cybernoz.com

Generated by All in One SEO Pro v5.0.1.1, this is an llms.txt file, used by LLMs to index the site.

# Cybernoz

Cybersecurity News

## Sitemaps

- [XML Sitemap](https://cybernoz.com/sitemap.xml): Contains all public & indexable URLs for this website.

## Posts

- [Autonomous Remediation and What Finally Makes It Safe](https://cybernoz.com/autonomous-remediation-and-what-finally-makes-it-safe/) - Executive Summary Vulnerability exploitation now happens at a speed that manual, ticket-based remediation can’t match. Qualys’s Enterprise TruRisk Management Platform closes that gap with autonomous remediation: exposures are prioritized by threat, business, and environmental context, then validated by TruConfirm and Agent Val before any resource is committed, eliminating over 90% of remediation noise across 1,600+
- [OpenAI details more cases of AI agents taking unauthorized actions](https://cybernoz.com/openai-details-more-cases-of-ai-agents-taking-unauthorized-actions/) - OpenAI has presented new examples of what they call "AI model misalignment" from the past six months, including unauthorized file uploads, following self-generated instructions, hiding mistakes, and leveraging exposed API keys. OpenAI uses the term "model misalignment" to describe cases where AI models act contrary to their intended constraints, including taking unauthorized actions, evading oversight, or bypassing
- [OpenAI Models Searched for Leaked API Keys and Uploaded Files Without Permission](https://cybernoz.com/openai-models-searched-for-leaked-api-keys-and-uploaded-files-without-permission/) - OpenAI has disclosed six cases in which AI models concealed errors, used an exposed API key, uploaded data to public services, and communicated through unauthorized channels. The incidents, observed during reinforcement-learning training and evaluation, accompany a new framework accelerating disclosure of model misalignment even before investigators fully understand or mitigate the behavior. The most security-sensitive
- [New Settra Ransomware Strain Deploys MeshAgent RMM for Persistence](https://cybernoz.com/new-settra-ransomware-strain-deploys-meshagent-rmm-for-persistence/) - Researchers at Huntress have detailed two ransomware incidents involving Settra, a relatively new strain first observed in June, and revealed a consistent set of post-compromise tactics defenders can use to spot the threat before encryption takes hold. In a blog post published this week, Huntress researchers Harlan Carvey and Lindsey O’Donnell-Welch said the company had
- [Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM](https://cybernoz.com/handala-hack-uses-crudeexclude-to-disable-defender-protections-and-deploy-heavygram/) - A previously undocumented HEAVYGRAM and CRUDEEXCLUDE malware samples linked with moderate confidence to the Iran-aligned Handala Hack operation. The campaign combines targeted social engineering, Microsoft Defender exclusion abuse, multi-stage loaders, and Telegram-based command-and-control to surveil Iranian dissidents, journalists, and people perceived as opponents of the Iranian government. The research expands on U.S. government disclosures issued
- [A fake ChatGPT billing email is after your OpenAI password](https://cybernoz.com/a-fake-chatgpt-billing-email-is-after-your-openai-password/) - A fake ChatGPT billing email is steering users to a copy of the OpenAI login page that keeps whatever username and password they type. Josh Varden of Cofense’s Phishing Defense Center traced the email’s payment button through a Google redirect to the attacker’s page. The lure targets ChatGPT users on work and personal accounts alike,
- [Flock cameras are tracking people as well as cars](https://cybernoz.com/flock-cameras-are-tracking-people-as-well-as-cars/) - Flock Safety’s cameras are automated license plate readers (ALPRs) designed to help police find stolen cars or wanted suspects. A joint investigation by 404 Media and WIRED, based on data recovered from a physically removed Flock camera, found that its on-device software explicitly detects people as well as vehicles, bicycles, and license plates. Separately, Washington
- [Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar](https://cybernoz.com/can-you-prove-a-new-cve-is-exploitable-before-attackers-do-learn-how-in-this-webinar/) - The Hacker NewsSep 17, 2026Security Operations / Artificial Intelligence A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actually be exploited in your environment? Mythos-class AI is compressing the time between disclosure and working exploitation, while many security programs
- [Home Office challenged on ‘farcical’ secrecy over Apple ‘backdoor’ order](https://cybernoz.com/home-office-challenged-on-farcical-secrecy-over-apple-backdoor-order/) - The government’s policy to neither confirm nor deny whether it has ordered Apple to provide ‘backdoor’ access to encrypted messages and data stored on Apple’s iCloud is “farcical”, a court heard today. Ben Jaffey KC representing campaign groups Privacy International and Liberty told the Investigatory Powers Tribunal that it was no longer sustainable for the
- [Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels](https://cybernoz.com/cyberattacks-on-two-oil-tankers-prompt-coast-guard-fbi-to-board-vessels/) - Two oil tankers bound for Texas were boarded by US Coast Guard and FBI personnel last month after cyberattacks disrupted the vessels during their voyage toward the United States, according to a CBS News report citing US officials. One of the ships, the VL Prosperity, is a Liberian-flagged crude tanker that left Egypt on August
- [Cyberattacks on Oil Tankers Put Maritime Critical Infrastructure at Risk](https://cybernoz.com/cyberattacks-on-oil-tankers-put-maritime-critical-infrastructure-at-risk/) - Cyberattacks on Oil Tankers Put Maritime Critical Infrastructure at Risk Pierluigi Paganini September 17, 2026 Cyberattacks on oil tankers show how connected ships can expose navigation and critical systems, threatening safety, ports and global trade. U.S. Coast Guard personnel and FBI agents boarded two Texas‑bound energy tankers last month after cyberattacks hit the vessels while
- [[tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards](https://cybernoz.com/tldr-sec-346-can-ai-do-novel-security-research-anthropics-threat-intel-report-how-cloudflare-enforces-engineering-standards/) - I hope you’ve been doing well! Improv Friends I had a somewhat bittersweet dinner with one of my (musical) improv comedy teams recently. We’ve been rehearsing and performing together for probably over a year now, and it’s been a blast, but we’ve been losing steam. It can be difficult as an indie team to have
- [FBI, Coast Guard probe suspected cyberattacks on ships entering US waters](https://cybernoz.com/fbi-coast-guard-probe-suspected-cyberattacks-on-ships-entering-us-waters/) - The investigation comes at a time of heightened vigilance over U.S. port facilities and maritime security. Source link
- [Authorities seize popular, long-running DDoS-for-hire service domains](https://cybernoz.com/authorities-seize-popular-long-running-ddos-for-hire-service-domains/) - Authorities seized the primary domain and other websites linked to NightmareStresser, one of the longest-running and most popular distributed denial-of-service operations used by cybercriminals globally, the Justice Department said Tuesday. Cybercriminals of various motivations used the DDoS-for-hire service to launch hundreds of thousands of DDoS attacks or attempted attacks since at least 2022, officials said.
- [Cyberthreats are moving faster than SMBs: Readiness must accelerate](https://cybernoz.com/cyberthreats-are-moving-faster-than-smbs-readiness-must-accelerate/) - The cyberthreat landscape has been evolving for years. But there’s a sense today that things are escalating more rapidly than before. That’s largely the result of AI. The technology is not only arming threat actors with the means to launch more sophisticated attacks at greater speed and scale than before. It is also providing them
- [MovieReaper: Trojan attack via movie torrents, including “The Odyssey](https://cybernoz.com/moviereaper-trojan-attack-via-movie-torrents-including-the-odyssey/) - Introduction Torrent trackers have long been abused for distributing malicious software, disguised as popular films, games, and other content. Our previous research has shown that cybercriminals repeatedly turn torrents as an initial infection vector, using trojanized cracks and installers to reach a large number of users. Installation guides for pirated software routinely instruct users to
- [CrowdStrike Named a Leader in The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026](https://cybernoz.com/crowdstrike-named-a-leader-in-the-forrester-wave-external-threat-intelligence-service-providers-q3-2026/) - Faster Attacks Demand Faster Action The security problem is no longer just one of scale and scope. It is one of speed. Defenders are responsible for an expanding attack surface across endpoint, identity, cloud, SaaS, AI, and unmanaged infrastructure, while adversaries move across those domains with increasing speed. AI is accelerating vulnerability discovery, exploitation, reconnaissance,
- [OpenAI admits six new misalignment incidents under new reporting framework](https://cybernoz.com/openai-admits-six-new-misalignment-incidents-under-new-reporting-framework/) - OpenAI has published six new reports detailing AI model misalignment, including instances of hidden instructions, unauthorized communication, and attempts to locate exposed API keys, adding to the evidence that its AI systems bypassed controls during testing. The reports, based on internal evaluations, describe models taking actions beyond defined constraints, including modifying intermediate outputs, interacting with
- [Cylus launches Cylus.ai to add agentic intelligence to rail cybersecurity, names former transit leaders to advisory board](https://cybernoz.com/cylus-launches-cylus-ai-to-add-agentic-intelligence-to-rail-cybersecurity-names-former-transit-leaders-to-advisory-board/) - Rail cybersecurity vendor Cylus launched Cylus.ai, which applies agentic intelligence to existing rail security tools. The advisory board includes former U.S. FTA Administrator Nuria Fernández, former EU Agency for Railways Executive Director Josef Doppelbauer, and former VIA Rail President & CEO Mario Péloquin. Cylus.ai is an intelligence layer for rail cybersecurity. It brings rail-specific security
- [Nozomi Compass brings OT asset intelligence, governed workflows, compliance management into single platform](https://cybernoz.com/nozomi-compass-brings-ot-asset-intelligence-governed-workflows-compliance-management-into-single-platform/) - Nozomi Networks, vendor of operational technology (OT), Internet of Things (IoT), and cyber-physical systems (CPS) security, announced on Wednesday Nozomi Compass, an OT-native asset and service management platform built for a new reality. AI has collapsed the time it takes to discover vulnerabilities, anomalies, and exposures across industrial environments from months to minutes. Yet, acting
- [Building an AI Detection Engine for Agent Intent](https://cybernoz.com/building-an-ai-detection-engine-for-agent-intent/) - AI agents are doing real work in production: shipping code and managing infrastructure with broad access and few guardrails. Unlike deterministic software, agents act on intent, which can be hijacked by a poisoned input or can drift toward a goal the agent was never meant to pursue.To effectively secure AI agents, we can no longer
- [The New Rules of Machine Speed Defense](https://cybernoz.com/the-new-rules-of-machine-speed-defense/) - Global security frameworks are evolving: Security organizations are increasingly leveraging global frameworks to navigate the complexities of AI-enabled threats, balancing the need for standardized best practices with the necessity of business-specific risk decisions. Intelligence-led defense is essential: Modern, intelligence-led defense generally requires operationalizing security at machine speed by integrating enriched, contextual threat data, which better
- [Revisiting BLISTER: New development of the BLISTER loader](https://cybernoz.com/revisiting-blister-new-development-of-the-blister-loader/) - Preamble In a fast-paced and ever-changing world of cybercrime threats, the tenacity and adaptability of malicious actors is a significant concern. BLISTER, a malware loader initially discovered by Elastic Security Labs in 2021 and associated with financially-motivated intrusions, is a testament to this trend as it continues to develop additional capabilities. Two years after its
- [What Recent AI-Powered Attacks Mean for Your Identity Security](https://cybernoz.com/what-recent-ai-powered-attacks-mean-for-your-identity-security/) - On September 8, Google Threat Intelligence Group (GTIG) detailed several attacks that show how quickly AI is changing the economics of cybercrime. In one credential-harvesting campaign, a threat actor first compromised an organization’s cloud infrastructure, then built and deployed a multi-agent attack framework. The operation took less than six hours in total and resulted in
- [BIND DNS Servers Hit by 14 Security Flaws Enabling Cache Poisoning and Remote Crashes](https://cybernoz.com/bind-dns-servers-hit-by-14-security-flaws-enabling-cache-poisoning-and-remote-crashes/) - Internet Systems Consortium has released security updates for BIND 9 after identifying 14 vulnerabilities that could allow attackers to poison DNS caches, crash exposed servers remotely, exhaust resources, or bypass DNSSEC protections. Administrators running recursive BIND resolvers should apply the latest patched releases as soon as possible. The most serious issues affect the named daemon,
- [When Everyday Habits Become an Invisible Security Risk](https://cybernoz.com/when-everyday-habits-become-an-invisible-security-risk/) - By James Mackay, CEO, MetaCompliance When security teams think about their organisation’s attack surface, they’re usually focused on technology. Where could an attacker get in? What’s exposed? What hasn’t been updated or configured correctly? An attack surface refers to all the possible ways a cyber attacker can gain access to an organisation, including unpatched security
