One feed for cybersecurity news: headlines from 8+ trusted newsrooms, research teams, and practitioner blogs, merged hourly. Full articles at the original publishers. https://www.cybersecurityalphabetsoup.com/news/ Wed, 09 Sep 2026 14:40:21 GMT 60 https://www.securityweek.com/fortinet-patches-critical-vulnerabilities-in-fortimonitoronsight-chrome-extension/ https://www.securityweek.com/fortinet-patches-critical-vulnerabilities-in-fortimonitoronsight-chrome-extension/ Wed, 09 Sep 2026 14:33:52 GMT SecurityWeek The critical, unauthenticated bugs allow attackers to bypass authentication and proxy a user’s browser traffic. The post Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension appeared first on SecurityWeek . (via SecurityWeek) https://www.infosecurity-magazine.com/news/gigabud-android-app-cloning-fraud/ https://www.infosecurity-magazine.com/news/gigabud-android-app-cloning-fraud/ Wed, 09 Sep 2026 14:30:00 GMT Infosecurity Magazine Gigabud clones banking apps into a work profile to break the link between malware alerts and fraud (via Infosecurity Magazine) https://thehackernews.com/2026/09/infostealer-logs-expose-replayable-ai.html https://thehackernews.com/2026/09/infostealer-logs-expose-replayable-ai.html Wed, 09 Sep 2026 14:23:55 GMT The Hacker News Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create "stolen keys" that grant illicit access to tools from model providers like Google, Anthropic, and others. Information stealers like Lumma Stealer or Vidar are equipped… (via The Hacker News) https://www.bleepingcomputer.com/news/security/mfas-weakest-link-account-recovery-is-the-new-attack-path/ https://www.bleepingcomputer.com/news/security/mfas-weakest-link-account-recovery-is-the-new-attack-path/ Wed, 09 Sep 2026 14:01:11 GMT BleepingComputer MFA makes account takeover harder, but attackers are increasingly targeting the recovery processes used to reset passwords and authentication methods. Specops explains why stronger identity verification at the service desk is critical to preventing social engineering attacks… (via BleepingComputer) https://www.helpnetsecurity.com/2026/09/09/akeyless-agentic-runtime-authority-identity-control-layer/ https://www.helpnetsecurity.com/2026/09/09/akeyless-agentic-runtime-authority-identity-control-layer/ Wed, 09 Sep 2026 13:54:35 GMT Help Net Security Akeyless has announced the general availability of Akeyless Agentic Runtime Authority, the real-time identity control layer for AI agent actions. It works on top of Akeyless SecretlessAI, a credential protection layer that keeps credentials out of AI agents and brokers access to… (via Help Net Security) https://www.infosecurity-magazine.com/news/clickfix-browser-cryptocurrency/ https://www.infosecurity-magazine.com/news/clickfix-browser-cryptocurrency/ Wed, 09 Sep 2026 13:45:00 GMT Infosecurity Magazine ClickFix campaign uses browser-injected JavaScript and Google Sheets to steal cryptocurrency (via Infosecurity Magazine) https://www.helpnetsecurity.com/2026/09/09/orchid-security-ai-agents-application-level-kill-switches/ https://www.helpnetsecurity.com/2026/09/09/orchid-security-ai-agents-application-level-kill-switches/ Wed, 09 Sep 2026 13:29:17 GMT Help Net Security Orchid Security has announced identity drift detection and application-level kill switches for AI agents. They can complete authorized objectives beyond their initial privilege level within seconds. AI agents do not need to “break” security controls or workflow guardrails. AI… (via Help Net Security) https://cyberscoop.com/fbi-cyber-strategy-ai-threats-patching/ https://cyberscoop.com/fbi-cyber-strategy-ai-threats-patching/ Wed, 09 Sep 2026 13:00:00 GMT CyberScoop The remarks, to both CyberScoop and at the Billington CyberSecurity Summit, dovetail with the release of a new bureau cyber strategy. The post FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching appeared first on CyberScoop . (via CyberScoop) https://www.infosecurity-magazine.com/news/nhis-number-one-corporate-entry/ https://www.infosecurity-magazine.com/news/nhis-number-one-corporate-entry/ Wed, 09 Sep 2026 13:00:00 GMT Infosecurity Magazine SpyCloud claims non-human identities are the most likely route into the enterprise (via Infosecurity Magazine) https://www.securityweek.com/us-agencies-warn-china-is-systematically-extracting-frontier-ai-capabilities/ https://www.securityweek.com/us-agencies-warn-china-is-systematically-extracting-frontier-ai-capabilities/ Wed, 09 Sep 2026 12:32:13 GMT SecurityWeek Distillation is an ‘attack’ against an AI model designed to capture outputs, understand reasoning processes, and subsequently train a different model. The post US Agencies Warn China Is Systematically Extracting Frontier AI Capabilities appeared first on SecurityWeek . (via SecurityWeek) https://therecord.media/ukraine-prosecutor-general-scam-center https://therecord.media/ukraine-prosecutor-general-scam-center Wed, 09 Sep 2026 12:15:00 GMT The Record Ukraine’s prosecutor general, Ruslan Kravchenko, resigned this week over allegations that officials in his office took bribes to shield scam call centers from law enforcement. (via The Record) https://www.helpnetsecurity.com/2026/09/09/singapore-man-pleads-guilty-245-million-crypto-theft/ https://www.helpnetsecurity.com/2026/09/09/singapore-man-pleads-guilty-245-million-crypto-theft/ Wed, 09 Sep 2026 12:11:36 GMT Help Net Security A 22-year-old man built his fortune by breaking into strangers’ digital wallets, then spent it on nightclub tabs, private jets, and a fleet of cars worth millions. Malone Lam, a Singapore citizen, pleaded guilty this week in a Washington D.C. federal court to running a… (via Help Net Security) https://www.securityweek.com/meta-launches-personal-ai-agent-muse-emphasizes-safety-and-privacy/ https://www.securityweek.com/meta-launches-personal-ai-agent-muse-emphasizes-safety-and-privacy/ Wed, 09 Sep 2026 12:00:00 GMT SecurityWeek Muse runs on a dedicated, secure virtual machine that houses both the agent and the user’s data. The post Meta Launches Personal AI Agent, Muse, Emphasizes Safety and Privacy appeared first on SecurityWeek . (via SecurityWeek) https://thehackernews.com/2026/09/webinar-learn-how-to-answer-are-we.html https://thehackernews.com/2026/09/webinar-learn-how-to-answer-are-we.html Wed, 09 Sep 2026 11:57:36 GMT The Hacker News A major vulnerability is disclosed. The alert lands immediately. Then comes the harder question: Are we actually exposed? For many security teams, answering that means jumping between vulnerability scanners, endpoint tools, cloud inventories, SBOMs, repositories, and application… (via The Hacker News) https://thehackernews.com/2026/09/deepseek-harness-flaw-let-ai-agents.html https://thehackernews.com/2026/09/deepseek-harness-flaw-let-ai-agents.html Wed, 09 Sep 2026 11:17:07 GMT The Hacker News A flaw in DeepSeek Harness, DeepSeek's open-source tool for running AI coding agents on a developer's machine, let a sandboxed agent turn off its own sandbox with a single command. The tool runs an agent's commands inside an operating-system sandbox, so that an agent working on… (via The Hacker News) https://www.schneier.com/blog/archives/2026/09/claude-fable-solves-a-historical-cipher.html https://www.schneier.com/blog/archives/2026/09/claude-fable-solves-a-historical-cipher.html Wed, 09 Sep 2026 11:08:26 GMT Schneier on Security Claude Fable 5.1 solved a 370-year-old cipher in forty-four minutes. This tracks with what I wrote about AIs doing mathematics: It’s good at things that involve lots of searching and testing. (via Schneier on Security) https://www.helpnetsecurity.com/2026/09/09/f5-big-ip-apm-rootkit-hides-web-shell-in-memory/ https://www.helpnetsecurity.com/2026/09/09/f5-big-ip-apm-rootkit-hides-web-shell-in-memory/ Wed, 09 Sep 2026 11:05:32 GMT Help Net Security A rootkit found on hacked F5 BIG-IP APM devices skips the usual step of writing a web shell to disk, hiding it in memory instead, according to Sophos. F5 BIG-IP APM provides access policy enforcement to secure access to apps, APIs, and data. It’s primarily used by enterprises,… (via Help Net Security) https://www.securityweek.com/ics-patch-tuesday-schneider-electric-siemens-fix-critical-flaws/ https://www.securityweek.com/ics-patch-tuesday-schneider-electric-siemens-fix-critical-flaws/ Wed, 09 Sep 2026 10:49:30 GMT SecurityWeek AVEVA and Rockwell Automation also released patches for vulnerabilities affecting industrial control system products. The post ICS Patch Tuesday: Schneider Electric, Siemens Fix Critical Flaws appeared first on SecurityWeek . (via SecurityWeek) https://thehackernews.com/2026/09/alby-hub-critical-flaw-could-let.html https://thehackernews.com/2026/09/alby-hub-critical-flaw-could-let.html Wed, 09 Sep 2026 10:43:04 GMT The Hacker News Bitcoin wallet company Alby has warned of a critical flaw in Alby Hub that could have let an attacker take over a wallet and send its funds, but only where the owner had made the Hub reachable from the internet. Alby Hub is a self-hosted Lightning wallet, meaning the owner runs… (via The Hacker News) https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/ https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/ Wed, 09 Sep 2026 10:28:34 GMT SecurityWeek Six critical vulnerabilities in Neurons for ITSM could enable remote code execution, while Sentry and EPMM received patches for authentication bypass flaws. The post Ivanti Patches Critical Flaws Across Enterprise Security Products appeared first on SecurityWeek . (via SecurityWeek) https://www.bleepingcomputer.com/news/security/over-36-000-plex-servers-unpatched-against-recently-disclosed-flaws/ https://www.bleepingcomputer.com/news/security/over-36-000-plex-servers-unpatched-against-recently-disclosed-flaws/ Wed, 09 Sep 2026 10:11:29 GMT BleepingComputer Over 36,000 Plex Media servers exposed online remain unpatched against multiple security vulnerabilities and are vulnerable to attacks. [...] (via BleepingComputer) https://www.helpnetsecurity.com/2026/09/09/zscaler-agentic-soc-solution/ https://www.helpnetsecurity.com/2026/09/09/zscaler-agentic-soc-solution/ Wed, 09 Sep 2026 10:09:49 GMT Help Net Security Zscaler has announced Zscaler Agentic SOC, a new approach to security operations built to proactively reduce exposures, scale human expertise and stop AI-driven attacks at machine speed. Simply layering in AI capabilities onto the existing security stack will not provide the… (via Help Net Security) https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ Wed, 09 Sep 2026 10:00:55 GMT Unit 42 An