servers to threat actors that used them to run BEC, phishing, and other fraud campaigns. The vendor now wants to shut down its payment networks and find the operators behind it.
The post Microsoft, Law Enforcement Disrupt RedVDS Global Cybercrime Service appeared first on Security Boulevard.
NEW YORK, Jan. 14, 2026, CyberNewswire — Panorays, a leading provider of third-party security risk management software, has released the 2026 edition of its annual CISO Survey for Third-Party Cyber Risk Management.
The survey highlights third-party cyber risk … (more…)
The post News alert: Panorays study finds most CISOs lack vendor visibility as supply chain attacks climb first appeared on The Last Watchdog.
The post News alert: Panorays study finds most CISOs lack vendor visibility as supply chain attacks climb appeared first on Security Boulevard.
How Are Non-Human Identities Revolutionizing Cloud Security? What drives the evolution of cybersecurity? The answer often lies in the innovative management of non-human identities (NHIs). With the unprecedented surge in cloud adoption, the challenge of securing machine identities and their corresponding secrets has never been more critical. But what exactly makes NHIs so pivotal? Understanding […]
The post What innovations do NHIs bring to cloud security appeared first on Entro.
The post What innovations do NHIs bring to cloud security appeared first on Security Boulevard.
How Can Advanced AI Strategies Transform Data Protection? How do organizations ensure that their data protection strategies remain cutting-edge and resilient against evolving threats? For many cybersecurity professionals, the key lies in harnessing the potential of Agentic AI. Advanced AI technologies have become pivotal in fortifying data protection strategies, especially in complex environments characterized by […]
The post Can Agentic AI keep your data protection strategies ahead appeared first on Entro.
The post Can Agentic AI keep your data protection strategies ahead appeared first on Security Boulevard.
How Do Organizations Ensure Machine Trust in Secret Management? How can organizations ensure that machines, which are increasingly handling vast amounts of sensitive data, can be trusted with secret management? With digital landscpe evolves, machine identities are taking center stage. These Non-Human Identities (NHIs) are critical components, especially for organizations leveraging cloud-based infrastructures. By ensuring […]
The post How do you trust a machine with secret management appeared first on Entro.
The post How do you trust a machine with secret management appeared first on Security Boulevard.
How Does Non-Human Identity Management Enhance Scalability in Tech Ecosystems? Is your organization struggling to keep pace with the scalability demands of emerging tech? With technology grow and evolve, the role of Non-Human Identities (NHIs) in ensuring seamless operations becomes increasingly significant. NHIs represent machine identities that are pivotal in cybersecurity, serving as the linchpin […]
The post Are NHIs scalable for growing tech ecosystems appeared first on Entro.
The post Are NHIs scalable for growing tech ecosystems appeared first on Security Boulevard.
Exploit code has been published for CVE-2025-64155, a critical command injection vulnerability affecting Fortinet FortiSIEM devices.
Key takeaways:On January 13, Fortinet published a security advisory (FG-IR-25-772) for CVE-2025-64155, a critical command injection vulnerability affecting Fortinet FortiSIEM.
CVE Description CVSSv3 CVE-2025-64155 Fortinet FortiSIEM Command Injection Vulnerability 9.4 AnalysisCVE-2025-64155 is a critical operating system (OS) command injection vulnerability affecting Fortinet FortiSIEM. A remote, unauthenticated attacker can exploit this flaw to execute arbitrary code using specially crafted requests.
Historical Exploitation of Fortinet Devices
Fortinet vulnerabilities have historically been common targets for cyber attackers, with 23 Fortinet CVEs currently on the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) list. At the time this blog was published on January 14, CVE-2025-64155 had not been added to the KEV, however we anticipate that it is likely to be added in the near future.
As Fortinet devices have been popular targets for attackers, the Tenable Research Special Operations Team (RSO) has authored several blogs about vulnerabilities affecting these devices. The following table outlines some of the most impactful Fortinet vulnerabilities in recent years.
CVE Description Published Tenable Blog CVE-2025-64446 Fortinet FortiWeb Path Traversal Vulnerability November 2025 CVE-2025-64446: Fortinet FortiWeb Zero-Day Path Traversal Vulnerability Exploited in the Wild CVE-2025-25256 Fortinet FortiSIEM Command Injection Vulnerability August 2025 CVE-2025-25256: Proof of Concept Released for Critical Fortinet FortiSIEM Command Injection Vulnerability CVE-2025-32756 Fortinet FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera Arbitrary Code Execution Vulnerability May 2025 CVE-2025-32756: Zero-Day Vulnerability in Multiple Fortinet Products Exploited in the Wild CVE-2024-55591 Fortinet Authentication Bypass in FortiOS and FortiProxy January 2025 CVE-2024-55591: Fortinet Authentication Bypass Zero-Day Vulnerability Exploited in the Wild CVE-2024-21762 Fortinet FortiOS Out-of-bound Write Vulnerability in sslvpnd February 2024 CVE-2024-21762: Critical Fortinet FortiOS Out-of-Bound Write SSL VPN Vulnerability CVE-2023-27997 FortiOS and FortiProxy Heap-Based Buffer Overflow Vulnerability June 2023 CVE-2023-27997: Heap-Based Buffer Overflow in Fortinet FortiOS and FortiProxy SSL-VPN (XORtigate) CVE-2022-42475 FortiOS and FortiProxy Heap-Based Buffer Overflow Vulnerability December 2022 CVE-2022-42475: Fortinet Patches Zero Day in FortiOS SSL VPNsAA23-250A: Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475 CVE-2022-40684 FortiOS and FortiProxy Authentication Bypass Vulnerability October 2022 CVE-2022-40684: Critical Authentication Bypass in FortiOS and FortiProxy Proof of conceptOn January 13, in coordination with the release of the advisory by Fortinet, researchers at Horizon3.ai published a technical writeup as well as a proof of concept for CVE-2025-64155. While there has been no reports of in-the-wild exploitation, we anticipate that attackers will quickly incorporate this exploit into their attacks.
