Ex-US soldier gets 70 months for role in AT&T, Snowflake data thefts 2026-09-28 at 11:45 By Sinisa Markovic A former U.S. Army soldier who was part of a group that stole data from telecom companies, including AT&T, has been sentenced to 70 months in prison. Cameron John Wagenius, 22, was part of the group that […]
Ex-US soldier gets 70 months for role in AT&T, Snowflake data thefts Read More »
If you do one security check this quarter, make it agent memory 2026-09-28 at 09:00 By Mirko Zorz In this interview with Help Net Security, Chris Latimer, CEO of Vectorize, talks about the security risks hiding in AI agent memory. He found coding agents storing API keys, credentials, and sensitive documents in plain text on […]
If you do one security check this quarter, make it agent memory Read More »
Authorizer: Open-source authentication and authorization for your apps 2026-09-28 at 08:30 By Mirko Zorz Authorizer is an open-source server for sign-in and access control in web and mobile apps. Teams run it on their own infrastructure and keep user accounts in a database they choose. Its maintainers have built a permissions engine and an interface […]
Authorizer: Open-source authentication and authorization for your apps Read More »
Fake payroll desktop apps hand attackers a route to company paychecks 2026-09-25 at 10:52 By Sinisa Markovic An attacker has been offering “desktop apps” for three large US payroll and HR platforms that have never released one, Allure Security have found. Anyone who runs the installer gets a copy of ScreenConnect, a legitimate remote access […]
Fake payroll desktop apps hand attackers a route to company paychecks Read More »
Stop watching what AI agents say and start watching what they do 2026-09-25 at 08:30 By Mirko Zorz In this interview with Help Net Security, Ariel Assaraf, CEO of Coralogix, explains why a system prompt can describe a boundary for an AI agent but cannot enforce one. Assaraf covers how his team builds AI agent […]
Stop watching what AI agents say and start watching what they do Read More »
Half of threat hunters say bad data is their biggest problem 2026-09-25 at 08:00 By Anamarija Pogorelec Half of security professionals name data quality or quantity as their biggest barrier to effective threat hunting, according to the SANS 2026 Threat Hunting Survey. Teams with working playbooks describe the logs as their ceiling, and gaps in […]
Half of threat hunters say bad data is their biggest problem Read More »
OpenAI agent hacking spree widens to Australia, targeting government website 2026-09-24 at 15:53 By Zeljka Zorz Before the Hugging Face and RubyGems hacks, autonomous OpenAI agents attempted to hack into three other websites, including an Australian government public health website, independent research lab Transluce revealed on Wednesday. “Notably, the tasks the agents were trying to […]
OpenAI agent hacking spree widens to Australia, targeting government website Read More »
New Android malware RemControl steals banking PINs and blocks removal attempts 2026-09-24 at 12:40 By Sinisa Markovic A new Android banking trojan called RemControl tricks victims into installing a fake TV app, then takes control of their phones to steal banking PINs, Group-IB has found. Researchers confirmed that the malware targets customers of more than […]
New Android malware RemControl steals banking PINs and blocks removal attempts Read More »
What to do first when you get 90 days to secure AI agent data 2026-09-24 at 08:00 By Mirko Zorz In this interview with Help Net Security, Kelly Herrell, CEO at Nol8, explains where AI agents create exposure inside organizations. The first thing to examine is the data path: what an agent can reach, what […]
What to do first when you get 90 days to secure AI agent data Read More »
Your security program knows about the firewall, but does it know about the elevator? 2026-09-24 at 07:30 By Anamarija Pogorelec By early August, attackers had hit water systems in at least seven U.S. states. The FBI and EPA said the intruders remotely accessed internet-facing programmable logic controllers, the small industrial computers that run pumps and […]
Your security program knows about the firewall, but does it know about the elevator? Read More »
DarkMe RAT trades zero-days for plain phishing emails 2026-09-23 at 16:24 By Zeljka Zorz DarkMe, a remote access trojan and info-stealer that has previously been associated with a threat group that targeted financial market traders and cryptocurrency users, has been spotted again. This time around, its distribution has been simplified: instead of leveraging zero-day exploits, […]
DarkMe RAT trades zero-days for plain phishing emails Read More »
Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances 2026-09-23 at 13:22 By Zeljka Zorz Check Point Software has released emergency fixes for a critical Check Point Management Server vulnerability (CVE-2026-93616) that has been exploited as far back as July 23, 2026. The company also confirmed that a pre-authentication remote code […]
Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes 2026-09-23 at 11:34 By Sinisa Markovic The EvilTokens phishing service, which compromised more than 12,000 inboxes at over 10,000 organizations, has been disrupted by a coalition of law enforcement and private-sector partners led by Microsoft. With authorization from the US District Court for […]
Prismor: Open-source runtime control plane for AI agents 2026-09-23 at 08:30 By Anamarija Pogorelec Prismor is a free, open-source security layer for AI coding agents. It sits between an agent such as Claude Code, Codex, or Cursor and the actions that agent wants to take, and it checks each tool call against a policy before […]
Prismor: Open-source runtime control plane for AI agents Read More »
Product showcase: Scamwise checks the red flags before you take the bait 2026-09-23 at 08:00 By Anamarija Pogorelec Scamwise is a free scam-checking service from Savi that examines suspicious messages, emails, websites, phone numbers, images, and real-world situations for signs of fraud. The service works in any web browser on desktop, mobile, or tablet, with […]
Product showcase: Scamwise checks the red flags before you take the bait Read More »
Researchers uncover malware that uses AI to choose its next move 2026-09-22 at 16:56 By Sinisa Markovic To help security practitioners catch malware that leans on AI, researchers from Cisco Talos shared an open-source framework that they hope will be used to classify and analyze the threat. The tool, called CAIRN, works entirely from metadata […]
Researchers uncover malware that uses AI to choose its next move Read More »
Brief hijack makes Elsevier domains redirect to LAPSUS$ “Chapter II” page 2026-09-22 at 16:46 By Zeljka Zorz Three domains / web portals belonging to Dutch academic publishing company Elsevier have been redirecting users to a page branded “LAPSUS$ GROUP, Chapter II,” carrying a signed statement that taunted the FBI and counted down to a future […]
Brief hijack makes Elsevier domains redirect to LAPSUS$ “Chapter II” page Read More »
The latest deepfake numbers give CISOs plenty to worry about 2026-09-22 at 15:05 By Sinisa Markovic AI is letting cybercriminals reach deeper into organizations than a phishing email ever could. 41% of CISOs reported at least one social engineering incident involving a deepfake during an employee audio call in the past 12 months, according to […]
The latest deepfake numbers give CISOs plenty to worry about Read More »
Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273) 2026-09-22 at 13:42 By Zeljka Zorz A Chinese-speaking threat actor has exploited a vulnerability (CVE-2026-7273) in unpatched ZyXEL GS1900 Smart Managed Switches and has exfiltrated sensitive data from 996 devices across 48 countries, GreyNoise reported on Monday. The affected switches are predominantly located in Italy, the […]
Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273) Read More »
Scammers use genuine Google sign-ins to sell costly, unverified AI subscriptions 2026-09-22 at 11:54 By Sinisa Markovic Scammers are using a $249 website toolkit to sell unverified AI subscriptions worth up to $2,000 a year, and a genuine Google sign-in screen is what makes the sites convincing. Malwarebytes found more than 100 websites built this […]
Scammers use genuine Google sign-ins to sell costly, unverified AI subscriptions Read More »