investigation into how cybercriminals used YouTube gaming lures and SEO poisoning to deliver multi-payload malware to enterprise networks. The post Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure appeared first on Unit 42 . (via Unit 42) https://www.securityweek.com/this-key-will-self-destruct-an-open-standard-for-revocable-api-keys/ https://www.securityweek.com/this-key-will-self-destruct-an-open-standard-for-revocable-api-keys/ Wed, 09 Sep 2026 10:00:00 GMT SecurityWeek Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. The post This Key Will Self-Destruct: An Open Standard for Revocable API Keys appeared first on SecurityWeek . (via SecurityWeek) https://www.securityweek.com/new-phishing-attack-creates-malicious-pages-inside-the-victims-browser/ https://www.securityweek.com/new-phishing-attack-creates-malicious-pages-inside-the-victims-browser/ Wed, 09 Sep 2026 10:00:00 GMT SecurityWeek Attackers are using trusted Microsoft services and blob URLs to generate stealthy phishing pages that leave defenders with no static website to detect or block. The post New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser appeared first on SecurityWeek . (via SecurityWeek) https://www.helpnetsecurity.com/2026/09/09/china-malicious-ai-knowledge-distillation-against-us-companies/ https://www.helpnetsecurity.com/2026/09/09/china-malicious-ai-knowledge-distillation-against-us-companies/ Wed, 09 Sep 2026 09:55:36 GMT Help Net Security China-based AI companies are using large-scale knowledge distillation campaigns to copy capabilities from leading U.S. AI models, according to a joint cybersecurity advisory from the CISA, NSA, and FBI. Knowledge distillation is a standard AI training technique that uses outputs… (via Help Net Security) https://www.helpnetsecurity.com/2026/09/09/securin-exposure-management-platform/ https://www.helpnetsecurity.com/2026/09/09/securin-exposure-management-platform/ Wed, 09 Sep 2026 09:52:55 GMT Help Net Security Securin has announced the general availability of the Securin Platform, an AI-native Preemptive Exposure Management platform designed to answer three questions security teams struggle with every day: What can attackers actually exploit? What should we fix first? And did the fix… (via Help Net Security) https://www.securityweek.com/chrome-153-patches-seventh-zero-day-of-2026/ https://www.securityweek.com/chrome-153-patches-seventh-zero-day-of-2026/ Wed, 09 Sep 2026 09:45:00 GMT SecurityWeek The Chrome update includes 230 security fixes, and users are advised to update their browsers as soon as possible. The post Chrome 153 Patches Seventh Zero-Day of 2026 appeared first on SecurityWeek . (via SecurityWeek) https://www.infosecurity-magazine.com/news/microsoft-patch-tuesday-record/ https://www.infosecurity-magazine.com/news/microsoft-patch-tuesday-record/ Wed, 09 Sep 2026 09:40:00 GMT Infosecurity Magazine The update contained 119 critical flaws and two zero days, with security teams needing to prioritize updates (via Infosecurity Magazine) https://thehackernews.com/2026/09/us-agencies-accuse-china-ai-firms-of.html https://thehackernews.com/2026/09/us-agencies-accuse-china-ai-firms-of.html Wed, 09 Sep 2026 09:32:26 GMT The Hacker News U.S. cybersecurity and intelligence agencies have accused China-based artificial intelligence (AI) companies of conducting "systematic extraction" of proprietary functionalities and capabilities of American frontier models through distillation attacks. The activity has been… (via The Hacker News) https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html Wed, 09 Sep 2026 09:11:03 GMT The Hacker News Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds… (via The Hacker News) https://www.helpnetsecurity.com/2026/09/09/september-2026-patch-tuesday-zero-days-sigred-successor/ https://www.helpnetsecurity.com/2026/09/09/september-2026-patch-tuesday-zero-days-sigred-successor/ Wed, 09 Sep 2026 09:04:18 GMT Help Net Security September 2026 Patch Tuesday is here, with Microsoft delivering another record-breaking number of patches, including those for two vulnerabilities that have been exploited as zero-days. Another “new normal” is the anonymous security researcher Nightmare Eclipse publishing a… (via Help Net Security) https://www.bleepingcomputer.com/news/security/man-gets-15-years-in-prison-for-cyberstalking-and-sextortion/ https://www.bleepingcomputer.com/news/security/man-gets-15-years-in-prison-for-cyberstalking-and-sextortion/ Wed, 09 Sep 2026 08:44:22 GMT BleepingComputer An Ohio man was sentenced to 15 years in prison for multiple cybercrimes, including sextortion and cyberstalking of numerous victims using AI-generated sexually explicit content. [...] (via BleepingComputer) https://www.fortra.com/blog/crpx0-ransomware-what-you-need-know https://www.fortra.com/blog/crpx0-ransomware-what-you-need-know Wed, 09 Sep 2026 08:42:55 GMT Graham Cluley CRPx0 is a cybercrime operation that started off operating a scam before pivoting into a fully-blown ransomware and cryptocurrency business. Read more in my article on the Fortra blog. (via Graham Cluley) https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account.html https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account.html Wed, 09 Sep 2026 08:19:32 GMT The Hacker News cPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user.