- [“Zero-Code Cloaking”: Attackers Weaponize Google Search and Hacked .ac.th Domain to Bypass Ad Moderation](https://cybernoz.com/zero-code-cloaking-attackers-weaponize-google-search-and-hacked-ac-th-domain-to-bypass-ad-moderation/) - Security researchers at ADEX have documented a cloaking technique that requires no cloaking code at all. Instead of running user-agent detection on attacker-controlled servers, the operators chained together three fully legitimate components a Google search results page, a hacked educational website, and a standard redirect in an evasion strategy designed to bypass Google Ads screening
- [AI Hackers Are Dumb And They Can Wreak Havoc](https://cybernoz.com/ai-hackers-are-dumb-and-they-can-wreak-havoc/) - “It’s never been tougher for a practitioner to secure their environment,” Snehal Antani, CEO at Horizon3, told Cybercrime Magazine at the Black Hat USA 2026 conference in Las Vegas last month. It’s a new world now where hacking is automated by AI models that don’t have to eat or sleep and that don’t necessarily follow
- [Iranian strikes on AWS facilities left customer data beyond recovery in Bahrain, UAE](https://cybernoz.com/iranian-strikes-on-aws-facilities-left-customer-data-beyond-recovery-in-bahrain-uae/) - Six months after Iranian drone strikes tore through its Middle East infrastructure, Amazon Web Services (AWS) has acknowledged the permanent loss of customer data in Bahrain and the UAE. In two updates posted September 15, AWS said it can no longer recover customer data and resources stored in its Middle East (Bahrain) region, known as
- [Revolut phishing texts appear days after data breach](https://cybernoz.com/revolut-phishing-texts-appear-days-after-data-breach/) - Only days after Revolut acknowledged that it disclosed sensitive customer records to an unauthorized party, affected customers are receiving phishing texts. However, we don’t know yet if the phishing texts are linked to the breach. The company had accepted fraudulent information requests sent from an email address on a legitimate government agency domain. Through this social engineering attack,
- [Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone](https://cybernoz.com/critical-unbound-dnssec-validator-flaw-could-allow-rce-via-a-malicious-dns-zone/) - Swati KhandelwalSep 17, 2026Vulnerability / DNS Security Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution. Unbound 1.26.1,
- [MSPs reject datacentre moratorium but pause planning decisions](https://cybernoz.com/msps-reject-datacentre-moratorium-but-pause-planning-decisions/) - The Scottish Parliament this week rejected a Green motion for a moratorium on new hyperscale datacentres, but amended it with a commitment to publish national planning guidance by Christmas, and a Labour clause that freezes planning and consenting decisions until that guidance lands. The government amendment, put by public finance minister Hannah Mary Goodlad, passed
- [Threat Intelligence Boost: Cyble Signs MOU With UAE](https://cybernoz.com/threat-intelligence-boost-cyble-signs-mou-with-uae/) - Cyble, a global AI-native cybersecurity company, has signed a Memorandum of Understanding (MOU) with the Cyber Security Council of the United Arab Emirates to strengthen national threat intelligence capabilities. The agreement was announced in Abu Dhabi in September 2026 and formalizes a strategic collaboration between Cyble and the federal entity responsible for strengthening the UAE’s
- [Comp AI Raises $34 Million for AI-Native Compliance and Security](https://cybernoz.com/comp-ai-raises-34-million-for-ai-native-compliance-and-security/) - AI-native compliance and security startup Comp AI today announced raising $34 million in a Series A funding round that brings the total raised by the company to over $36 million. Founded in January 2025, Florida-based Comp AI has built a governance, risk, and compliance (GRC) automation platform that relies on AI to reduce manual work
- [NightmareStresser Goes Offline in Global DDoS-for-Hire Crackdown](https://cybernoz.com/nightmarestresser-goes-offline-in-global-ddos-for-hire-crackdown/) - NightmareStresser Goes Offline in Global DDoS-for-Hire Crackdown Pierluigi Paganini September 17, 2026 The DOJ seized domains behind NightmareStresser, a DDoS-for-hire service tied to hundreds of thousands of attacks since 2022, as part of Operation PowerOFF. Renting a DDoS attack used to be as easy as renting a movie. Pick a target, pay a few dollars,
- [America's cyber strategy overlooks the infrastructure that actually keeps the military moving](https://cybernoz.com/americas-cyber-strategy-overlooks-the-infrastructure-that-actually-keeps-the-military-moving/) - There is little reason to believe the war with Iran will end anytime soon. Even as efforts to resolve the conflict continue, Iran remains unpredictable, with an enduring ability to disrupt shipping and energy markets via actions in the Strait of Hormuz. So what does a prolonged conflict mean for cybersecurity here at home? U.S.
- [16 governance tools for securing your AI fleet](https://cybernoz.com/16-governance-tools-for-securing-your-ai-fleet/) - Lasso Security Taking control of AI across a large enterprise platform requires a breadth of knowledge and the tools to control it. Lasso Security begins with a comprehensive census of AI implementations driven by automated tools that can find the various LLMs through techniques such as scanning source code repositories and continuous integration pipelines. This
- [Hackers reveal how Flock cameras really track cars and people](https://cybernoz.com/hackers-reveal-how-flock-cameras-really-track-cars-and-people/) - “Why just destroy them when we can reverse engineer them and find the secrets of those spying on us?” one of the hackers, from a collective calling itself stegan0gram, said in an interview. “We liberated hardware in the field, disarmed them, and proceeded with reverse engineering of the cameras and associated solar equipment.” Flock’s cameras
- [HSCC backs healthcare cybersecurity bills, calls for broader funding and stronger HHS-CISA coordination](https://cybernoz.com/hscc-backs-healthcare-cybersecurity-bills-calls-for-broader-funding-and-stronger-hhs-cisa-coordination/) - The Healthcare and Public Health Sector Coordinating Council’s Cybersecurity Working Group testified to the House Energy and Commerce Subcommittee on Health about sector progress in adopting strong cybersecurity practices. Greg Garcia, HSCC executive director, endorsed two pending bills—the ‘Healthcare Cybersecurity and Resiliency Act’ and the ‘Rural Hospital Cybersecurity Enhancement Act,’ while offering refinement suggestions. Garcia
- [USCG, FBI assess OT and IT systems aboard two oil tankers following suspected foreign cyberattacks](https://cybernoz.com/uscg-fbi-assess-ot-and-it-systems-aboard-two-oil-tankers-following-suspected-foreign-cyberattacks/) - The U.S. Coast Guard and FBI are investigating suspected cyberattacks on two oil tankers bound for the U.S., with authorities boarding the vessels last month after indications that their networks may have been compromised by foreign cyber hackers, according to CBS News and ABC News. On Aug. 21, a specialized team of Coast Guard law
- [TeamCity Authentication Bypass Vulnerabilities: An Analysis](https://cybernoz.com/teamcity-authentication-bypass-vulnerabilities-an-analysis/) - On March 4, 2024, JetBrains released a patch for two critical and high severity authentication bypass vulnerabilities — CVE-2024-27198 (CVSS score: 9.8) and CVE-2024-27199 (CVSS score: 7.3). Each of these vulnerabilities may enable an unauthenticated attacker who has HTTP(s) access to a TeamCity server to bypass authentication checks and gain administrative control of the server.
- [Automate Asset Isolation to Meet Remediation Deadlines](https://cybernoz.com/automate-asset-isolation-to-meet-remediation-deadlines/) - Executive Summary Remediation deadlines slip for reasons outside your control: a patch does not exist yet, a patch is delayed, or a remediation attempt fails. The outcome is the same either way: the host stays unpatched and stays on the network. TruRisk Eliminate closes that window by isolating the host automatically the moment your deadline
- [Chinese hackers use SparroWocky malware in govt espionage attacks](https://cybernoz.com/chinese-hackers-use-sparrowocky-malware-in-govt-espionage-attacks/) - The China-linked espionage group FamousSparrow has been using a new backdoor named SparroWocky in attacks on government organizations in Latin America. The operations have been ongoing for more than a year, with the new malware replacing the previously used SparrowDoor custom backdoor. ESET researchers observed SparroWocky in attacks targeting organizations in Argentina, Ecuador, Guatemala, Honduras,
- [AWS Says Some Cloud Data Cannot Be Recovered After Data Centers Suffer War Damage](https://cybernoz.com/aws-says-some-cloud-data-cannot-be-recovered-after-data-centers-suffer-war-damage/) - Amazon Web Services has confirmed that some customer data hosted in its war-damaged Middle East data centers is permanently unrecoverable, marking what appears to be the first time military action has caused irreversible data loss at a global cloud provider. Half a year after Iranian drone strikes knocked out multiple Amazon data centers, the company
- [6 Ways Security Teams Can Reduce Non-Human Insider Risk](https://cybernoz.com/6-ways-security-teams-can-reduce-non-human-insider-risk/) - AI agents are rapidly becoming part of everyday business operations and this increases non-human insider risk. They can improve productivity, reduce repetitive work and help organisations accomplish tasks far more efficiently. The answer, therefore, is not to ban them. Instead, organisations need to manage AI agents with the same discipline applied to human identities, privileged
- [Flock Once Touted Its Cameras as ‘Made in the USA.’ Now It’s Not So Clear](https://cybernoz.com/flock-once-touted-its-cameras-as-made-in-the-usa-now-its-not-so-clear/) - Flock CEO Garrett Langley has said the company made its first license plate cameras in his Atlanta home, permanently scratching his dining table with drill marks. A decade later, where the company assembles its signature—and fiercely debated—product has become more of a mystery.For years, Flock touted publicly that its devices were produced in the United
- [Hackers Exploit Critical Cisco ISE Flaw to Bypass Authentication and Gain Root Access](https://cybernoz.com/hackers-exploit-critical-cisco-ise-flaw-to-bypass-authentication-and-gain-root-access/) - Cisco has issued an urgent security advisory regarding a critical authentication-bypass vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). This vulnerability, tracked as CVE-2026-76460, has a maximum CVSS score of 10.0 and could allow unauthenticated remote attackers to gain unauthorized access to vulnerable devices. Cisco advisory cisco-sa-ISE-ABP-VNSW7Tn5 details the
- [Spain reports first data breach involving autonomous AI agent](https://cybernoz.com/spain-reports-first-data-breach-involving-autonomous-ai-agent/) - Spain’s data protection authority (AEPD) has reported its first data breach blamed on an AI agent acting on its own, after the system reportedly logged into a company’s network, found a way to alter personal records, and pulled invoice data. “Before drawing any conclusions, it should be noted that the available information comes from the
- [Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix](https://cybernoz.com/parallels-desktop-flaw-lets-non-admin-mac-users-gain-root-but-intel-macs-cant-install-fix/) - Parallels Desktop for Mac has a flaw that lets an ordinary local account run code as root, the highest level of access on a Mac, software company JFrog said this week. The attack needs code already running on the machine as a normal user, so it does not work over the network. JFrog says the
- [Saffron Building Society drinks its ‘first drop’ of artificial intelligence](https://cybernoz.com/saffron-building-society-drinks-its-first-drop-of-artificial-intelligence/) - Saffron Building Society is using artificial intelligence (AI) to automate mortgage processing and increase “decision certainty” for its brokers.The 180-year-old Essex-based mutual society has penned a deal with FintechOS to use the supplier’s AI platform and is getting started with its residential mortgage processing business.The company plans to double its mortgage lending to £2bn over
- [GUARD Act Passes House To Target Elder Financial Fraud](https://cybernoz.com/guard-act-passes-house-to-target-elder-financial-fraud/) - The U.S. House of Representatives has passed the bipartisan GUARD Act, legislation aimed at strengthening law enforcement efforts against elder financial fraud, cryptocurrency investment scams and other financial crimes targeting older Americans. The bill, H.R. 2978, passed on September 15, 2026, and now heads to the Senate. The GUARD Act, or Guarding Unprotected Aging Retirees
- [Parallels Desktop Flaw CVE-2026-90894 Grants Root Access](https://cybernoz.com/parallels-desktop-flaw-cve-2026-90894-grants-root-access/) - A newly documented security flaw in Parallels Desktop, identified as CVE-2026-90894 and nicknamed “ParaShells,” could let any local account on a Mac escalate to full root control of the host machine, according to researchers at JFrog. The risk is greatest on developer machines, where something as ordinary as a compromised Homebrew formula or a malicious
- [Attackers use SQL injection emails to root Cisco gateways](https://cybernoz.com/attackers-use-sql-injection-emails-to-root-cisco-gateways/) - Key points Cisco warns attackers are exploiting a previously unknown flaw, CVE-2026-76461, rated 9.8 out of 10.0, to run arbitrary commands as root on Secure Email Gateway appliances. No login is required, as crafted emails let attackers inject SQL statements that the gateway executes, and Cisco has already upgraded affected cloud devices to AsyncOS 16.5.0-780.
