Don’t miss

FBI job portals remain offline after ShinyHunters claims breach via PeopleSoft zero-day

cybersecurity, Don't miss, extortion, FBI, Hot stuff, News, Oracle /

FBI job portals remain offline after ShinyHunters claims breach via PeopleSoft zero-day 2026-09-28 at 16:56 By Zeljka Zorz The FBI’s online portals for job applicants (at apply.fbijobs.gov) and special agent applicants (at fbijobs.gov/special-agents) are still unavailable, following what appears to be successful compromises by the ShinyHunters cyber extortion group. Last week, the United States’ domestic […]

FBI job portals remain offline after ShinyHunters claims breach via PeopleSoft zero-day Read More »

16-year-old researcher breaks into Microsoft analytics service with access to 17 trillion rows of data

AI, Don't miss, Hot stuff, Microsoft, News, vulnerability disclosure /

16-year-old researcher breaks into Microsoft analytics service with access to 17 trillion rows of data 2026-09-28 at 16:50 By Sinisa Markovic A flaw in Titan, an internal Microsoft analytics service, could have let an attacker read employee records and Bing search analytics, a 16-year-old security researcher has disclosed. The researcher, who goes by Faav, found […]

16-year-old researcher breaks into Microsoft analytics service with access to 17 trillion rows of data Read More »

Other users can watch your browsing and time your keystrokes through OS file notifications

apple, Don't miss, Linux, macOS, News, Privacy, research, Windows /

Other users can watch your browsing and time your keystrokes through OS file notifications 2026-09-28 at 15:14 By Anamarija Pogorelec Researchers at Graz University of Technology have used the file-notification systems in Windows, Linux, and macOS to spy on activity in other accounts. On Windows, a standard unprivileged account detected 95.7 percent of another user’s […]

Other users can watch your browsing and time your keystrokes through OS file notifications Read More »

Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)

CISA, Citrix, Don't miss, Hot stuff, NCSC-NL, NetScaler, News, Tenable /

Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772) 2026-09-28 at 12:51 By Zeljka Zorz Citrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited in zero-day attacks to plant webshells on compromised devices. Rumors about their existence and active exploitation popped […]

Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772) Read More »

Ex-US soldier gets 70 months for role in AT&T, Snowflake data thefts

AT&T, cybercrime, Don't miss, Hot stuff, law enforcement, News, Snowflake, US DoJ, USA /

Ex-US soldier gets 70 months for role in AT&T, Snowflake data thefts 2026-09-28 at 11:45 By Sinisa Markovic A former U.S. Army soldier who was part of a group that stole data from telecom companies, including AT&T, has been sentenced to 70 months in prison. Cameron John Wagenius, 22, was part of the group that […]

Ex-US soldier gets 70 months for role in AT&T, Snowflake data thefts Read More »

If you do one security check this quarter, make it agent memory

agentic AI, CISO, cybersecurity, Don't miss, enterprise, Features, Hot stuff, News, opinion, strategy, tips /

If you do one security check this quarter, make it agent memory 2026-09-28 at 09:00 By Mirko Zorz In this interview with Help Net Security, Chris Latimer, CEO of Vectorize, talks about the security risks hiding in AI agent memory. He found coding agents storing API keys, credentials, and sensitive documents in plain text on […]

If you do one security check this quarter, make it agent memory Read More »

Authorizer: Open-source authentication and authorization for your apps

authentication, cybersecurity, Don't miss, GitHub, News, open source /

Authorizer: Open-source authentication and authorization for your apps 2026-09-28 at 08:30 By Mirko Zorz Authorizer is an open-source server for sign-in and access control in web and mobile apps. Teams run it on their own infrastructure and keep user accounts in a database they choose. Its maintainers have built a permissions engine and an interface […]

Authorizer: Open-source authentication and authorization for your apps Read More »

Fake payroll desktop apps hand attackers a route to company paychecks

Allure Security, cybercrime, Don't miss, Hot stuff, Malware, News /

Fake payroll desktop apps hand attackers a route to company paychecks 2026-09-25 at 10:52 By Sinisa Markovic An attacker has been offering “desktop apps” for three large US payroll and HR platforms that have never released one, Allure Security have found. Anyone who runs the installer gets a copy of ScreenConnect, a legitimate remote access […]

Fake payroll desktop apps hand attackers a route to company paychecks Read More »

Stop watching what AI agents say and start watching what they do

agentic AI, AI, CISO, cybersecurity, Don't miss, Features, Hot stuff, how-to, News, opinion, security telemetry, strategy, tips /

Stop watching what AI agents say and start watching what they do 2026-09-25 at 08:30 By Mirko Zorz In this interview with Help Net Security, Ariel Assaraf, CEO of Coralogix, explains why a system prompt can describe a boundary for an AI agent but cannot enforce one. Assaraf covers how his team builds AI agent […]

Stop watching what AI agents say and start watching what they do Read More »

Half of threat hunters say bad data is their biggest problem

cybersecurity, data, data analysis, Don't miss, News, report, SANS, security operations, security telemetry, SOC, survey, threat hunting /

Half of threat hunters say bad data is their biggest problem 2026-09-25 at 08:00 By Anamarija Pogorelec Half of security professionals name data quality or quantity as their biggest barrier to effective threat hunting, according to the SANS 2026 Threat Hunting Survey. Teams with working playbooks describe the logs as their ceiling, and gaps in […]