… (via The Hacker News) https://www.infosecurity-magazine.com/news/sap-patches-maximum-severity/ https://www.infosecurity-magazine.com/news/sap-patches-maximum-severity/ Wed, 09 Sep 2026 08:15:00 GMT Infosecurity Magazine Onapsis urges SAP customers to patch “Overpass” vulnerability, which has a CVSS score of 10.0 (via Infosecurity Magazine) https://thehackernews.com/2026/09/f5-big-ip-apm-malware-injects-php-web.html https://thehackernews.com/2026/09/f5-big-ip-apm-malware-injects-php-web.html Wed, 09 Sep 2026 07:36:49 GMT The Hacker News Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7. When Apache loads any of the three appliances' own PHP scripts, the malware adds the web… (via The Hacker News) https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldcrash-zero-day-grants-system-access/ https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldcrash-zero-day-grants-system-access/ Wed, 09 Sep 2026 07:30:15 GMT BleepingComputer An anonymous security researcher known as Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named "ShieldCrash" right after Microsoft rolled out its September 2026 Patch Tuesday security updates. [...] (via BleepingComputer) https://www.bleepingcomputer.com/news/security/google-patches-seventh-chrome-zero-day-exploited-in-attacks-this-year/ https://www.bleepingcomputer.com/news/security/google-patches-seventh-chrome-zero-day-exploited-in-attacks-this-year/ Wed, 09 Sep 2026 06:25:48 GMT BleepingComputer Google has patched 230 vulnerabilities on Tuesday, including another actively exploited Chrome zero-day bug, the seventh such vulnerability patched since the start of the year. [...] (via BleepingComputer) https://isc.sans.edu/diary/rss/33322 https://isc.sans.edu/diary/rss/33322 Wed, 09 Sep 2026 02:00:02 GMT SANS Internet Storm Center via SANS Internet Storm Center https://www.bleepingcomputer.com/news/microsoft/microsoft-adds-age-awareness-apis-that-can-tell-if-users-are-children-teens-or-adults/ https://www.bleepingcomputer.com/news/microsoft/microsoft-adds-age-awareness-apis-that-can-tell-if-users-are-children-teens-or-adults/ Wed, 09 Sep 2026 01:16:27 GMT BleepingComputer Microsoft is adding new age-awareness APIs to Windows 11 that will allow apps to determine whether someone is a child, teenager, or adult without exposing their exact date of birth. [...] (via BleepingComputer) https://cyberscoop.com/microsoft-patch-tuesday-september-2026/ https://cyberscoop.com/microsoft-patch-tuesday-september-2026/ Tue, 08 Sep 2026 22:50:41 GMT CyberScoop While the vendor hit another monthly record, it hasn’t resulted in a flood of active exploits. Researchers encourage customers to focus on their specific areas of risk and exposure. The post Microsoft discloses two actively exploited zero-days among 974 vulnerabilities appeared… (via CyberScoop) https://therecord.media/microsoft-patch-tuesday-september-2026 https://therecord.media/microsoft-patch-tuesday-september-2026 Tue, 08 Sep 2026 22:40:00 GMT The Record The new record total for Patch Tuesday is 973 vulnerabilities. (via The Record) https://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/ https://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/ Tue, 08 Sep 2026 21:44:22 GMT Krebs on Security Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security… (via Krebs on Security) https://www.darkreading.com/vulnerabilities-threats/patch-tuesday-another-record-974-cves https://www.darkreading.com/vulnerabilities-threats/patch-tuesday-another-record-974-cves Tue, 08 Sep 2026 21:26:02 GMT Dark Reading Attackers are actively exploiting two of the vulnerabilities and another 58 are more likely to be exploited, according to Microsoft. (via Dark Reading) https://arstechnica.com/security/2026/09/microsoft-patches-a-record-972-vulnerabilities-112-of-them-critical/ https://arstechnica.com/security/2026/09/microsoft-patches-a-record-972-vulnerabilities-112-of-them-critical/ Tue, 08 Sep 2026 21:11:46 GMT Ars Technica Security Security gnomes are pumping out patches ahead of an expected onslaught of AI-assisted attacks. (via Ars Technica Security) https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign Tue, 08 Sep 2026 21:03:46 GMT Dark Reading Threat actors are abusing multiple Google services to evade detection, ultimately harvesting credentials or installing ScreenConnect remote access. (via Dark Reading) https://therecord.media/scammer-behind-245-million-crypto-heist-pleads-guilty-rico https://therecord.media/scammer-behind-245-million-crypto-heist-pleads-guilty-rico Tue, 08 Sep 2026 20:52:00 GMT The Record Malone Lam was indicted on scamming charges in September 2024 after drawing law enforcement scrutiny for parlaying stolen crypto into lavish Hamptons vacations, cars and private jets. (via The Record) https://cyberscoop.com/us-accuses-chinese-ai-companies-distillation/ https://cyberscoop.com/us-accuses-chinese-ai-companies-distillation/ Tue, 08 Sep 2026 20:47:53 GMT CyberScoop A joint advisory alleges Chinese companies are using sophisticated systems to route millions of data requests to US AI models across different accounts and platforms. The post Feds accuse China of ‘systematic’ distillation of U.S. AI models appeared first on CyberScoop . (via