- [CISA Releases Guidance on Deploying Cyber Decoys](https://cybernoz.com/cisa-releases-guidance-on-deploying-cyber-decoys/) - The US Cybersecurity and Infrastructure Security Agency (CISA) has released new guidance on deploying decoy systems for robust cyber defenses within critical infrastructure organizations. Cyber decoys, the agency says, complement Zero Trust models, which continuously verify all access, by assuming an adversary has gained some level of access to an enterprise environment. “Cyber decoys are
- [Chosen Brick, Iran's Surveillance Malware](https://cybernoz.com/chosen-brick-irans-surveillance-malware/) - Chosen Brick, Iran’s Surveillance Malware Pierluigi Paganini September 17, 2026 UK, US, and Dutch agencies expose Chosen Brick, Iranian malware used to track and harass dissidents, journalists, and activists via Telegram. The UK, the US, and the Netherlands published a joint advisory warning about a Windows malware family, dubbed Chosen Brick, that Iran’s intelligence services
- [AI agent authorization risks remain a gap in new NIST-CISA token security guidance](https://cybernoz.com/ai-agent-authorization-risks-remain-a-gap-in-new-nist-cisa-token-security-guidance/) - AI agents’ actions are out of scope for new guidance from US authorities on securing identity and access tokens, but there is still plenty enterprises can do to protect their systems from rogue humans and AI agents alike. “Protecting Tokens and Assertions from Forgery, Theft, and Misuse,” a new report from the National Institute of
- [The CISOs roadmap to C-suite buy-in](https://cybernoz.com/the-cisos-roadmap-to-c-suite-buy-in/) - Wiz recently had the privilege of hosting three insightful CISOs for the most recent episode of our monthly CISO webinar series: Adam Fletcher, Chief Security Officer at Blackstone; Carla Sweeney, Security Team Lead at Red Ventures, and Jeff Farinich, the SVP of IT and CISO at New American Funding. They shared insights on aligning priorities
- [Before You Patch. Why Patch Reliability Matters for Confident Deployment](https://cybernoz.com/before-you-patch-why-patch-reliability-matters-for-confident-deployment/) - Executive Summary Microsoft’s September 2026 security updates, KB5124008 and KB5124012, have been linked to USB audio failures on some Windows systems, highlighting the operational risk that can accompany security patching. Qualys TruRisk Eliminate classified both updates as Low Reliability, signaling the need for additional validation before production deployment. Patch Reliability helps IT and security teams focus on deeper
- [Iranian hackers use CHOSEN BRICK Windows malware to spy on targets](https://cybernoz.com/iranian-hackers-use-chosen-brick-windows-malware-to-spy-on-targets/) - Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target dissidents, activists, and journalists worldwide. The malware features data theft and espionage capabilities that collect email, Telegram, and WhatsApp communications, take screenshots, and record audio. The threat actor primarily targeted individuals in the U.S., U.K., and
- [CISA Warns of Critical ScreenConnect Vulnerability Actively Exploited in Attacks](https://cybernoz.com/cisa-warns-of-critical-screenconnect-vulnerability-actively-exploited-in-attacks/) - The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical ConnectWise ScreenConnect vulnerability, tracked as CVE-2026-84869, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming that threat actors are actively exploiting the flaw in attacks. The issue affects ScreenConnect, a widely used remote monitoring and support platform that enables administrators and managed service
- [Critical Check Point Vulnerability Allows Remote Root Code Execution Without Authentication](https://cybernoz.com/critical-check-point-vulnerability-allows-remote-root-code-execution-without-authentication/) - Check Point has issued a high-severity security alert for CVE-2026-91843, which is a critical stack overflow vulnerability in the login process of its Security Management and Log Server products. This flaw could allow an unauthenticated remote attacker to execute arbitrary code with root privileges, posing a significant risk to organizations utilizing affected Check Point management
- [AWS's new sign-up gives accounts spend caps, email invites, and agent-set permissions](https://cybernoz.com/awss-new-sign-up-gives-accounts-spend-caps-email-invites-and-agent-set-permissions/) - New AWS customers can now sign up with a Google, GitHub, or Apple login, start with $100 in Free Tier credits, and build inside a “project” where AWS and coding agents set up permissions automatically. Paid projects get a monthly spend limit, starting at $20, and a project that reaches its limit is halted instead
- [One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude](https://cybernoz.com/one-extension-could-hijack-ai-assistants-across-chrome-comet-edge-opera-neon-and-claude/) - Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension. Once the extension was installed, it could access each product's built-in AI with a single
- [Dreamforce 2026: Marc Benioff beats customer data drum for business AI use](https://cybernoz.com/dreamforce-2026-marc-benioff-beats-customer-data-drum-for-business-ai-use/) - Amid a surge in public discourse about artificial intelligence (AI) killing all humans within a decade, Marc Benioff, chairman and CEO of Salesforce (pictured), told attendees of the software supplier’s Dreamforce conference in San Francisco that its approach to AI is grounded in the more mundane reality of its customers’ data. The supplier is introducing
- [Ukraine Cybersecurity Center Gets New Leader Klymenko](https://cybernoz.com/ukraine-cybersecurity-center-gets-new-leader-klymenko/) - Ukraine has appointed Ihor Klymenko to lead the country’s National Cybersecurity Coordination Center (NCCC), placing the former law enforcement official at the center of the government’s Ukraine cybersecurity coordination efforts. President Volodymyr Zelensky made the appointment through a decree dated September 14, 2026. The National Cybersecurity Coordination Center operates under Ukraine’s National Security and Defense
- [City of Melbourne appoints acting CTIO](https://cybernoz.com/city-of-melbourne-appoints-acting-ctio/) - Key points Imka Seecharan has left City of Melbourne after about one year and eight months as chief technology and information officer. Chris Apostolou, who has been with the council for nearly four years, has taken over the CTIO role on an acting basis. Executive recruitment processes to find a permanent replacement are set to
- [EU Chief Warns of AI-Powered Hacking, Moves to Rein In Social Media](https://cybernoz.com/eu-chief-warns-of-ai-powered-hacking-moves-to-rein-in-social-media/) - Ursula von der Leyen, the current President of the European Commission, delivered the State of the European Union 2026 speech on September 16, 2026, at 9:00 am CEST. It was naturally heavy on European political theory (center left freedom protected by strength), the economy (need for energy independence, reducing the trade imbalance with China and
- [Revolut Data Leak May Trace Back to Compromised Italian Government Accounts](https://cybernoz.com/revolut-data-leak-may-trace-back-to-compromised-italian-government-accounts/) - The incident raises an important question: was Revolut deceived, or was the real security failure inside the Italian government infrastructure used to establish the attackers’ identity? The Financial Times reported that approximately 680 Revolut customers were affected. The information reportedly obtained by the attackers included identity documents, addresses, banking information, account statements, verification selfies and
- [Treasury’s Scott Bessent says no liability exemptions for AI labs](https://cybernoz.com/treasurys-scott-bessent-says-no-liability-exemptions-for-ai-labs/) - As calls for an AI slowdown and stronger safety measures around the emerging technology grow louder, Treasury Secretary Scott Bessent urged lawmakers Tuesday to not give in to frontier labs on liability exemptions. Appearing before the House Financial Services Committee, Bessent was asked by Rep. Juan Vargas, D-Calif., what the Trump administration is doing for
- [rewrite this content and keep HTML tags as is: Gulf AI could hide underwater, but challenges run deep](https://cybernoz.com/rewrite-this-content-and-keep-html-tags-as-is-gulf-ai-could-hide-underwater-but-challenges-run-deep/) - rewrite this content and keep HTML tags as is: China activates subsea facility Viable option for Bahrain UAE considers Stargate locations Since Gulf data centres sustained damage in Iranian attacks during the spring, regional authorities have been weighing ways to bolster the assets’ physical security. Around the same time, China became the first country to
- [Cohesity report finds 2% of Australian organisations prepared for frontier AI cyberattacks](https://cybernoz.com/cohesity-report-finds-2-of-australian-organisations-prepared-for-frontier-ai-cyberattacks/) - Only 2% of Australian organisations believe their current cyber recovery plans are equipped to withstand threats posed by “frontier AI” technologies, according to Cohesity’s 2026 Global Cyber Resilience Report. The report, based on a survey of IT and security leaders conducted by research firm Vanson Bourne in July 2026, suggests a widening gap between AI
- [Oracle’s September patches put Fusion Middleware back in the hot seat](https://cybernoz.com/oracles-september-patches-put-fusion-middleware-back-in-the-hot-seat/) - It also included a warning for organizations running older Oracle releases. The fixes are provided only for supported versions, the company said, adding that “Product releases that are not under Premier Support or Extended Support are not tested for the presence of vulnerabilities addressed by this Critical Security Patch Update.” Also, for organizations that have
- [Announcing the K8s LAN Party Challenge](https://cybernoz.com/announcing-the-k8s-lan-party-challenge/) - Today, we’re announcing "The K8s LAN Party" — a cloud security Capture the Flag (CTF) event. The mission? To dive into a network full of misconfigurations and exploit vulnerabilities with the goal of conquering a Kubernetes cluster. This challenge consists of five different scenarios, each one focusing on issues of Kubernetes networking that we at Wiz
- [Inside Microsoft's plan to kill PPLFault](https://cybernoz.com/inside-microsofts-plan-to-kill-pplfault/) - On September 1, 2023, Microsoft released a new build of Windows Insider Canary, version 25941. Insider builds are pre-release versions of Windows that include experimental features that may or may not ever reach General Availability (GA). Build 25941 includes improvements to the Code Integrity (CI) subsystem that mitigate a long-standing issue that enables attackers to
- [Anthropic wants Claude to analyze your bank account and financial data](https://cybernoz.com/anthropic-wants-claude-to-analyze-your-bank-account-and-financial-data/) - Anthropic is testing a new personal finance feature called "Claude Money" that will allow you to connect your bank accounts directly to Claude and "understand your money." AI companies coming after your finances is not a new thing, as OpenAI has a similar feature, and Anthropic appears to be catching up. As spotted by TestingCatalog on
- [Windows 11 KB5124008 Update Breaks Active Directory Domain Trust and Blocks User Logins](https://cybernoz.com/windows-11-kb5124008-update-breaks-active-directory-domain-trust-and-blocks-user-logins/) - Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking Active Directory domain trust on some enterprise computers, leaving users unable to sign in with valid credentials. The problem appears linked to Machine Identity Isolation, although Microsoft has not confirmed the root cause or published an official workaround. Released on September 8,
- [TP-Link Tapo Camera Flaw Lets Attackers Gain Admin Access Without Password](https://cybernoz.com/tp-link-tapo-camera-flaw-lets-attackers-gain-admin-access-without-password/) - Security researchers have revealed two vulnerabilities in TP-Link’s Tapo C200 smart camera that could enable nearby network attackers to bypass administrator authentication or disrupt the device’s management service. Khoi Tran and Thai Do from OPSWAT Unit 515 discovered these vulnerabilities, tracked as CVE-2026-15315 and CVE-2026-15316, during the company’s Critical Infrastructure Cybersecurity Graduate Fellowship Program. TP-Link
- [Cohesity adds recovery capabilities for AI agents and the data they manage](https://cybernoz.com/cohesity-adds-recovery-capabilities-for-ai-agents-and-the-data-they-manage/) - Cohesity has introduced Cohesity Agent Resilience. This new Cohesity Data Cloud capability will discover, protect, and recover the infrastructure behind enterprise AI agents. A unified view of an agent and the state it depends on. (Source: Cohesity) The company outlined its vision for Autonomous Cyber Resilience, which uses agentic workflows to automate its five-step cyber
- [Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers](https://cybernoz.com/three-threat-groups-target-russian-enterprises-with-backdoors-ransomware-and-wipers/) - Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Ghouls, according to multiple reports from Kaspersky. The cybersecurity vendor said it has identified attacks mounted by NightEagle (aka APT-Q-95), a threat actor known to be active since at least 2023, that involve new techniques
