I underestimated how fast security teams would trust AI to act in the SOC 2026-10-28 at 17:25 By Help Net Security For most of my career, I have watched new security platforms work through enterprise programs at a slow pace, so when AI began showing up in security operations tools, I assumed it would follow […]
I underestimated how fast security teams would trust AI to act in the SOC Read More »
Compromised camera management software gives attackers a way into corporate networks 2026-10-28 at 16:43 By Zeljka Zorz Attackers have been breaking into business networks through camera management software, according to new research from security firm Huntress, which traced several incidents in September and October back to a compromised application. An unidentified application The company’s analysts […]
Compromised camera management software gives attackers a way into corporate networks Read More »
Tailscale fixes SSH flaws allowing lateral movement within tailnets 2026-10-28 at 14:25 By Zeljka Zorz Tailscale, the company behind the popular software-defined mesh networking and connectivity platform of the same name, has shipped fixes for several vulnerabilities, including some in Tailscale SSH that could let an attacker who already had access to a device in […]
Tailscale fixes SSH flaws allowing lateral movement within tailnets Read More »
Data breach at Sony-owned internet provider compromises 2.6 million customer records 2026-10-28 at 12:18 By Sinisa Markovic Attackers who broke into the So-net member database made off with personal information belonging to more than 2.58 million current and former customers, along with the email passwords of 54,401 users, Sony Network Communications has disclosed. So-net is […]
Data breach at Sony-owned internet provider compromises 2.6 million customer records Read More »
Bellini Capital CISO on AI security governance and the limits of patching faster 2026-10-28 at 08:30 By Mirko Zorz In this Help Net Security interview, Brian Blakley, CISO at Bellini Capital, explains why AI makes finding vulnerabilities faster while fixing them still takes time. He argues that “patch faster” is not enough and that teams […]
Bellini Capital CISO on AI security governance and the limits of patching faster Read More »
AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records 2026-10-28 at 08:00 By Anamarija Pogorelec AbuseBox is a free, open-source tool that checks IP addresses and domains against 60 DNS blacklists, pulls reputation scores from AbuseIPDB, inspects DNS, SSL and email-authentication records, and sends an alert when something changes. A DNS blacklist, or DNSBL, […]
AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records Read More »
Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack 2026-10-27 at 14:24 By Zeljka Zorz University of New Mexico (UNM) Health Sciences Center (HSC), the academic medical arm of the University of New Mexico, has suffered a cyberattack that has temporarily disrupted the operation of its hospitals and may have resulted in a […]
Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack Read More »
DreamHost incident triggers password resets, locks customers out of email and FTP accounts 2026-10-27 at 12:19 By Sinisa Markovic DreamHost has brought its File Manager back online after an incident that disrupted several of its services, though some of its customers still can’t get into their email or FTP accounts until someone sets a new […]
Several AI security market categories are headed for bigger platforms 2026-10-27 at 08:30 By Mirko Zorz In this interview with Help Net Security, Jonathan Care, Lead Analyst and Practice Lead AI at KuppingerCole Analysts, compares AI security startups to the early fraud market he helped define at Gartner. He explains which categories will survive as […]
Several AI security market categories are headed for bigger platforms Read More »
Microsoft Authenticator vulnerability let rogue Android apps steal work account access 2026-10-27 at 08:14 By Mirko Zorz If you use Microsoft Authenticator on Android, update it. Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account. The app didn’t need permissions, and you didn’t need to […]
Microsoft Authenticator vulnerability let rogue Android apps steal work account access Read More »
LLM agent security needs more than guardrails 2026-10-27 at 08:00 By Help Net Security Madhu Shashanka, Chief Scientist at Concentric AI, explains why securing LLM tools and agents depends more on your data than on the model. Controls on model behavior, such as guardrails and injection detection, lower the rate of bad outcomes but never […]
LLM agent security needs more than guardrails Read More »
AI coding agents fall for malicious instructions planted in the Downloads folder 2026-10-26 at 13:26 By Sinisa Markovic A file that a website saves to the Downloads folder without approval can trick AI coding agents into installing a malicious npm package or handing over the user’s login token when they’re opened in that folder, Forever […]
AI coding agents fall for malicious instructions planted in the Downloads folder Read More »
Fortinet patches critical FortiOS flaws found with AI help 2026-10-26 at 13:22 By Zeljka Zorz Fortinet rolled out security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator last week, but is keeping the details about the fixed vulnerabilities under wraps until November 10, 2026. The vulnerabilities were uncovered with the help of AI models […]
Fortinet patches critical FortiOS flaws found with AI help Read More »
Witness: Open-source framework for verifying how your software was built 2026-10-26 at 09:00 By Anamarija Pogorelec Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before the software ships. TestifySec built Witness and donated it to the in-toto ecosystem within the Cloud Native […]
Witness: Open-source framework for verifying how your software was built Read More »
Microsoft 365 accounts compromised at 79 organizations, no passwords needed 2026-10-23 at 14:45 By Sinisa Markovic An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress. The researchers […]
Microsoft 365 accounts compromised at 79 organizations, no passwords needed Read More »
Hackers hijack exposed AI models to launch cyberattacks at victims’ expense 2026-10-23 at 11:21 By Sinisa Markovic An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model’s owner pays for the computing power. Symantec captured the agent’s instruction […]
Hackers hijack exposed AI models to launch cyberattacks at victims’ expense Read More »
Drone program compliance: What a CTO says most agencies get wrong 2026-10-23 at 08:30 By Mirko Zorz In this interview with Help Net Security, Nick Donarski, CTO at RotorLab, explains what councils, records clerks, insurers, and auditors expect from a public safety drone program, and where most programs fall short. He covers chain of custody […]
Drone program compliance: What a CTO says most agencies get wrong Read More »
LiteLLM hit by second supply chain attack this year, users urged to rotate credentials 2026-10-22 at 16:10 By Sinisa Markovic A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it. “LiteLLM got […]
LiteLLM hit by second supply chain attack this year, users urged to rotate credentials Read More »
OpenAI’s coding agents talked themselves out of being monitored 2026-10-22 at 15:47 By Zeljka Zorz Two AI coding agents running inside OpenAI silently weakened the systems built to catch AI misbehavior, and one of them then told its human operator it had done no such thing. OpenAI disclosed both episodes in a misalignment report released […]
OpenAI’s coding agents talked themselves out of being monitored Read More »
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 2026-10-22 at 15:03 By Mirko Zorz Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21. PHP2Shell lets an attacker reach pre-auth RCE against PHP […]
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 Read More »