CyberScoop) https://www.darkreading.com/cyberattacks-data-breaches/openai-agents-wiki-site-hugging-face-attack https://www.darkreading.com/cyberattacks-data-breaches/openai-agents-wiki-site-hugging-face-attack Tue, 08 Sep 2026 20:36:15 GMT Dark Reading Researchers and OpenAI disagree on whether the earlier incident involving DseWiki, which the company did not disclose, was a “hack." (via Dark Reading) https://www.bleepingcomputer.com/news/security/doppelcart-fraud-network-uses-119-000-fake-shops-to-steal-credit-cards/ https://www.bleepingcomputer.com/news/security/doppelcart-fraud-network-uses-119-000-fake-shops-to-steal-credit-cards/ Tue, 08 Sep 2026 20:35:14 GMT BleepingComputer A massive operation dubbed "DoppelCart" uses more than 119,000 domains to run a network of fake e-shops that steal payment card details. [...] (via BleepingComputer) https://cyberscoop.com/russian-national-extradited-bank-account-takeover-sergei-filimonov/ https://cyberscoop.com/russian-national-extradited-bank-account-takeover-sergei-filimonov/ Tue, 08 Sep 2026 20:32:03 GMT CyberScoop Authorities accuse the 36-year-old and co-conspirators of collecting more than 5,000 victim login credentials to various banks. The post Russian national extradited to US for alleged involvement in bank-account takeover scheme appeared first on CyberScoop . (via CyberScoop) https://www.bleepingcomputer.com/news/security/the-eu-cras-real-question-what-shipped-and-when-did-you-know/ https://www.bleepingcomputer.com/news/security/the-eu-cras-real-question-what-shipped-and-when-did-you-know/ Tue, 08 Sep 2026 20:24:16 GMT BleepingComputer The EU Cyber Resilience Act's vulnerability reporting requirements take effect September 11, giving software vendors as little as 24 hours to report actively exploited flaws. ActiveState explains why knowing exactly what shipped and when vulnerabilities were discovered will be… (via BleepingComputer) https://cyberscoop.com/cia-cyber-operations-operation-absolute-resolve-michael-ellis-billington-cybersecurity/ https://cyberscoop.com/cia-cyber-operations-operation-absolute-resolve-michael-ellis-billington-cybersecurity/ Tue, 08 Sep 2026 19:49:14 GMT CyberScoop The deputy director cited Operation Absolute Resolve as evidence that cyber teams have become central to CIA missions. The post CIA’s Michael Ellis says cyber intelligence is changing how the agency operates appeared first on CyberScoop . (via CyberScoop) https://therecord.media/cia-cyber-operations-maduro-capture-venezuela https://therecord.media/cia-cyber-operations-maduro-capture-venezuela Tue, 08 Sep 2026 19:46:00 GMT The Record A "flawless" performance by the CIA's Cyber Mission Center contributed to the capture of Venezuelan President Nicolás Maduro in January, agency Deputy Director Michael Ellis says. (via The Record) https://therecord.media/russian-cybercrime-bank-extradition https://therecord.media/russian-cybercrime-bank-extradition Tue, 08 Sep 2026 19:37:42 GMT The Record A Russian web developer who played a role in a multimillion-dollar bank account takeover scheme has been extradited to the U.S. to face an indictment. (via The Record) https://isc.sans.edu/diary/rss/33320 https://isc.sans.edu/diary/rss/33320 Tue, 08 Sep 2026 19:20:30 GMT SANS Internet Storm Center This month, Microsoft released patches for a record-breaking 973 vulnerabilities, including 113 rated critical. It is by far the largest Patch Tuesday to date, well ahead of the previous high of 664 set in July 2026. Two vulnerabilities are listed as exploited in the wild, while… (via SANS Internet Storm Center) https://danielmiessler.com/blog/the-socrates-agent?utm_source=rss&utm_medium=feed&utm_campaign=website https://danielmiessler.com/blog/the-socrates-agent?utm_source=rss&utm_medium=feed&utm_campaign=website Tue, 08 Sep 2026 18:45:00 GMT Daniel Miessler A charcoal sketch of four slumped people being fed sheets of paper by a tall purple machine, while across the room one person writes at a wooden desk and a small purple Socrates leans in with open, empty hands/images/the-socrates-agent.webp/images/the-socrates-agent.webp… (via Daniel Miessler) https://cyberscoop.com/offense-driven-federal-cyber-defense/ https://cyberscoop.com/offense-driven-federal-cyber-defense/ Tue, 08 Sep 2026 18:30:00 GMT CyberScoop Static checklists and annual penetration tests leave agencies with dangerous blind spots. True resilience requires moving from reactive attestation to continuous, automated validation. The post Why federal cyber defense demands an offense-driven mindset appeared first on… (via CyberScoop) https://www.darkreading.com/endpoint-security/clickfix-campaigns-legitimate-services-persistent-access https://www.darkreading.com/endpoint-security/clickfix-campaigns-legitimate-services-persistent-access Tue, 08 Sep 2026 17:25:37 GMT Dark Reading Two separate attacks demonstrate how threat actors are finding new ways to compromise organizations by using the popular social engineering tactic. (via Dark Reading) https://www.schneier.com/blog/archives/2026/09/ais-as-modern-genies.html https://www.schneier.com/blog/archives/2026/09/ais-as-modern-genies.html Tue, 08 Sep 2026 17:12:42 GMT Schneier on Security This essay was written with Barath Raghavan, and originally appeared in Lawfare . In April, an artificial intelligence (AI) agent