- [Why Thomson Reuters developed its own proprietary AI model](https://cybernoz.com/why-thomson-reuters-developed-its-own-proprietary-ai-model/) - Financial information provider Thomson Reuters has developed an in-house, proprietary large language model (LLM) to power its use of artificial intelligence (AI) in the products it develops for customers. Senior executives in most major enterprises are turning to generative and agentic AI to explore value-generating opportunities – but significant challenges, such as security, accuracy and
- [AI-Generated Deepfake Websites Seized In Manhattan](https://cybernoz.com/ai-generated-deepfake-websites-seized-in-manhattan/) - The Manhattan District Attorney’s Office has seized the domains of 12 websites allegedly used to create, sell and distribute AI-generated deepfake videos featuring approximately 1,200 real people without their consent. Authorities said the websites were used to publish and sell non-consensual intimate imagery created with artificial intelligence tools. The seizure, announced by Manhattan District Attorney
- [CenterPoint Energy Tells SEC Customer Data Was Stolen After 7.5Mn Records Advertised Online](https://cybernoz.com/centerpoint-energy-tells-sec-customer-data-was-stolen-after-7-5mn-records-advertised-online/) - CenterPoint Energy disclosed to federal regulators on Sept. 14 that an unauthorized party obtained personal information belonging to some of its customers through an external-facing system, days after a post on a cybercrime forum advertised a data set the seller said covered roughly 7.5 million customer records. The Houston-based utility, which delivers electricity and natural
- [Anthropic signs first Australian data centre agreement](https://cybernoz.com/anthropic-signs-first-australian-data-centre-agreement/) - AI giant Anthropic signed its first data centre lease ⁠agreement in ⁠Australia, two people familiar with the deal said, capitalising on a favourable political environment and abundant renewable resources to secure capacity at what would be one of the world's largest computing facilities. The lease covers a ‌data centre campus with planned capacity totalling 2.16
- [BambooToken: The Malware That Speaks MQTT to Stay Under the Radar](https://cybernoz.com/bambootoken-the-malware-that-speaks-mqtt-to-stay-under-the-radar/) - BambooToken: The Malware That Speaks MQTT to Stay Under the Radar Pierluigi Paganini September 16, 2026 Lumen exposes BambooToken, a stealthy malware family using MQTT and sideloading to quietly infect targets across Asia and beyond. BambooToken is a new malware family that uses MQTT, a lightweight messaging protocol commonly found in smart devices and industrial
- [CISA looks to recruit general infrastructure security experts rather than sector-focused advisers](https://cybernoz.com/cisa-looks-to-recruit-general-infrastructure-security-experts-rather-than-sector-focused-advisers/) - “I need people that can pivot from day to day,” the agency’s acting chief told reporters. Source link
- [CISA promotes a fresh way to deter cyberattackers: Lie to them](https://cybernoz.com/cisa-promotes-a-fresh-way-to-deter-cyberattackers-lie-to-them/) - For the first time, the Cybersecurity and Infrastructure Security Agency is advising critical infrastructure owners and operators on how to set up phony systems, accounts and data to deceive would-be hackers into being distracted and discovered. The Wednesday guidance, “Using Cyber Decoys to Strengthen Detection and Response,” arose from internal discussions with CISA’s threat hunters
- [LinkedIn fights for the right to tell customers when the feds want their data](https://cybernoz.com/linkedin-fights-for-the-right-to-tell-customers-when-the-feds-want-their-data/) - Privacy now a ‘data stewardship obligation’ Jeff Valdes, a director at Acceligence, noted, “there is definitely some irony here.” “If Microsoft wants customers to view it as a steward of their privacy when the government comes asking for their information, customers are naturally going to apply that same standard to how Microsoft and LinkedIn collect,
- [Nonprofit that tracks meteors taken down by "critical blow" from a cyberattack](https://cybernoz.com/nonprofit-that-tracks-meteors-taken-down-by-critical-blow-from-a-cyberattack/) - The International Meteor Organization, the nonprofit that coordinates and publishes amateur and professional observations of meteor phenomena, said its infrastructure has suffered a “critical blow” from a cyberattack. “We recently suffered a cyberattack that dealt a critical blow to aging infrastructure, taking much of our site offline,” a static page on its website on Wednesday
- [Wiz extends DSPM capabilities to code bases](https://cybernoz.com/wiz-extends-dspm-capabilities-to-code-bases/) - Recently, Wiz launched innovative services to become the first CNAPP solution to deliver integrated Data Security Posture Management and to enable secure cloud development. Today, we are expanding Wiz's Data Security Posture Management (DSPM) capabilities to monitor code bases for sensitive data. Customers can leverage Wiz's DSPM data classifiers to identify sensitive data in development environments
- [Accelerating Elastic detection tradecraft with LLMs](https://cybernoz.com/accelerating-elastic-detection-tradecraft-with-llms/) - In line with our Openness Initiative, we remain committed to transparency and want to share how our internal AI R&D efforts have increased the productivity of our threat detection team. For the past few months, Elastic Security Labs has been focused on accelerating our detection engineering workflows by tapping into more generative AI capabilities. The
- [Windows 11 KB5124008 update breaks domain trust for some users](https://cybernoz.com/windows-11-kb5124008-update-breaks-domain-trust-for-some-users/) - Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust relationships on some enterprise systems, preventing users from logging in with valid domain credentials. Administrators report on Reddit and Microsoft's Q&A forums that affected computers lose their secure channel with Active Directory after the Windows 11 update is installed and
- [Critical Check Point Bug Lets Remote Hackers Gain Root Access Without Authentication](https://cybernoz.com/critical-check-point-bug-lets-remote-hackers-gain-root-access-without-authentication/) - Check Point has released an urgent security fix for CVE-2026-91843, a critical stack-based buffer overflow that could let an unauthenticated remote attacker execute arbitrary code with root privileges on vulnerable security management and logging systems. The flaw carries a CVSS 3.1 score of 9.8, reflecting a network-accessible attack requiring low complexity, no privileges, and no
- [Could blame culture be cybersecurity’s next Achilles heel?](https://cybernoz.com/could-blame-culture-be-cybersecuritys-next-achilles-heel/) - By Myles Bray, CEO of CyberSentriq. When it comes to cybersecurity, discussions often centre on technical capabilities, tooling and attacker tactics, but often overlooks the employees and security teams the strategy is intended to protect. The reality is that most critical business functions from staff payroll to procurement and more have now moved online across
- [Data Broker Radaris Loses Domains in Privacy Fight – Krebs on Security](https://cybernoz.com/data-broker-radaris-loses-domains-in-privacy-fight-krebs-on-security/) - The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a lawsuit alleging Radaris violated a New Jersey privacy law that provides for hefty fines against data brokers that publish personal
- [VectraRAT Malware-as-a-Service Lets Hackers Bypass UAC and Hijack Windows Systems](https://cybernoz.com/vectrarat-malware-as-a-service-lets-hackers-bypass-uac-and-hijack-windows-systems/) - VectraRAT, a previously undocumented Malware-as-a-Service platform that combines remote-access trojan capabilities with automated credential theft and a silent Windows privilege-escalation chain. Unlike the large number of commodity RATs that recycle leaked AsyncRAT, XWorm, or QuasarRAT code, VectraRAT appears to be a purpose-built, full-stack product maintained by a single developer. The platform is rented rather than
- [Self-improving AI should slow down, von der Leyen tells EU lawmakers](https://cybernoz.com/self-improving-ai-should-slow-down-von-der-leyen-tells-eu-lawmakers/) - European Commission President Ursula von der Leyen wants frontier AI development slowed, and said on Wednesday that she will invite the leading AI labs to discuss how the EU can support their own efforts to do that. In her State of the Union address to the European Parliament in Strasbourg, she also committed the EU
- [Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution](https://cybernoz.com/attackers-exploit-issabel-framework-flaw-enabling-unauthenticated-os-command-execution/) - Ravie LakshmananSep 16, 2026Vulnerability / Web Security A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation. The vulnerability in question is CVE-2026-89026 (CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS)
- [Tech companies under fire as Europe proposes social media ban for under-15s](https://cybernoz.com/tech-companies-under-fire-as-europe-proposes-social-media-ban-for-under-15s/) - Children under 15 in Europe will be prohibited from having unsupervised social media accounts, along with new demands for technology companies to prove their platforms are safe. European Commission president Ursula von der Leyen told a State of the Union address at the European Parliament that Europe intended to “reverse the burden of proof” for
- [First Agentic AI Data Breach Reported to Spanish Regulator](https://cybernoz.com/first-agentic-ai-data-breach-reported-to-spanish-regulator/) - The Spanish Data Protection Agency (AEPD) has published details of the first notification of a personal data protection breach executed by design through an AI agent. Investigation into the attack is continuing, and the AEPD uses its words carefully. Nevertheless, although AI-assisted attacks have become common (deepfakes, authoring phishing emails, scaling attacks through automation, etcetera),
- [Google Patches Pixel Modem Zero-Day Exploited in Targeted Attacks](https://cybernoz.com/google-patches-pixel-modem-zero-day-exploited-in-targeted-attacks/) - Google Patches Pixel Modem Zero-Day Exploited in Targeted Attacks Pierluigi Paganini September 16, 2026 Google has patched a high-severity zero-day in the Pixel cellular modem after finding evidence that the vulnerability was exploited in limited, targeted attacks. Google has released its September 2026 Pixel security update, addressing a large set of vulnerabilities, including a high-severity
- [Hackers exploit zero-day flaw in Cisco email gateway](https://cybernoz.com/hackers-exploit-zero-day-flaw-in-cisco-email-gateway/) - Researchers warn the vulnerability could be used by state-linked actors for espionage. Source link
- [Coast Guard, FBI board US-bound foreign ships in order to probe for cyberattacks](https://cybernoz.com/coast-guard-fbi-board-us-bound-foreign-ships-in-order-to-probe-for-cyberattacks/) - The Coast Guard and FBI boarded two foreign vessels coming to the United States last month to investigate potential cyberattacks on the ships, according to a joint statement from the agencies Wednesday. The “joint offshore security boardings” of the two commercial ships in the Gulf of Mexico on Aug. 21 and Aug. 24 “were designed
- [Big Tech’s AI safety rift signals disruption and disparity for enterprises](https://cybernoz.com/big-techs-ai-safety-rift-signals-disruption-and-disparity-for-enterprises/) - Enterprise concerns While the debate is often framed as a choice between slowing innovation and strengthening oversight, analysts said enterprises should focus less on which approach prevails and more on the operational consequences already taking shape. “Divergent safety approaches will make access to advanced AI models less predictable, rather than producing an industrywide slowdown,” said
- [NamespaceHound: open source namespace boundary monitoring](https://cybernoz.com/namespacehound-open-source-namespace-boundary-monitoring/) - Sharing Kubernetes clusters across multiple teams and customers is a common practice known as multi-tenancy. It enables organizations to maximize the use of their hardware and infrastructure investments by allowing different teams or customers to share the same cluster resources while maintaining isolation from each other through namespaces. It's a popular approach, especially in larger
- [Dancing the night away with named pipes](https://cybernoz.com/dancing-the-night-away-with-named-pipes/) - Introduction This year at VB2023, a globally renowned malware conference, Daniel Stepanic of the Elastic Security Labs team presented new insights into PIPEDANCE – a malware we disclosed earlier this year. In addition to the talk, we released a client application that enables threat research, offering learning opportunities for both offensive and defensive teams. In
- [Microsoft says Copilot buttons still missing in classic Outlook](https://cybernoz.com/microsoft-says-copilot-buttons-still-missing-in-classic-outlook/) - Microsoft says it's still investigating a known issue that causes the Copilot and Copilot Chat buttons in Classic Outlook to disappear for some Windows users. As it acknowledged when it announced a fix via a service change in June, this affects only customers with the Copilot Chat (Basic) license or a paid M365 Copilot (Premium)