Half of threat hunters say bad data is their biggest problem Read More »

OpenAI agent hacking spree widens to Australia, targeting government website

agentic AI, Australia, Don't miss, Government, Hot stuff, intrusion detection, News, OpenAI, Transluce, USA /

OpenAI agent hacking spree widens to Australia, targeting government website 2026-09-24 at 15:53 By Zeljka Zorz Before the Hugging Face and RubyGems hacks, autonomous OpenAI agents attempted to hack into three other websites, including an Australian government public health website, independent research lab Transluce revealed on Wednesday. “Notably, the tasks the agents were trying to […]

OpenAI agent hacking spree widens to Australia, targeting government website Read More »

New Android malware RemControl steals banking PINs and blocks removal attempts

Android, cybercrime, Don't miss, financial industry, Group-IB, Hot stuff, Malware, mobile security, News, online banking /

New Android malware RemControl steals banking PINs and blocks removal attempts 2026-09-24 at 12:40 By Sinisa Markovic A new Android banking trojan called RemControl tricks victims into installing a fake TV app, then takes control of their phones to steal banking PINs, Group-IB has found. Researchers confirmed that the malware targets customers of more than […]

New Android malware RemControl steals banking PINs and blocks removal attempts Read More »

What to do first when you get 90 days to secure AI agent data

agentic AI, cybersecurity, data, Don't miss, Features, Hot stuff, News, opinion, strategy, tips /

What to do first when you get 90 days to secure AI agent data 2026-09-24 at 08:00 By Mirko Zorz In this interview with Help Net Security, Kelly Herrell, CEO at Nol8, explains where AI agents create exposure inside organizations. The first thing to examine is the data path: what an agent can reach, what […]

What to do first when you get 90 days to secure AI agent data Read More »

Your security program knows about the firewall, but does it know about the elevator?

critical infrastructure, cybersecurity, Don't miss, hardware, Honeywell, IIoT, Internet of Things, News, report /

Your security program knows about the firewall, but does it know about the elevator? 2026-09-24 at 07:30 By Anamarija Pogorelec By early August, attackers had hit water systems in at least seven U.S. states. The FBI and EPA said the intruders remotely accessed internet-facing programmable logic controllers, the small industrial computers that run pumps and […]

Your security program knows about the firewall, but does it know about the elevator? Read More »

DarkMe RAT trades zero-days for plain phishing emails

Don't miss, enterprise, Huntress, News, phishing, Remote Access Trojan, social engineering /

DarkMe RAT trades zero-days for plain phishing emails 2026-09-23 at 16:24 By Zeljka Zorz DarkMe, a remote access trojan and info-stealer that has previously been associated with a threat group that targeted financial market traders and cryptocurrency users, has been spotted again. This time around, its distribution has been simplified: instead of leveraging zero-day exploits, […]

DarkMe RAT trades zero-days for plain phishing emails Read More »

Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances

0-day, access management, Arista Networks, Check Point, CISA, CVE, Don't miss, F5 Networks, firewall, Hot stuff, MSP, News, SMBs /

Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances 2026-09-23 at 13:22 By Zeljka Zorz Check Point Software has released emergency fixes for a critical Check Point Management Server vulnerability (CVE-2026-93616) that has been exploited as far back as July 23, 2026. The company also confirmed that a pre-authentication remote code […]

Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances Read More »

Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes

Cloudflare, Coinbase, cybercrime, Don't miss, Hot stuff, law enforcement, Microsoft, Microsoft 365, News, OpenAI, phishing, Shadowserver, SpyCloud /

Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes 2026-09-23 at 11:34 By Sinisa Markovic The EvilTokens phishing service, which compromised more than 12,000 inboxes at over 10,000 organizations, has been disrupted by a coalition of law enforcement and private-sector partners led by Microsoft. With authorization from the US District Court for […]

Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes Read More »

Prismor: Open-source runtime control plane for AI agents

agentic AI, Don't miss, GitHub, News, open source, software /

Prismor: Open-source runtime control plane for AI agents 2026-09-23 at 08:30 By Anamarija Pogorelec Prismor is a free, open-source security layer for AI coding agents. It sits between an agent such as Claude Code, Codex, or Cursor and the actions that agent wants to take, and it checks each tool call against a policy before […]

Prismor: Open-source runtime control plane for AI agents Read More »

Product showcase: Scamwise checks the red flags before you take the bait

Android, cybersecurity, Don't miss, email security, fraud, iOS, News, Product showcase, scams /

Product showcase: Scamwise checks the red flags before you take the bait 2026-09-23 at 08:00 By Anamarija Pogorelec Scamwise is a free scam-checking service from Savi that examines suspicious messages, emails, websites, phone numbers, images, and real-world situations for signs of fraud. The service works in any web browser on desktop, mobile, or tablet, with […]

Product showcase: Scamwise checks the red flags before you take the bait Read More »

Researchers uncover malware that uses AI to choose its next move

AI, Cisco, Don't miss, Hot stuff, Malware, News, open source /

Researchers uncover malware that uses AI to choose its next move 2026-09-22 at 16:56 By Sinisa Markovic To help security practitioners catch malware that leans on AI, researchers from Cisco Talos shared an open-source framework that they hope will be used to classify and analyze the threat. The tool, called CAIRN, works entirely from metadata […]

Researchers uncover malware that uses AI to choose its next move Read More »

Scroll to Top