SolutionThe following table details the affected and fixed versions of Fortinet FortiSIEM devices for CVE-2025-64155:
Product Version Affected Range Fixed Version FortiSIEM 6.7 6.7.0 through 6.7.10 Migrate to a fixed release FortiSIEM 7.0 7.0.0 through 7.0.4 Migrate to a fixed release FortiSIEM 7.1 7.1.0 through 7.1.8 7.1.9 or above FortiSIEM 7.2 7.2.0 through 7.2.6 7.2.7 or above FortiSIEM 7.3 7.3.0 through 7.3.4 7.3.5 or above FortiSIEM 7.4 7.4.0 7.4.1 or above FortiSIEM 7.5 Not affected - FortiSIEM Cloud Not affected -Fortinet’s security advisory advises if immediate patching is not able to be performed, they recommend limiting access to the phMonitor port of 7900. We strongly recommend reviewing the advisory for updates as well as the latest on mitigation recommendations.
Identifying affected systemsA list of Tenable plugins for this vulnerability can be found on the individual CVE page for CVE-2025-64155 as they’re released. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.
Additionally, customers can utilize Tenable Attack Surface Management to identify public facing assets running Fortinet devices by using the following subscription:
Get more informationJoin Tenable's Research Special Operations (RSO) Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
The post CVE-2025-64155: Exploit Code Released for Critical Fortinet FortiSIEM Command Injection Vulnerability appeared first on Security Boulevard.
Session 8D: Usability Meets Privacy
Authors, Creators & Presenters: Andrick Adhikari (University of Denver), Sanchari Das (University of Denver), Rinku Dewri (University of Denver)
PAPER
PolicyPulse: Precision Semantic Role Extraction For Enhanced Privacy Policy Comprehension
The effectiveness of natural language privacy policies continues to be clouded by concerns surrounding their readability, ambiguity, and accessibility. Despite multiple design alternatives proposed over the years, natural language policies are still the primary format for organizations to communicate privacy practices to users. Current NLP techniques are often drawn towards generating high-level overviews, or specialized towards a single aspect of consumer privacy communication; the flexibility to apply them for multiple tasks is missing. To this aid, we present PolicyPulse, an information extraction pipeline designed to process privacy policies into usable formats. PolicyPulse employs a specialized XLNet classifier, and leverages a BERT-based model for semantic role labeling to extract phrases from policy sentences, while maintaining the semantic relations between predicates and their arguments. Our classification model was trained on 13,946 manually annotated semantic frames, and achieves a F1-score of 0.97 on identifying privacy practices communicated using clauses within a sentence. We emphasize the versatility of PolicyPulse through prototype applications to support requirement-driven policy presentations, question-answering systems, and privacy preference checking.
ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.
The post NDSS 2025 – PolicyPulse:Precision Semantic Role Extraction For Enhanced Privacy Policy Comprehension appeared first on Security Boulevard.
Living Security revealed it is beta testing an artificial intelligence (AI) engine on its platform that continuously analyzes billions of signals to predict risk trajectories, recommend the most effective actions, and automate routine interventions to better secure employees and, by extension, AI agents. Dubbed Livvy, the AI engine is being added to a Human Risk..
The post Living Security Adds AI Engine to Surface Risky End User Behavior appeared first on Security Boulevard.
via the comic artistry and dry wit of Randall Munroe, creator of XKCD
The post Randall Munroe’s XKCD ‘Telescope Types’ appeared first on Security Boulevard.
Learn how to use JWT as API keys for enterprise apps. We cover security best practices, oidc integration, and avoiding common auth breaches.
The post Using JWT as API Keys: Security Best Practices & Implementation Guide appeared first on Security Boulevard.
Artificial intelligence is now part of modern software development. The tools available to engineers today are enabling new levels of productivity, automation, and collaboration. Leaders...Read More
The post How AI Is Reshaping Software Development and How Tech Leaders Should Measure Its Impact appeared first on ISHIR | Custom AI Software Development Dallas Fort-Worth Texas.
The post How AI Is Reshaping Software Development and How Tech Leaders Should Measure Its Impact appeared first on Security Boulevard.