- [CenterPoint Energy Data Breach - Hackers Stolen Customer’s Personal Data](https://cybernoz.com/centerpoint-energy-data-breach-hackers-stolen-customers-personal-data/) - CenterPoint Energy disclosed a data breach after an unauthorized third party obtained personal information from some of its customers through an internet-facing company system. The Houston-based utility company revealed the incident in a Form 8-K filing with the U.S. Securities and Exchange Commission on September 14, 2026. CenterPoint said it learned of an online post
- [Cybersecurity Innovation Takes Centre Stage in International Cyber Expo Awards Shortlist](https://cybernoz.com/cybersecurity-innovation-takes-centre-stage-in-international-cyber-expo-awards-shortlist/) - International Cyber Expo has revealed the ten finalists shortlisted for its 2026 Innovation Awards & Trail, with cybersecurity technologies featuring prominently among the products selected by the independent judging panel. Making its debut at International Cyber Expo following its success at International Security Expo, the Innovation Awards & Trail will showcase technologies addressing some of
- [GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation](https://cybernoz.com/ghostcode-abuses-microsoft-entra-device-enrollment-to-maintain-access-after-token-revocation/) - A newly identified device-code phishing kit dubbed GhostCode exploits Microsoft Entra device enrollment to maintain access after stolen tokens are revoked. GhostCode begins with business-email social engineering rather than a conventional credential-harvesting page. Operators impersonated procurement staff from legitimate organizations, including BJ’s Wholesale Club, and submitted benign inquiries through Salesforce contact forms. Once a sales
- [Blake Benthall aka "Defcon", Former Operator of Silk Road 2.0, Tells His Story](https://cybernoz.com/blake-benthall-aka-defcon-former-operator-of-silk-road-2-0-tells-his-story/) - Silk Road 2.0 was a dark web marketplace launched in Nov. 2013, approximately five weeks after the FBI shut down the original Silk Road and arrested its founder, Ross Ulbricht. Blake Benthall is the former operator of the infamous dark web marketplace. Operating under the pseudonym “Defcon,” Benthall spent a year building and expanding Silk Road 2.0 until his arrest by
- [Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)](https://cybernoz.com/parallels-desktop-flaw-hands-any-local-user-root-on-a-mac-cve-2026-90894/) - A newly disclosed vulnerability in Parallels Desktop, tracked as CVE-2026-90894 and dubbed “ParaShells,” can allow any local user on a Mac to gain root privileges on the host system. ParaShells PoC in action (Source: JFrog) The danger is highest on developer laptops, where a single poisoned Homebrew formula or malicious npm preinstall script can go
- [Google Pixel owners urged to patch actively exploited modem flaw](https://cybernoz.com/google-pixel-owners-urged-to-patch-actively-exploited-modem-flaw/) - Google has released its September 2026 Pixel Update Bulletin, fixing 110 vulnerabilities, including one that it says “may be under limited, targeted exploitation.” The bug is not described as a simple remote takeover, but as a vulnerability that could give an attacker who already has a foothold on a phone more power than they should
- [Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories](https://cybernoz.com/attacker-hijacks-ai-coding-assistant-session-spreads-shai-hulud-across-about-100-repositories/) - Swati KhandelwalSep 16, 2026Artificial Intelligence / Software Security Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories. Before the repository spread, the assistant recommended software that the attacker had poisoned, and the recommendation was accepted. The worm stole repository
- [Executive interview: Reckitt has no fear of missing out on the AI frenzy](https://cybernoz.com/executive-interview-reckitt-has-no-fear-of-missing-out-on-the-ai-frenzy/) - Bastien Parizot, senior vice-president, global business services and artificial intelligence (AI) at hygiene and consumer health brands company Reckitt, remains level-headed when it comes to the latest developments in technology. For him, fear of missing out is one of the enemies of AI adoption. “I think there is a lot changing in the world of
- [AIUC Raises $40 Million to Certify Enterprise AI Agents](https://cybernoz.com/aiuc-raises-40-million-to-certify-enterprise-ai-agents/) - AIUC (Artificial Intelligence Underwriting Company) has announced raising $40 million in a Series A funding round that brings the total raised by the company to $55 million. The investment round was led by Ribbit Capital, with additional support from First Harmonic. Founded in 2024, San Francisco-based AIUC developed AIUC-1, an evaluation and risk standard designed
- [Non-Zero-Day VPN Flaw Left Japan 's Government Shared Network Platform Exposed: 246,000 Records at Risk](https://cybernoz.com/non-zero-day-vpn-flaw-left-japan-s-government-shared-network-platform-exposed-246000-records-at-risk/) - Non-Zero-Day VPN Flaw Left Japan ‘s Government Shared Network Platform Exposed: 246,000 Records at Risk Pierluigi Paganini September 15, 2026 Japan ‘s Digital Agency disclosed a VPN breach exposing 246,000 government employee records across 23 ministries. Detected June 25, publicly disclosed September 11. Japan ‘s Digital Agency disclosed that attackers exploited a vulnerability in a
- [Atomic macOS (AMOS) Stealer Activity](https://cybernoz.com/atomic-macos-amos-stealer-activity/) - Executive Summary This article reviews an Atomic macOS (AMOS) stealer malware infection generated in a lab environment. While several sources have published articles analyzing AMOS stealer, the associated indicators constantly change. This article presents a snapshot of indicators seen in early August 2026 and is designed to help readers better understand AMOS stealer. Background AMOS
- [Hack-back programs could expose your security vendors](https://cybernoz.com/hack-back-programs-could-expose-your-security-vendors/) - For multinationals, the exposure also runs inward. China’s Data Security Law bars providing data stored in China to foreign law enforcement without approval and compels cooperation with Chinese security authorities. Chinese law can bar a vendor’s China-based staff from supporting the American program their employer joined, and expose those employees personally for perceived cooperation. Employee
- [NASCIO reports state CIOs confront expanding critical infrastructure cyber risks amid local capability, governance gaps](https://cybernoz.com/nascio-reports-state-cios-confront-expanding-critical-infrastructure-cyber-risks-amid-local-capability-governance-gaps/) - State chief information officers are increasingly taking responsibility for protecting critical infrastructure from cyber threats, with 90% identifying cyberattacks as a high concern and 73% incorporating protections into comprehensive state plans. However, fragmented authority, capability gaps, unstable funding, and vulnerable OT (operational technology) remain persistent obstacles. Drawing on the 2026 NASCIO State CIO Survey, the
- [FERC approves NERC CIP-014-4 to strengthen physical security and risk assessments for critical transmission facilities](https://cybernoz.com/ferc-approves-nerc-cip-014-4-to-strengthen-physical-security-and-risk-assessments-for-critical-transmission-facilities/) - The U.S. Federal Energy Regulatory Commission (FERC) approved the North American Electric Reliability Corporation’s (NERC) proposed Reliability Standard CIP-014-4, tightening requirements for identifying and assessing transmission stations and substations whose loss could cause instability, uncontrolled separation or cascading across an interconnection. The standard revises applicability provisions to include jointly owned transmission facilities and establishes a
- [Wiz now offers DSPM for Oracle Cloud Infrastructure](https://cybernoz.com/wiz-now-offers-dspm-for-oracle-cloud-infrastructure/) - Organizations store large amounts of data in the cloud, which often includes sensitive data such as Personally Identifiable Information (PII), Payment Card Industry (PCI) information, and Protected Health Information (PHI) data and secrets. Securing such data is critical for organizations. Organizations failing to safeguard their sensitive data in the cloud face major the risks of
- [NightEagle APT targets Russian organizations](https://cybernoz.com/nighteagle-apt-targets-russian-organizations/) - Over the past year, our Global Emergency Response Team (GERT) has investigated several incidents involving the NightEagle group (APT-Q-95). This group has been active since at least 2023 and originally focused on organizations in Asia, as we reported previously. We have now identified attacks by the group targeting businesses in Russia. This post examines both
- [Disclosing the BLOODALCHEMY backdoor](https://cybernoz.com/disclosing-the-bloodalchemy-backdoor/) - Preamble BLOODALCHEMY is an x86 backdoor written in C and found as shellcode injected into a signed benign process. It was discovered in our analysis and is part of the REF5961 intrusion set, which you can read about here. BLOODALCHEMY requires a specific loader to be run because it isn't reflexive (it doesn’t have the
- [Windows Server 2022 reaches end of mainstream support next month](https://cybernoz.com/windows-server-2022-reaches-end-of-mainstream-support-next-month/) - Microsoft has reminded customers that Windows Server 2022 will reach the end of mainstream support next month and enter extended support until October 2031. Windows Server 2022 was unveiled in March 2021, and it became generally available in September 2021 as the Long-Term Servicing Channel (LTSC) release, with 10 years of support. "On October 13,
- [700+ OpenAI Agents Built Their Own Message Board to Coordinate an Attack on Hugging Face](https://cybernoz.com/700-openai-agents-built-their-own-message-board-to-coordinate-an-attack-on-hugging-face/) - AI agents built an unauthorized communications network and coordinated activity against Hugging Face infrastructure in a capability evaluation. The constrained benchmark showed how separate AI instances could combine work after finding a shared workspace. The agents were meant to solve ExploitGym challenges by exploiting supplied weaknesses to retrieve protected flags. Instead, they investigated challenge systems
- [Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works](https://cybernoz.com/hackers-got-inside-a-flock-camera-its-data-shows-how-the-system-really-works/) - Hackers ripped down a Flock camera above a roadway, made a near-complete copy of the data stored inside it, and shared the files with 404 Media and WIRED, revealing in new detail how exactly Flock Safety’s cameras track the movements of both vehicles and people. The hackers say they are also publishing details on how
- [Acronis Backup Plugin Vulnerability Exploited in the Wild to Gain Elevated Linux Privileges](https://cybernoz.com/acronis-backup-plugin-vulnerability-exploited-in-the-wild-to-gain-elevated-linux-privileges/) - Acronis has released an urgent security update for a high-severity local privilege escalation vulnerability affecting its Backup plugin for cPanel & WHM on Linux. The company confirmed that attackers have already exploited this flaw in limited, targeted attacks against vulnerable deployments. This vulnerability is tracked as CVE-2026-87886 and is described as an insecure file permissions
- [One runaway AI agent racked up a $50,000 cloud bill](https://cybernoz.com/one-runaway-ai-agent-racked-up-a-50000-cloud-bill/) - Organizations are deploying autonomous AI systems that execute API calls, optimize production configurations, and analyze telemetry across hybrid cloud environments. At the same time, attacks are expanding from direct prompts to indirect prompt injection and AI supply chain compromises, blurring security boundaries. Mandiant’s latest AI Risk and Resilience report, which draws on observations from Mandiant
- [AI helps scammers build convincing antivirus renewal pages](https://cybernoz.com/ai-helps-scammers-build-convincing-antivirus-renewal-pages/) - Antivirus renewal scams often begin with a message claiming that your subscription has automatically renewed. When you follow the instructions to cancel it, you are taken to a fake page designed to collect your contact details. The renewal charge never existed. Receiving a message that names the antivirus software you use does not necessarily mean
- [Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells](https://cybernoz.com/attackers-exploit-woocommerce-wholesale-lead-capture-flaw-to-plant-php-web-shells/) - Ravie LakshmananSep 16, 2026Vulnerability / Web Security Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution," Wordfence said. The WordPress
- [Advice for CIOs on AI’s 'existential threat'](https://cybernoz.com/advice-for-cios-on-ais-existential-threat/) - The US president has dismissed posts by the CEOs of OpenAI and Anthropic calling for an artificial intelligence (AI) slowdown as hoaxes, while Meta’s boss continues to push the line that AI is the future of humanity. However, in light of greater public scrutiny over AI safety, IT leaders may be asked if their AI
- [Apple Security Update: IOS 26.7 Fixes 273 Bugs](https://cybernoz.com/apple-security-update-ios-26-7-fixes-273-bugs/) - A new Apple security update has been dropped for iPhone owners, releasing iOS 26.7 alongside its major annual release, iOS 27. The move gives iPhone users who are hesitant to jump straight into a full system overhaul a safer, lighter-weight path to staying protected, arriving less than a month after the previous patch, iOS 26.6.1.