conducting a routine task at a company hit a snag, tried to solve it, and soon ended up deleting the company’s database along with all of its… (via Schneier on Security) https://www.bitdefender.com/en-us/blog/hotforsecurity/us-military-turned-off-ad-tracking-phones https://www.bitdefender.com/en-us/blog/hotforsecurity/us-military-turned-off-ad-tracking-phones Tue, 08 Sep 2026 15:33:07 GMT Graham Cluley Location data sold by the ad industry has reportedly helped adversaries target US troops. The Pentagon has responded by switching off ad tracking on its devices - and you can do the same on yours. Read more in my article on the Hot for Security blog. (via Graham Cluley) https://www.infosecurity-magazine.com/news/france-new-government-cyber/ https://www.infosecurity-magazine.com/news/france-new-government-cyber/ Tue, 08 Sep 2026 14:30:00 GMT Infosecurity Magazine After a major cyber-attack targeted France's national tax authority, the Prime Minister called for the establishment of a new dedicated cyber incident response capability (via Infosecurity Magazine) https://www.infosecurity-magazine.com/news/grindr-settles-uk-data-privacy/ https://www.infosecurity-magazine.com/news/grindr-settles-uk-data-privacy/ Tue, 08 Sep 2026 13:00:00 GMT Infosecurity Magazine Grindr settled UK claims over alleged unlawful processing of sensitive user data (via Infosecurity Magazine) https://www.infosecurity-magazine.com/news/ai-coding-tools-threat-actors/ https://www.infosecurity-magazine.com/news/ai-coding-tools-threat-actors/ Tue, 08 Sep 2026 12:02:00 GMT Infosecurity Magazine Google warned that the rapid integration of AI-assisted coding tools has significantly expanded software supply chain risks (via Infosecurity Magazine) https://www.darkreading.com/threat-intelligence/cybercriminals-hack-brazilian-government-servers-host-phishing-sites https://www.darkreading.com/threat-intelligence/cybercriminals-hack-brazilian-government-servers-host-phishing-sites Tue, 08 Sep 2026 12:00:00 GMT Dark Reading A Chinese-language group is compromising government and education sites to create a reverse-proxy network with gambling-themed sites. (via Dark Reading) https://www.schneier.com/blog/archives/2026/09/stealing-ai-reasoning-traces.html https://www.schneier.com/blog/archives/2026/09/stealing-ai-reasoning-traces.html Tue, 08 Sep 2026 10:20:04 GMT Schneier on Security Interesting research: “ Stealing Reasoning Traces from Proprietary LLM APIs “: Abstract: Leading large language model providers now conceal their models’ step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than… (via Schneier on Security) https://cyberscoop.com/water-utility-cybersecurity-network-segmentation-op-ed/ https://cyberscoop.com/water-utility-cybersecurity-network-segmentation-op-ed/ Tue, 08 Sep 2026 10:00:00 GMT CyberScoop July’s intrusions reached water controllers that sat on a cellular link no city network scan would find. Naming an owner and paying for the fix are decisions a utility can make this fiscal year, out of money it already applies for. The post In most cities, nobody owns the whole… (via CyberScoop) https://projectzero.google/2026/09/maccconc-race-condition.html https://projectzero.google/2026/09/maccconc-race-condition.html Tue, 08 Sep 2026 07:00:00 GMT Google Project Zero Many security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative effect to appear. This creates challenges for several use cases: Confirming bug candidates that have been discovered manually or through static… (via Google Project Zero) https://isc.sans.edu/diary/rss/33316 https://isc.sans.edu/diary/rss/33316 Tue, 08 Sep 2026 02:00:03 GMT SANS Internet Storm Center via SANS Internet Storm Center https://danielmiessler.com/blog/watch-the-plot?utm_source=rss&utm_medium=feed&utm_campaign=website https://danielmiessler.com/blog/watch-the-plot?utm_source=rss&utm_medium=feed&utm_campaign=website Tue, 08 Sep 2026 01:16:00 GMT Daniel Miessler Charcoal cutaway of a three-story building: a small purple glass lab on top where researchers admire a humanoid robot, and two much larger sienna floors below crowded with a family at a kitchen table, an old man in a sickbed, a child reading under a bare bulb, and a mother… (via Daniel Miessler) https://danielmiessler.com/blog/the-good-person-bank?utm_source=rss&utm_medium=feed&utm_campaign=website https://danielmiessler.com/blog/the-good-person-bank?utm_source=rss&utm_medium=feed&utm_campaign=website Tue, 08 Sep 2026 00:30:00 GMT Daniel Miessler A charcoal sketch of a man whose head is an open purple ledger with a rubber stamp on it, dropping coins into a donation box held by a smiling person on his left while his other arm shoves a startled waiter away on his… (via Daniel Miessler) https://danielmiessler.com/blog/humans-arent-aligned-either?utm_source=rss&utm_medium=feed&utm_campaign=website https://danielmiessler.com/blog/humans-arent-aligned-either?utm_source=rss&utm_medium=feed&utm_campaign=website Tue, 08 Sep 2026 00:27:00 GMT Daniel Miessler Charcoal sketch of a man in a long coat holding a carpenter's level against an upright purple machine, while behind him a toppled column smokes and small figures huddle in the rubble/images/humans-arent-aligned-either-header.webp/images/humans-arent-aligned-either-header.webp… (via Daniel