Welcome to our podcast series, Coffee with the Council. I’m Alicia Malone, Director of Communications and Public Relations for the PCI Security Standards Council. As many of our listeners are aware, we are quickly approaching the deadline to adopt the future-dated requirements of PCI DSS version 4.0.1 on March 31st, 2025. Over the course of the last year, the Council has received feedback that more guidance was needed to properly implement some of the…

Artificial intelligence has emerged as a game-changing force, with record amounts of funding fueling new innovations that are transforming industries and workflows at speeds we have never seen before. According to data from Crunchbase, in February 2024, AI companies received $4.7 billion in venture funding. That’s more than double the $2.1 billion invested in February 2023. It’s money like this is fueling innovations that are being adopted at record speeds. Take code copilots as an example….

A growing number of phishing campaigns have been observed leveraging trusted online document platforms to evade secure email gateways (SEGs) and steal credentials. Threat analysts at Cofense Intelligence have identified that platforms such as Adobe, DocuSign, Dropbox, Canva and Zoho are being misused in phishing attacks due to their widespread adoption by businesses and individuals. In 2024, these online document services reportedly accounted for 8.8% of all credential phishing campaigns, with 79% of observed cases…

A newly discovered malware campaign has leveraged malicious npm packages to deliver highly sophisticated reverse shells. Researchers at ReversingLabs identified two malicious packages, “ethers-provider2” and “ethers-providerz,” which infiltrated development environments by covertly modifying legitimate npm dependencies. The ethers-provider2 package closely mimics the legitimate ssh2 package, embedding harmful code within its installation script. Upon execution, the script downloads a second-stage payload from an external server, executing it before erasing any traces of the download. This payload continuously monitors for the installation of the…

Do you rely on SAP maintenance contracts to keep vulnerabilities in check? Here’s a question: have you felt the sting of renewal season? Those spiraling costs are hard to ignore—just like the rising threats and security compliance headaches. No wonder so many organizations, maybe even yours, are asking: Do we really need to keep paying for vendor protection, or could we handle SAP security ourselves? Yes, ditching the maintenance contract can save cash, but it’s…