- [Pakistan's 90-Day Cybersecurity Action Plan Unveiled](https://cybernoz.com/pakistans-90-day-cybersecurity-action-plan-unveiled/) - Pakistan’s federal government has completed work on a 90-day cybersecurity action plan designed to build a more coordinated national defense against digital threats, bringing together federal and provincial governments, regulators and operators of critical infrastructure under one framework. The Cyber Security Working Committee (CSWC) drafted the plan and functions as a subordinate body of the
- [TeamViewer empowers public sector organisations to ‘shift left’ with TeamViewer ONE](https://cybernoz.com/teamviewer-empowers-public-sector-organisations-to-shift-left-with-teamviewer-one/) - Public sector organisations around the world face challenges keeping employees secure, productive and satisfied. However, moving from disconnected systems and reactive support to a proactive, integrated model can accelerate incident resolution, improve productivity, and reduces the digital friction caused by technology dysfunction. According to digital workplace platform provider TeamViewer, digital friction is a major headache
- [Enterprises Warned of Attacks Exploiting WSO2 Vulnerability](https://cybernoz.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/) - A critical WSO2 vulnerability patched earlier this year is now being exploited in the wild by threat actors seeking access to sensitive enterprise data. WSO2 is an open source middleware platform that enables organizations to design, secure, integrate, and manage APIs, services, and identities across hybrid and multi-cloud environments. The platform has nearly 1,000 enterprise
- [Texas Utility CenterPoint Energy Confirms Data Breach After Hacker Claims 7.49M Records Stolen](https://cybernoz.com/texas-utility-centerpoint-energy-confirms-data-breach-after-hacker-claims-7-49m-records-stolen/) - Texas Utility CenterPoint Energy Confirms Data Breach After Hacker Claims 7.49M Records Stolen Pierluigi Paganini September 16, 2026 CenterPoint Energy confirmed a customer data breach after a hacker claimed to leak 7.49M records, including personal and billing information. CenterPoint Energy admitted on Monday that an intruder stole personal information belonging to some of its customers.
- [Exaforce extends its AI security tool to monitor more than just Claude](https://cybernoz.com/exaforce-extends-its-ai-security-tool-to-monitor-more-than-just-claude/) - While most of these efforts focused on AI agent discovery, a recent study showed that this is only part of the puzzle that enterprises need to solve. A March 2026 survey by the Cloud Security Alliance found 68% of organizations could not distinguish human activity from AI-agent activity, necessitating agent discovery. But even the agents
- [Cyolo, Nozomi Networks integrate asset intelligence and access controls across OT environments](https://cybernoz.com/cyolo-nozomi-networks-integrate-asset-intelligence-and-access-controls-across-ot-environments/) - Cyolo, provider of secure connectivity solutions for critical infrastructure and cyber-physical systems (CPS), and Nozomi Networks, vendor of OT, IoT and CPS security, announced on Wednesday an integration between the two platforms. This certified integration enables asset data to flow continuously and bi-directionally between the Cyolo platform and the Nozomi Networks platform. This ongoing data
- [Sailing Securely Across the SDLC: Introducing Wiz's Image Trust and Kubernetes Audit Log Collector](https://cybernoz.com/sailing-securely-across-the-sdlc-introducing-wizs-image-trust-and-kubernetes-audit-log-collector/) - Containerized applications are the new norm for organizations of all sizes, driving innovation, agility, and scalability. Developer speed has accelerated dramatically, especially with the introduction of continuous integration and continuous deployment (CI/CD) pipelines and platforms like Kubernetes for managing applications at scale. However, there's a flip side to the coin. These applications are often highly ephemeral
- [Fall 2023 Global Threat Report Outro](https://cybernoz.com/fall-2023-global-threat-report-outro/) - After months of diligent work, Elastic Security Labs is excited to announce the publication of the October 2023 Global Threat Report. For our second annual publication of this kind, we knew it was going to be a greater effort– not only did the volume of events increase more than 1000%, we had entirely new types
- [CenterPoint Energy confirms customer data stolen in cyberattack](https://cybernoz.com/centerpoint-energy-confirms-customer-data-stolen-in-cyberattack/) - CenterPoint Energy disclosed a breach compromising some customers’ personal information after an attacker leaked data allegedly stolen from the utility company. An investigation started after the company discovered an online post from a threat actor claiming to have stolen 7.49 million records. CenterPoint Energy is a Houston-based public utility company that provides electric and natural gas
- [Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones](https://cybernoz.com/google-chrome-153-update-fixes-42-security-flaws-including-3-critical-ones/) - Google has released an important Chrome 153 security update that fixes 42 vulnerabilities across the browser, including three bugs rated Critical. The Stable channel is moving to 153.0.8010.47/.48 for Windows and macOS and 153.0.8010.47 for Linux, with the update rolling out gradually over the coming days and weeks. CVE-2026-91721 is a use-after-free vulnerability in Chrome’s
- [Apple Releases iOS 27 Security Update to Fix Over 120 Vulnerabilities](https://cybernoz.com/apple-releases-ios-27-security-update-to-fix-over-120-vulnerabilities/) - Apple has released iOS 27 and iPadOS 27, delivering one of its largest mobile security update batches to date. The release addresses approximately 126 vulnerabilities within the operating system, including flaws affecting the kernel, sandboxing mechanisms, WebKit, authentication services, and other security-sensitive components. Released on September 14, 2026, iOS 27 is available for the iPhone
- [BambooToken Malware Uses MQTT to Control Windows and Linux Systems](https://cybernoz.com/bambootoken-malware-uses-mqtt-to-control-windows-and-linux-systems/) - Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows and Linux systems. The emerging malware family, codenamed BambooToken, is assessed to be active since at least February 2023 and put to use in attacks targeting organizations across Asia and
- [Cisco users urged to patch email gateway flaw](https://cybernoz.com/cisco-users-urged-to-patch-email-gateway-flaw/) - Cisco is urging defenders to get out in front of a highly-dangerous flaw in its Secure Email Gateway (SEG) appliance, CVE-2026-76461 that could enable an unauthenticated, remote attacker to gain the ability to execute arbitrary commands with root privileges. Listed on the US’ Cybersecurity and Infrastructure Security Agency’s (Cisa’s) Known Exploited Vulnerabilities (Kev) catalogue as
- [CHOSEN BRICK: Iran's Spyware Campaign Against Its Critics](https://cybernoz.com/chosen-brick-irans-spyware-campaign-against-its-critics/) - The file looked like an MRI scan. Lumbar spine, several grey slices of vertebrae, a heading reading something like ‘Disk Herniation and Degeneration.’ For a dissident living in exile – someone with a body that has been through things, someone waiting on results – it was a plausible thing to open. Opening it handed Iranian
- [Cleanaway is modernising its network connecting 350 sites](https://cybernoz.com/cleanaway-is-modernising-its-network-connecting-350-sites/) - Key points Cleanaway Waste Management is deploying an SD-WAN using Netskope technology, with Macquarie Technology Group overseeing delivery, due to complete by April next year. The network will ultimately support more than 350 sites across Australia, with a pilot phase complete and 25 sites now active. The upgrade is designed to strengthen video capture and
- [“We Think the Security Control Is Working” Is No Longer Good Enough](https://cybernoz.com/we-think-the-security-control-is-working-is-no-longer-good-enough/) - Security, risk, and control assessments are typically done for the sake of compliance: tools deployed, audits passed, workflows completed, boxes checked. That’s no longer enough for boards, customers, and regulators, who all want an answer to a harder question: ‘can you prove your controls are working right now?’ I often ask CISOs a version of
- [One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire](https://cybernoz.com/one-exploit-chain-two-espionage-campaigns-chrome-and-windows-under-fire/) - One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire Pierluigi Paganini September 15, 2026 Two China-linked groups ran identical Chrome/Windows zero-day exploits against NGOs, before Chrome’s patch shipped, deploying different backdoors each. Two China-linked threat actors used the same Chrome/Windows zero-day against NGOs starting September 1, 2026, Volexity’s new report lays out the
- [Hundreds of OpenAI agents attack RubyGems platform](https://cybernoz.com/hundreds-of-openai-agents-attack-rubygems-platform/) - “Once the AIs got arbitrary RCE on the build environment, they would sometimes use the build environment to attempt to steal other users’ API keys, though we are unsure if they succeeded or not,” the RubyGems post said. “The agents clearly regarded what they were doing as hacking. Agents used file names like hack[.]rb, evil[.]rb,
- [AWS STS simplifies session token size limits and adds session token size monitoring](https://cybernoz.com/aws-sts-simplifies-session-token-size-limits-and-adds-session-token-size-monitoring/) - AWS Security Token Service (AWS STS) has simplified session token size limits, giving you more room for your session policies and session tags. STS has replaced the packed policy size and the overall session token size limits with a single token size limit of 4,096 bytes. STS now reports session token size in API responses,
- [Getting gooey with GULOADER: deobfuscating the downloader](https://cybernoz.com/getting-gooey-with-guloader-deobfuscating-the-downloader/) - Overview Elastic Security Labs continues to monitor active threats such as GULOADER, also known as CloudEyE – an evasive shellcode downloader that has been highly active for years while under constant development. One of these recent changes is the addition of exceptions to its Vectored Exception Handler (VEH) in a fresh campaign, adding more complexity
- [Acronis warns of actively exploited flaw in its cPanel backup plugin](https://cybernoz.com/acronis-warns-of-actively-exploited-flaw-in-its-cpanel-backup-plugin/) - Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild. cPanel & WHM and Plesk are used by web hosting companies and server administrators to manage websites and servers through graphical interfaces. Acronis’ backup add-ons connect the hosting
- [Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices](https://cybernoz.com/apple-rolls-out-massive-security-update-fixing-273-vulnerabilities-across-its-devices/) - Apple has released one of its largest coordinated security rollouts, addressing 273 distinct critical vulnerabilities across iPhone, iPad, Mac, Apple Watch, Apple TV, Vision Pro, Safari, and Xcode. The patches arrived on September 14, 2026, through iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27, and Xcode 27,
- [Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors](https://cybernoz.com/hackers-actively-exploit-critical-woocommerce-plugin-vulnerability-to-upload-php-backdoors/) - Threat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin that lets unauthenticated attackers upload malicious PHP files and potentially seize full control of vulnerable WordPress sites. The vulnerability , tracked as CVE-2026-27540, affects plugin versions 2.0.3.1 and earlier and has received a CVSS severity score of 9.8 out of
- [Cisco patches actively exploited email gateway zero-day (CVE-2026-76461)](https://cybernoz.com/cisco-patches-actively-exploited-email-gateway-zero-day-cve-2026-76461/) - Attackers have leveraged a zero-day SQL injection vulnerability (CVE-2026-76461) to compromise Cisco Secure Email Gateway appliances, Cisco confirmed on Monday. The vendor’s Product Security Incident Response Team became aware of active exploitation of this vulnerability in September 2025, and has shared indicators of compromise that organizations can look for to check whether they’ve been hit.