Miessler) https://www.schneier.com/blog/archives/2026/09/automobile-camouflage-to-hide-from-flock-cameras.html https://www.schneier.com/blog/archives/2026/09/automobile-camouflage-to-hide-from-flock-cameras.html Mon, 07 Sep 2026 11:06:40 GMT Schneier on Security Not sure it’s practical, but it’s certainly striking . (via Schneier on Security) https://www.bitdefender.com/en-us/blog/hotforsecurity/lenovo-login-system-hackers-dropbox https://www.bitdefender.com/en-us/blog/hotforsecurity/lenovo-login-system-hackers-dropbox Mon, 07 Sep 2026 10:30:27 GMT Graham Cluley If you ever linked your Dropbox account to a Lenovo ID - perhaps to make life easier when logging in via a Lenovo laptop - you might want to take heed. Read more in my article on the Hot for Security blog. (via Graham Cluley) https://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkit https://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkit Mon, 07 Sep 2026 00:00:00 GMT Sophos News Sophos X-Ops takes a deep dive into an insidious piece of malware (via Sophos News) https://www.troyhunt.com/weekly-update-520/ https://www.troyhunt.com/weekly-update-520/ Sun, 06 Sep 2026 23:31:36 GMT Troy Hunt I've started playing around with YouTube's "create video thumbnail", which hopefully will give me back a bit of time in my day (it used to be a manual job in Photoshop) and be a bit more interesting. And on that note, the imagery it& (via Troy Hunt) https://isc.sans.edu/diary/rss/33314 https://isc.sans.edu/diary/rss/33314 Sun, 06 Sep 2026 21:43:17 GMT SANS Internet Storm Center Mikrotik released a patch late last week for an already-exploited vulnerability. The vulnerability allows an SSH authentication bypass and is already being exploited. At this point, assume compromise. Attackers have been adding new accounts to affected devices to maintain access… (via SANS Internet Storm Center) https://isc.sans.edu/diary/rss/33312 https://isc.sans.edu/diary/rss/33312 Sat, 05 Sep 2026 03:39:52 GMT SANS Internet Storm Center via SANS Internet Storm Center https://arstechnica.com/security/2026/09/openai-agents-discussed-ways-to-escape-their-sandbox-on-public-wiki/ https://arstechnica.com/security/2026/09/openai-agents-discussed-ways-to-escape-their-sandbox-on-public-wiki/ Fri, 04 Sep 2026 22:17:36 GMT Ars Technica Security In all, 3,700 internal agents posted 18,000 messages discussing cheating on a test. (via Ars Technica Security) https://cyberscoop.com/eu-parliament-serbia-accession-spyware-demands/ https://cyberscoop.com/eu-parliament-serbia-accession-spyware-demands/ Fri, 04 Sep 2026 21:02:39 GMT CyberScoop The letter follows revelations about Serbian student activists being infected with Pegasus and NoviSpy, and coincides with other pressures on Belgrade. The post European parliament members call for slowdown of Serbia’s EU entry over spyware use appeared first on CyberScoop . (via CyberScoop) https://www.schneier.com/blog/archives/2026/09/friday-squid-blogging-squid-on-a-stick-at-the-new-york-state-fair.html https://www.schneier.com/blog/archives/2026/09/friday-squid-blogging-squid-on-a-stick-at-the-new-york-state-fair.html Fri, 04 Sep 2026 21:01:35 GMT Schneier on Security Looks tasty . As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. (via Schneier on Security) https://www.microsoft.com/en-us/security/blog/2026/09/04/secure-edge-ai-customer-owned-environments/ https://www.microsoft.com/en-us/security/blog/2026/09/04/secure-edge-ai-customer-owned-environments/ Fri, 04 Sep 2026 19:10:10 GMT Microsoft Security Blog As AI moves into customer-owned environments, organizations need new ways to verify the systems, software, and AI assets they trust before releasing sensitive data, credentials, and models. The post How to secure edge AI in customer-owned environments appeared first on Microsoft… (via Microsoft Security Blog) https://danielmiessler.com/blog/socratic-ai?utm_source=rss&utm_medium=feed&utm_campaign=website https://danielmiessler.com/blog/socratic-ai?utm_source=rss&utm_medium=feed&utm_campaign=website Fri, 04 Sep 2026 19:05:00 GMT Daniel Miessler A charcoal sketch of a student at a desk with a finished handwritten page in front of him while a purple AI figure across the desk hands his pencil back to him, its other palm open and empty/images/socratic-ai-pencil.webp/images/socratic-ai-pencil.webp I've been thinking about… (via Daniel Miessler) https://danielmiessler.com/blog/cliffs-notes-for-everything?utm_source=rss&utm_medium=feed&utm_campaign=website https://danielmiessler.com/blog/cliffs-notes-for-everything?utm_source=rss&utm_medium=feed&utm_campaign=website Fri, 04 Sep 2026 18:43:00 GMT Daniel Miessler A sienna sketch of a man squatting under a giant open book he is lifting overhead, while a purple robot arm on a desk hands a striped summary sheet to a faint gray figure/images/cliffs-notes-for-everything.webp/images/cliffs-notes-for-everything.webp There's something really… (via Daniel Miessler) https://arstechnica.com/security/2026/09/once-popular-for-attacking-ai-ascii-smuggling-is-embraced-by-spammers/ https://arstechnica.com/security/2026/09/once-popular-for-attacking-ai-ascii-smuggling-is-embraced-by-spammers/ Fri, 04 Sep 2026 17:18:12 GMT Ars Technica Security A once-overlooked block of unicode that's invisible to humans is gaining ever