Technical Consultant

Trellix appoints Joe Chen as Chief Technology Officer. Cybersecurity veteran to lead mission-critical technology roadmap and harden R&D processes for the modern threat landscape SAN JOSE, Calif. - Trellix, a global leader in intelligence-led cyber resilience, today announced the appointment of Joe Chen as Chief Technology Officer. Chen will advance Trellix's mission-critical cybersecurity vision, strengthen engineering execution, and lead the next phase of the company's technology roadmap. Chen brings more than 25 years of experience driving product portfolio transformation for global cybersecurity providers. Chen will partner closely with Alex Au Yeung, Chief Product Officer, to deliver next-generation security technology for the era of AI and frontier models. The duo shares a successful history of product portfolio transformations, evolving complex, multi-product offerings into unified solutions that advance customer outcomes through clear roadmaps and rapid development cycles. "Joe is a proven technology leader who excels at simplifying complex solutions and delivering innovation at scale," said Vishal Rao, CEO of Trellix. "He brings the cybersecurity expertise, disciplined execution, and AI-forward disposition required to relentlessly strengthen our security posture and R&D processes for the modern world. I also want to thank Steve Tait for his steady leadership as interim CTO and for ensuring continuity during this transition." Chen joins Trellix at a critical moment, with a priority focus on optimizing the processes used to securely deliver high-quality innovations to the market. His leadership will reinforce the systems and practices that underpin secure product development, ensuring Trellix remains at the forefront of cyber resilience. "Cybersecurity is at an inflection point, with today's threat landscape and the rise of AI and frontier models demanding uncompromising security in everything we do," said Chen. "I'm thrilled to be joining Trellix at this pivotal time, with a sharp focus on hardening our R&D engine and applying a continuous improvement mindset to engineering operations, so we deliver the most secure, reliable, and innovative solutions to our customers at speed." Prior to Trellix, Chen was an Operating Partner at Crosspoint Capital, focusing on engineering transformation. He previously held senior leadership roles at Broadcom's Symantec Enterprise Division and Carbon Black, overseeing large-scale integration and security product development. Chen is a founding member of the Cyber Threat Alliance and holds more than 55 U.S. patents. About Trellix Trellix is a global cybersecurity company delivering intelligence-led cyber resilience for security-conscious organizations at any stage of their journey. Transforming over 30 years of threat intelligence into high-fidelity detections and automating AI-driven detection and response across cloud, on-premises, air-gapped, and operational technology environments, Trellix helps customers adapt to the constantly evolving threat landscape. More at https://trellix.com. Follow Trellix on LinkedIn and X.

NEWS ROUNDUP - 8th may 2026. Digital Forensics Magazine - 48h News Roundup Window: 06-05-2026 to 08-05-2026 (UTC) Snapshot summary. | Sector / Section | Headline Highlights | Count | | Digital Investigations | API exposure and source-code review | 2 | | Cyber Investigations | Supply-chain and firewall probes | 2 | | Major Cyber Incidents | Education and platform breaches | 2 | | Exploits & Threat Intelligence | Ivanti and Linux exploitation | 2 | | Law Enforcement | DPRK fraud and database deletion | 2 | | Policy & Standards | PNT and enterprise advisories | 2 | Digital Investigations. A DOD contractor API flaw exposed service-member and course data in the United States after researchers found accessible records and confidential military training material on Schemata's AI platform [AMER]. The investigative value sits in the exposed identifiers, base assignments, course metadata and patched endpoint trail, which give auditors a clear path for scope validation and third-party control review (Source: CyberScoop, 06-05-2026). Trellix confirmed unauthorised access to part of its source-code repository after a breach investigation involving external security specialists and notifications to authorities [AMER]. The company said there was no evidence that source-code distribution had been affected, leaving investigators to resolve access method, exfiltration scope, actor identity and whether any downstream abuse indicators exist (Source: TechRadar, 06-05-2026). Cyber Investigations. Kaspersky reported a DAEMON Tools supply-chain compromise after attackers replaced signed installers with trojanised builds distributed through the vendor's official channel across more than 100 countries [Global]. The staged infection chain collected host data before selectively deploying a backdoor, giving investigators file-signing artefacts, download timelines and victim-sector clustering across government, scientific, industrial and retail environments (Source: Kaspersky, 05-05-2026). Unit 42 detailed exploitation of a PAN-OS captive-portal zero-day affecting exposed Palo Alto Networks firewall authentication portals, with activity carrying indicators consistent with targeted intrusion operations [Global]. The investigation centres on unauthenticated remote code execution, affected portal exposure, root-level device access and the collection of network-edge evidence needed to determine lateral movement risk (Source: Unit 42, 07-05-2026). Major Cyber Incidents. Vimeo user data was exposed through a third-party analytics integration, with Have I Been Pwned reporting names and email addresses for about 119,000 people after ShinyHunters leaked stolen data [AMER]. The incident illustrates how technical metadata, account identifiers and integration access logs become central evidence when breach scope depends on a connected supplier rather than the primary platform alone (Source: TechRadar, 07-05-2026). Queensland education authorities confirmed student and teacher data was stolen from the Canvas-linked QLearn environment, affecting current and former users since 2020 [APAC]. Investigators are correlating provider notifications, school communications, exposed names, email addresses and school-location records while assessing risk for protected families and individuals affected by domestic violence or child-safety concerns (Source: The Courier-Mail, 07-05-2026). Exploits & Threat Intelligence. Ivanti issued fixes for EPMM vulnerabilities, including CVE-2026-6973, after warning that the flaw had been exploited in limited attacks against mobile endpoint management infrastructure [Global]. The threat picture requires administrators to preserve appliance logs, review administrator-session history, validate exposed management surfaces and confirm upgrades to fixed versions 12.6.1.1, 12.7.0.1 or 12.8.0.1 (Source: Ivanti, 07-05-2026). A Linux zero-day dubbed Dirty Frag was disclosed, with reporting that local attackers can obtain root privileges on major distributions using a public proof-of-concept exploit [Global]. Forensic triage should prioritise privilege-escalation artefacts, unusual local command execution, kernel-version exposure and whether the exploit was chained after credential theft or web-shell access (Source: BleepingComputer, 08-05-2026). Law Enforcement. Two U.S. nationals were sentenced for facilitating fraudulent remote IT worker schemes that helped North Korean workers access U.S. companies through laptop farms [AMER]. Court records describe shipped victim laptops, unauthorised remote-desktop installations, network access and revenue flows, providing a clear evidential chain from physical devices to identity deception and sanctioned state funding (Source: U.S. Department of Justice, 06-05-2026). A federal jury convicted a Virginia man over deletion of U.S. government databases, in a case involving unauthorised data destruction affecting public-sector systems [AMER]. The prosecution highlights evidential dependence on database activity records, access authorisation history, deletion timelines and system-recovery analysis when courts must distinguish administrative access from criminal misuse (Source: U.S. Department of Justice, 07-05-2026). Policy & Standards. NIST published an initial public draft of IR 8323 Revision 2, updating the Foundational PNT Profile for applying the Cybersecurity Framework 2.0 to positioning, navigation and timing services [AMER]. The draft supports evidence-led risk management by mapping functions, categories and outcomes to systems whose timing and location dependencies underpin telecommunications, finance, transport and critical infrastructure operations (Source: NIST, 06-05-2026). The Canadian Centre for Cyber Security issued Cisco advisory AV26-430 after Cisco published fixes for vulnerabilities across multiple enterprise products [AMER]. The advisory gives defenders a standards-aligned reference point for change control, patch evidence, exposure assessment and audit documentation where code execution, server-side request forgery or denial-of-service conditions could affect enterprise infrastructure (Source: Canadian Centre for Cyber Security, 06-05-2026). Editorial perspective. This cycle shows why digital investigations must treat identity, supplier access and platform telemetry as a single evidential environment. The most useful artefacts are no longer confined to endpoint images or server logs; they include integration records, administrator sessions, signed installer provenance, API exposure histories and third-party notification trails. Investigative readiness therefore depends on organisations being able to preserve cross-platform evidence before containment actions overwrite the sequence of events. The strongest operational theme is correlation: linking exposed personal data to supplier pathways, linking appliance exploitation to edge-device configuration, and linking remote-access infrastructure to physical devices and payment flows. Attribution capability remains fragile where actors use compromised software distribution or legitimate management tools, so investigators need defensible timelines and corroborated artefacts rather than assumptions based on victim sector alone. Evidence integrity will increasingly depend on structured logging, rapid legal preservation and supplier contracts that make forensic access explicit. Reference reading. Digital Investigations, API Exposure, Supply Chain Compromise, ShinyHunters, Ivanti EPMM, PAN-OS, Linux Zero-Day, North Korea IT Workers, NIST CSF, Evidence Integrity