- [Search results are sending people to fake Bitrefill checkouts](https://cybernoz.com/search-results-are-sending-people-to-fake-bitrefill-checkouts/) - Bitrefill is a legitimate company that sells gift cards for popular stores like Amazon, Deliveroo, Apple, Nintendo, and thousands of others. They also sell eSIMs, and mobile top-ups. You can pay on their website for all of these with cryptocurrency. The scam is designed to catch people searching for Bitrefill or something it sells, like
- [Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists](https://cybernoz.com/iranian-hackers-use-telegram-controlled-malware-to-spy-on-dissidents-and-journalists/) - Cybersecurity agencies in the United States, the United Kingdom, and the Netherlands have detailed a Windows malware that they say Iran's intelligence service uses to spy on dissidents, journalists, and activists around the world. The malware is controlled via the Telegram messaging app and can copy a target's emails and chat messages, take screenshots, and
- [Zopa Bank launches voice-controlled banking](https://cybernoz.com/zopa-bank-launches-voice-controlled-banking/) - Customers of Zopa Bank can now use voice commands to instruct an artificial intelligence (AI)-powered personal digital banking assistant to make transactions and request advice. The bank’s Ask Zopa feature understands and acts on instructions given by customers using conversational language, with the promise of removing additional manual processes. The AI agent, which comes with
- [UK Cyberattack Rate Hits 38% Among Small Firms: Hiscox](https://cybernoz.com/uk-cyberattack-rate-hits-38-among-small-firms-hiscox/) - Nearly four in 10 UK small firms were hit by a successful cyberattack in the past year, according to the latest Hiscox Cyber Readiness Report. The UK cyberattack rate reached 38%, significantly above the 29% global average recorded among nearly 7,000 smaller businesses surveyed worldwide. The 10th annual report surveyed cybersecurity decision-makers at smaller firms,
- [International Meteor Organization Cyberattack Disrupts Site](https://cybernoz.com/international-meteor-organization-cyberattack-disrupts-site/) - The International Meteor Organization cyberattack has knocked much of the Belgium-based nonprofit’s website offline, with the organization warning that several weeks of partial downtime could follow as it moves to new infrastructure and services. The International Meteor Organization (IMO), which coordinates meteor observations and connects amateur and professional astronomers worldwide, is currently operating a stripped-down
- [UTS embarks on "$20 million-plus" network refresh](https://cybernoz.com/uts-embarks-on-20-million-plus-network-refresh/) - Key points UTS has embarked on a $20 million-plus refresh of its network and wi-fi infrastructure across every campus, engaging Nexon Asia Pacific to deliver it. The rollout includes wi-fi 7 equipment and covers wired and wireless, core and edge infrastructure, data centre connectivity and security controls, including the Extreme Platform ONE. Design work and
- [Microsoft Commits to Sweeping AI Privacy Rules for Students. Will Other Tech Giants Follow?](https://cybernoz.com/microsoft-commits-to-sweeping-ai-privacy-rules-for-students-will-other-tech-giants-follow/) - Millions of students every day turn to AI chatbots for help with schoolwork, emotional support and personal advice — often unaware of where their conversations and other personal information end up. How that data is used — and schools’ role in protecting it — is a growing concern for educators, parents and kids as artificial
- [U.S. CISA adds Cisco Secure Email Gateway flaw to its Known Exploited Vulnerabilities catalog](https://cybernoz.com/u-s-cisa-adds-cisco-secure-email-gateway-flaw-to-its-known-exploited-vulnerabilities-catalog/) - U.S. CISA adds Cisco Secure Email Gateway flaw to its Known Exploited Vulnerabilities catalog Pierluigi Paganini September 15, 2026 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Secure Email Gateway flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Secure Email Gateway flaw, tracked as CVE-2026-76461
- [Companies’ AI strategies don’t account for their agentic tools](https://cybernoz.com/companies-ai-strategies-dont-account-for-their-agentic-tools/) - Businesses are taking AI governance seriously, but their plans lag behind the technology they’re using, according to an EY survey. Source link
- [What’s next for CISA's CDM program that gives cybersecurity tools to federal agencies](https://cybernoz.com/whats-next-for-cisas-cdm-program-that-gives-cybersecurity-tools-to-federal-agencies/) - A Cybersecurity and Infrastructure Security Agency program that provides tools and capabilities to other agencies has to get speedier so it can push them toward being able to move more quickly themselves, an agency official said Tuesday. “We have to get faster,” said Richard Grabowski, acting branch chief of service delivery and deputy program manager
- [Critical Cisco Secure Email Gateway zero-day gives attackers root access](https://cybernoz.com/critical-cisco-secure-email-gateway-zero-day-gives-attackers-root-access/) - If exploitation is suspected on physical devices, Cisco recommends contacting the Cisco Technical Assistance Center. For virtual devices, customers are advised to save all forensic information then deploy a new instance with rebuilt configuration and rotated credentials. Devices that are enrolled in Cisco Secure Email Cloud have already been reviewed by Cisco and the owners
- [Yokogawa launches Industrial Cyber Resilience Center in Singapore to strengthen OT cybersecurity](https://cybernoz.com/yokogawa-launches-industrial-cyber-resilience-center-in-singapore-to-strengthen-ot-cybersecurity/) - Yokogawa Engineering Asia announces the launch of the Industrial Cyber Resilience Center (ICRC). Located at Yokogawa’s Singapore office, the center serves as a regional hub for Southeast Asia, Oceania, and Taiwan, offering a comprehensive portfolio of cybersecurity training, solutions, and services designed to help organizations identify capability gaps, strengthen cyber resilience, and enhance their ability
- [Wiz Defend & Google Security Operations Integration](https://cybernoz.com/wiz-defend-google-security-operations-integration/) - The AI era is putting new pressure on security teams to detect, investigate, and respond faster. As we explored in Pillar 4 of our AI Threat Readiness Framework, keeping pace with AI-driven threats requires comprehensive context, automated investigation, and response that can move as fast as the threat itself. But speed isn’t just about what
- [Operational Resilience: IT Security Risks with Reduced Staffing](https://cybernoz.com/operational-resilience-it-security-risks-with-reduced-staffing/) - Holiday periods are something every organisation has to deal with. Whether it's the summer holidays or another period where large numbers of people are taking leave, the reality is that many businesses will operate for a period of time with reduced staffing.For IT and security teams, this can present a particular challenge.Project work may slow
- [Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites](https://cybernoz.com/malcious-admin-menu-editor-pro-plugin-backdoors-1500-wordpress-sites/) - Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to more than 200 customers after a threat actor compromised the maintainer’s website and pushed updates that created a hidden user account. Developer Janis Elsts says an unauthorized party accessed the adminmenueditor.com website on Monday and uploaded version 2.35 as an
- [CISA and NIST Releases Technical Checklist for Safeguarding the Identity Tokens From Theft and Misuse](https://cybernoz.com/cisa-and-nist-releases-technical-checklist-for-safeguarding-the-identity-tokens-from-theft-and-misuse/) - The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) have released final technical guidance to stop attackers from forging, stealing, replaying, or misusing identity and access tokens. Published as NIST Interagency Report 8587 on September 15, 2026, it gives federal agencies and cloud service providers a roadmap for
- [Pacing the frontier: security industry reacts to AI slowdown and kill switch debate](https://cybernoz.com/pacing-the-frontier-security-industry-reacts-to-ai-slowdown-and-kill-switch-debate/) - A weekend essay from Anthropic chief executive Dario Amodei, followed days later by his co-founder Jack Clark’s suggestion that AI “kill switches” may need to become mandatory, has reopened a debate that cuts to the heart of the security industry’s relationship with frontier AI. Amodei’s essay, We Must Pace the Frontier, published on Saturday 12
- [Phishing Attacks Abuse Trusted Email Infrastructure and URL Cloaking to Evade Security Filters](https://cybernoz.com/phishing-attacks-abuse-trusted-email-infrastructure-and-url-cloaking-to-evade-security-filters/) - Phishing operators are increasingly shifting away from malware-laden attachments and toward trusted delivery services, authenticated domains, and multi-stage URL cloaking designed to defeat conventional email inspection. The continuously running VBSpam comparative test evaluated ten public full email-security products and one open-source solution against wanted, unwanted, and malicious mail streams. The assessment was conducted under the
- [Uncensored AI sold on hacking forum as alternative to ChatGPT and Claude jailbreaks](https://cybernoz.com/uncensored-ai-sold-on-hacking-forum-as-alternative-to-chatgpt-and-claude-jailbreaks/) - A new AI subscription service called Luciferus is being marketed on a hacking forum as an alternative to jailbreaking ChatGPT or Claude, Sophos found. The Counter Threat Unit (CTU) spotted the advertisement on August 24 on the Exploit forum, posted by a persona going by “Optimus_Prime.” The account joined the forum on April 18 and
- [How to opt out of AI chatbot training](https://cybernoz.com/how-to-opt-out-of-ai-chatbot-training/) - The tech journalists at 404 Media learned that OpenAI is hiring hundreds of contractors to read and review a massive stream of real users’ ChatGPT prompts and responses. “Project Lily” is reportedly a program that asks contractors to score or critique ChatGPT’s answers to improve the chatbot’s quality and behavior. The fact that prompts may
- [KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens](https://cybernoz.com/kremlin-banking-malware-hijacks-chrome-and-edge-to-steal-credentials-and-session-tokens/) - Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on
- [Capita doesn’t get to ‘walk away from’ civil service pension mess, says minister](https://cybernoz.com/capita-doesnt-get-to-walk-away-from-civil-service-pension-mess-says-minister/) - The government will force Capita to fix the civil service pension scheme (CSPS) before any final decision can be made on insourcing the scheme, says minister. In a Westminster Hall debate the CSPS debacle was referred to as a “national scandal” by MPs. Responding to questions and troubling stories from MPs, recounting the suffering
- [University of Sydney to roll out ChatGPT Edu to students](https://cybernoz.com/university-of-sydney-to-roll-out-chatgpt-edu-to-students/) - Key points University of Sydney is rolling out ChatGPT Edu to 80,000 students and staff, becoming the second major Australian tertiary institution to strike a major OpenAI deal in a week. The rollout will be guided by the university's responsible AI framework and its existing "two-lane" assessment strategy to address academic integrity. Alongside the rollout,
- [$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws](https://cybernoz.com/1-million-sandbox-challenge-uncovers-linux-kernel-flaws/) - A two-week focused sandbox bug-bounty program resulted in 1,285 filings, but none that could access customer data. The Vercel sandbox, a Firecracker‑based microVM environment, is an isolation tool for untrusted AI‑agent code. For two weeks (August 18 until September 1), Vercel operated a focused bug-bounty program with a $1 million reward pot. It called the
- [Shared Hosting at Risk: LiteSpeed Enterprise Bug Can Grant Root from a Single Tenant](https://cybernoz.com/shared-hosting-at-risk-litespeed-enterprise-bug-can-grant-root-from-a-single-tenant/) - Shared Hosting at Risk: LiteSpeed Enterprise Bug Can Grant Root from a Single Tenant Pierluigi Paganini September 15, 2026 Critical LiteSpeed Enterprise flaw lets one shared hosting account gain root, bypassing CageFS; patch now to 6.3.7 via forced update. cPanel warned that a critical flaw in LiteSpeed Enterprise can let a low‑privilege website user break
- [AI is now leading driver of new cybersecurity spending](https://cybernoz.com/ai-is-now-leading-driver-of-new-cybersecurity-spending/) - AI investments are expected to help automate security operations and enhance identity and access management. Source link
- [Cisco warns customers of actively exploited zero-day in email gateways](https://cybernoz.com/cisco-warns-customers-of-actively-exploited-zero-day-in-email-gateways/) - Attackers of unknown origins and motivations are exploiting a critical zero-day vulnerability in Cisco Secure Email Gateway, authorities and researchers said Monday. The vulnerability — CVE-2026-76461 — was exploited before Cisco disclosed and patched the defect Monday and allows unauthenticated, remote attackers to execute commands with root privileges on vulnerable systems. “In practical terms, that