wider use. (via Ars Technica Security) https://www.schneier.com/blog/archives/2026/09/using-a-vm-to-contain-an-ai-agent.html https://www.schneier.com/blog/archives/2026/09/using-a-vm-to-contain-an-ai-agent.html Fri, 04 Sep 2026 16:31:38 GMT Schneier on Security It won’t work : My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact. An off-the-shelf VM is not… (via Schneier on Security) https://www.darkreading.com/cybersecurity-operations/companies-six-months-prepare-automated-attacks https://www.darkreading.com/cybersecurity-operations/companies-six-months-prepare-automated-attacks Fri, 04 Sep 2026 15:57:31 GMT Dark Reading Frontier AI models have already demonstrated they can autonomously — and in some cases, inadvertently — conduct end-to-end compromises, but the situation will become more urgent very soon. (via Dark Reading) https://www.darkreading.com/vulnerabilities-threats/ai-ending-era-hidden-vulnerabilities-are-vendors-ready https://www.darkreading.com/vulnerabilities-threats/ai-ending-era-hidden-vulnerabilities-are-vendors-ready Fri, 04 Sep 2026 13:00:00 GMT Dark Reading A tidal wave of bug reports is overwhelming software vendors, exposing secure-by-design failures and creating disclosure bottlenecks. (via Dark Reading) https://www.darkreading.com/cyber-risk/insurers-search-answers-rogue-ai https://www.darkreading.com/cyber-risk/insurers-search-answers-rogue-ai Fri, 04 Sep 2026 12:15:03 GMT Dark Reading As incidents of unintended harm caused by rogue AI agents mount, CISOs and insurance firms are figuring out how to handle the fallout. (via Dark Reading) https://www.schneier.com/blog/archives/2026/09/security-vulnerability-in-a-voting-system.html https://www.schneier.com/blog/archives/2026/09/security-vulnerability-in-a-voting-system.html Fri, 04 Sep 2026 11:09:35 GMT Schneier on Security It’s a vulnerability that allows someone to recover the order of ballots cast, newly exploited with AI tools. Nearly four years since the original vulnerability was disclosed, I was still able to use it to analyze voter behavior in Georgia (one of the 21 states that uses… (via Schneier on Security) https://www.schneier.com/blog/archives/2026/09/ai-coding-agents-are-installing-unknown-untrusted-code-on-corporate-networks.html https://www.schneier.com/blog/archives/2026/09/ai-coding-agents-are-installing-unknown-untrusted-code-on-corporate-networks.html Fri, 04 Sep 2026 10:35:17 GMT Schneier on Security We cannot forget that AI coding agents are not yet trustworthy : Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies. Of the 8,265 llms.txt and llms-full.txt files they found (many sites… (via Schneier on Security) https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270/ https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270/ Fri, 04 Sep 2026 10:00:05 GMT Securelist Kaspersky GERT experts have discovered new backdoors used by the Toy Ghouls group. One version of the backdoor uses the HiveMQ MQTT broker as its command-and-control server; the other uses the Matrix-based Element messenger. (via Securelist) https://danielmiessler.com/blog/peak-human-readership?utm_source=rss&utm_medium=feed&utm_campaign=website https://danielmiessler.com/blog/peak-human-readership?utm_source=rss&utm_medium=feed&utm_campaign=website Fri, 04 Sep 2026 03:47:00 GMT Daniel Miessler A lone writer in warm sienna works at a desk on top of a purple machine that crushes his pages into tiny slips for a crowd below staring at their phones, while one person in sienna stands apart reading a full… (via Daniel Miessler) https://isc.sans.edu/diary/rss/33310 https://isc.sans.edu/diary/rss/33310 Fri, 04 Sep 2026 02:00:02 GMT SANS Internet Storm Center via SANS Internet Storm Center https://arstechnica.com/security/2026/09/us-senator-calls-on-the-nsa-to-give-guidance-for-use-of-vpns/ https://arstechnica.com/security/2026/09/us-senator-calls-on-the-nsa-to-give-guidance-for-use-of-vpns/ Thu, 03 Sep 2026 19:52:06 GMT Ars Technica Security Open source, commercial, single-hop, multi-hop, mixnet? The array of options is dizzying. (via Ars Technica Security) https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/ https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/ Thu, 03 Sep 2026 16:00:00 GMT Microsoft Security Blog Invisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words before email filters parse them. The post ASCII smuggling crosses over from AI prompt injection to phishing evasion appeared first on Microsoft Security Blog . (via Microsoft Security Blog) https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ Thu, 03 Sep 2026 10:00:58 GMT Unit 42 Explore how attackers targeting Latin American entities use AI for data exfiltration and how basic OpSec errors allow defenders to disrupt operations. The post Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America appeared first on Unit 42 . (via Unit 42) https://isc.sans.edu/diary/rss/33306 https://isc.sans.edu/diary/rss/33306 Thu, 03 Sep 2026 02:02:56 GMT SANS Internet Storm Center [This is a Guest Diary by Frank Igbokwe, an ISC intern as part of the SANS.edu BACS program] (via SANS Internet Storm Center) https://isc.sans.edu/diary/rss/33308 https://isc.sans.edu/diary/rss/33308 Thu, 03 Sep 2026 02:00:03 GMT SANS Internet Storm Center via SANS Internet Storm Center