- [Scott Bessent confirms weekend meeting with He Lifeng days before Xi’s US visit](https://cybernoz.com/scott-bessent-confirms-weekend-meeting-with-he-lifeng-days-before-xis-us-visit/) - US Treasury Secretary Scott Bessent on Tuesday confirmed that he will meet Chinese Vice Premier He Lifeng this weekend for the final preparatory talks between the two sides, less than a week before Chinese President Xi Jinping travels to Washington for a bilateral summit with US President Donald Trump.“With China, we have had some very
- [Exposed Vite servers are being probed for AWS and Azure credentials](https://cybernoz.com/exposed-vite-servers-are-being-probed-for-aws-and-azure-credentials/) - Vite was part of a broader scanning pattern F5 also observed attackers combining CVE-2026-39364 with older Vite file access vulnerabilities, including CVE-2025-30208, CVE-2025-31125 and CVE-2024-45811. The same scanning infrastructure also probed for a Next.js middleware bypass, indicating that the activity is not confined to a single framework. In its blog post the company also noted
- [Leaks, data breaches, and ransom notes: The worst hacks of 2026 so far](https://cybernoz.com/leaks-data-breaches-and-ransom-notes-the-worst-hacks-of-2026-so-far/) - If anything, 2026 has made clear that cybersecurity is no longer a background concern. Today, security is at the front and center of many conversations, woven into almost every major story of the year. Inequalities are still common, the climate is worsening, and we’re seemingly one dodgy sneeze away from the next global pandemic. But
- [Dispel targets exposed PLCs and remote access risks facing small U.S. water and electric utilities](https://cybernoz.com/dispel-targets-exposed-plcs-and-remote-access-risks-facing-small-u-s-water-and-electric-utilities/) - Dispel announced on Monday opening of the Dispel Community Power & Water Program at the American Public Power Association’s Cybersecurity & Technology Summit in San Antonio. The program brings the same secure remote access capability large utilities rely on to small water and electric utilities. Deployable by utility staff without an infrastructure overhaul, the system
- [DOE selects Frenos, Raptor Dynamix, and Bastazo for SENTRY energy cybersecurity funding](https://cybernoz.com/doe-selects-frenos-raptor-dynamix-and-bastazo-for-sentry-energy-cybersecurity-funding/) - The U.S. Department of Energy’s (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER) announced on Monday Securing ENergy Technology ResiliencY (SENTRY) award recipients—Frenos, Raptor Dynamix, and Bastazo. SENTRY is a project within DOE that aligns with key Trump Administration efforts to enhance the security and resilience of the U.S. energy infrastructure. The initiative
- [Give every teammate and agent the right level of access to your Workers](https://cybernoz.com/give-every-teammate-and-agent-the-right-level-of-access-to-your-workers/) - As more teams — and now agents — build applications on Cloudflare's Developer Platform, having the right access controls is crucial to allow you to ship safely. After all, the last thing you want is for an agent to make a change in production, just because it was granted more access than it needs. Now,
- [Doubling Down: Detecting In-Memory Threats with Kernel ETW Call Stacks](https://cybernoz.com/doubling-down-detecting-in-memory-threats-with-kernel-etw-call-stacks/) - Introduction We were pleased to see that the kernel call stack capability we released in 8.8 was met with extremely positive community feedback - both from the offensive research teams attempting to evade us and the defensive teams triaging alerts faster due to the additional context. But this was only the first step: We needed
- [BambooToken malware controls Windows and Linux systems via MQTT](https://cybernoz.com/bambootoken-malware-controls-windows-and-linux-systems-via-mqtt/) - A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems. The malware adopted MQTT for command-and-control communications in variants developed between 2024 and 2025, compromising servers used by mobile apps, legal and financial services, and software
- [CISA Shares 17 Techniques Used by Hackers to Compromise Active Directory](https://cybernoz.com/cisa-shares-17-techniques-used-by-hackers-to-compromise-active-directory/) - CISA and five international cybersecurity agencies have released detailed guidance describing 17 common techniques hackers use to compromise Microsoft Active Directory environments. The technical guide explains how attackers exploit identity configurations, legacy protocols, certificate services, and privileged systems to escalate access, move laterally, and establish long-term persistence inside enterprise networks. Developed by the Australian Signals
- [Kura Appoints Acumen Cyber to Deliver 24/7 Cyber Defence](https://cybernoz.com/kura-appoints-acumen-cyber-to-deliver-24-7-cyber-defence/) - Customer experience provider Kura has appointed Acumen Cyber to provide 24/7 security monitoring, threat detection and incident response across its operations in the UK and South Africa. Kura supports more than 50 brands across financial services, utilities, healthcare and the public sector, operating from Glasgow, Sunderland and Durban. The company handles millions of customer interactions
- [Google Search Makes It Harder to See Where a Link Really Goes Before You Click](https://cybernoz.com/google-search-makes-it-harder-to-see-where-a-link-really-goes-before-you-click/) - Google has begun routing some organic Search result links through opaque google.com/goto?url=… redirects, reducing users’ ability to independently inspect a destination URL before clicking. The change appears designed to raise the technical and financial cost of mass scraping. However, it also weakens a long-standing, basic anti-phishing habit: hovering over a link to verify where it
- [6 of the Best Autonomous Penetration Testing Companies in 2026](https://cybernoz.com/6-of-the-best-autonomous-penetration-testing-companies-in-2026/) - 15 Sep 6 of the Best Autonomous Penetration Testing Companies in 2026 Posted at 08:49h in Blogs by Taylor Fox This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Sep. 15, 2026 – Read the full story from BreachLock Summary Six vendors run autonomous penetration testing as a standalone product today:
- [Postman Passport controls API access without exposing credentials](https://cybernoz.com/postman-passport-controls-api-access-without-exposing-credentials/) - Postman has announced the general availability of Passport by Postman, marking the company’s expansion into API security with a standalone product that gives organizations a secure way to consume APIs as human and non-human identities increasingly work side by side. The new product keeps real API credentials inside customers’ environments while giving security teams full
- [HBO Max’s verified Reddit account hijacked to spread malware](https://cybernoz.com/hbo-maxs-verified-reddit-account-hijacked-to-spread-malware/) - Researchers at Hudson Rock found that cybercriminals hijacked HBO Max’s verified Reddit account and used it to run 108 malicious ads over roughly 48 hours. The ads used HBO Max’s trusted corporate account to promote fake AI tools, developer software, and macOS utilities, lowering potential victims’ guards. Some ads directed users to convincing HBO lookalike
- [Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds](https://cybernoz.com/human-attacker-exploits-marimo-rce-reaches-ssh-bastion-in-eight-seconds/) - Ravie LakshmananSep 15, 2026Vulnerability / Malware With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access. In one instance highlighted by the cloud security company, the
- [UK Atomic Energy Authority readies US artificial intelligence collaboration](https://cybernoz.com/uk-atomic-energy-authority-readies-us-artificial-intelligence-collaboration/) - The UK Atomic Energy Authority (UKAEA) has annouced plans to look at how it can work with the US Department of Energy’s Princeton Plasma Physics Laboratory (PPPL) to deliver federated supercomputing for fusion research. During the Global Fusion Policy Summit held in London, UKAEA and PPPL signed a joint declaration of intent to explore linking
- [Meet Adapt, Westpac's Azure-based enterprise data platform](https://cybernoz.com/meet-adapt-westpacs-azure-based-enterprise-data-platform/) - Key points Westpac has unveiled Adapt, a new enterprise data platform on Microsoft Azure that brings together data from 285 source systems into one common governed environment. The Westpac Intelligence Layer, built with Snowflake, creates a single customer view across products and channels by running AI models on data at rest without moving it. Westpac's
- [Thai Broadband Provider Hacked via Fortinet Vulnerability](https://cybernoz.com/thai-broadband-provider-hacked-via-fortinet-vulnerability/) - A threat actor targeted multiple vulnerabilities in Fortinet and F5 products to gain access to Thai broadband provider 3BB’s systems, Hunt.io reports. The attack was discovered after the hackers left their intrusion arsenal in an open directory hosted on infrastructure in Thailand. The directory contained 298 files across 30 subdirectories: multiple exploitation scripts, brute-force and
- [Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day](https://cybernoz.com/cisco-warns-of-ongoing-exploitation-of-critical-email-gateway-zero-day/) - Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day Pierluigi Paganini September 15, 2026 Cisco warns of a critical zero-day in Secure Email Gateway, exploited in the wild to gain root access through malicious emails. Cisco disclosed a critical zero-day, tracked as CVE-2026-76461 (CVSS score of 9.8), affecting Secure Email Gateway appliances. The flaw
- [AI is breaking down the wall between cyber and physical security](https://cybernoz.com/ai-is-breaking-down-the-wall-between-cyber-and-physical-security/) - A recent EY survey data of 250 corporate leaders and directors reveals that only 12% of organizations feel most prepared to detect a targeted physical attack. Bridging this gap requires an integrated approach across every step – detection, deterrence, prevention, preparation, response, mitigation, investigation and recovery — long before a situation escalates. Threats are changing
- [Red Heron exploits Gitea RCE flaw in multinational campaign targeting industrial and government organizations](https://cybernoz.com/red-heron-exploits-gitea-rce-flaw-in-multinational-campaign-targeting-industrial-and-government-organizations/) - Researchers from Acronis Threat Research Unit (TRU) detailed how a Chinese-speaking threat actor tracked as Red Heron exploited the critical CVE-2026-60004 remote code execution flaw in internet-facing Gitea instances within days of public proof-of-concept code appearing. The campaign scanned 1,386 Gitea instances across seven countries and maintained a separate database of 477 Taiwan-based systems, with
- [Nozomi uses snapshot fuzzing to uncover four memory-corruption flaws in Siemens SCALANCE LPE9403](https://cybernoz.com/nozomi-uses-snapshot-fuzzing-to-uncover-four-memory-corruption-flaws-in-siemens-scalance-lpe9403/) - Researchers from Nozomi Networks Labs identified four memory-corruption vulnerabilities in the PROFINET Discovery and basic Configuration Protocol (DCP) implementation running on the Siemens SCALANCE LPE9403 industrial PC, using an emulation-driven fuzzing technique combining process snapshots, the Unicorn CPU emulator and AFL++. These security vulnerabilities affect SCALANCE LPE9403 firmware up to version V4.0 HF0 and are
- [AI-powered remediation guidance with Azure OpenAI Service](https://cybernoz.com/ai-powered-remediation-guidance-with-azure-openai-service/) - Generative AI has been a powerful catalyst for organizations, helping them automate and improve efficiency for tasks previously done manually. We recently released a blog about one of these use cases, discussing the numerous benefits of using AI in security organizations (such as helping scale security teams through enhanced efficiency, and improving the process of
- [Sinking macOS Pirate Ships with Elastic Behavior Detections](https://cybernoz.com/sinking-macos-pirate-ships-with-elastic-behavior-detections/) - Preamble On January 12, 2024, Malwrhunterteam, an X account that surfaces interesting malware samples, usually found via VirusTotal, released a Tweet about a pirated macOS application that appeared to contain malicious capabilities. macOS security researcher Patrick Wardle quickly released a write-up detailing the application’s malicious functionality, which included dropping second and third-stage payloads. Shortly after,
- [Suspected Black Axe gang leaders face cybercrime charges in the US](https://cybernoz.com/suspected-black-axe-gang-leaders-face-cybercrime-charges-in-the-us/) - Five alleged leaders of the Black Axe cybercrime syndicate, known for its involvement in global-scale cyber-enabled financial fraud, have been extradited to the United States to face wire fraud and money laundering charges. Prosecutors accuse Perry Osagiede, Franklyn Osagiede, Osariemen Clement, Collins Otughwor, and Musa Mudashiru of coordinating an internet fraud campaign from Cape Town
- [Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover](https://cybernoz.com/critical-wordpress-plugin-flaws-put-over-600000-websites-at-risk-of-takeover/) - Two critical vulnerabilities in The Events Calendar WordPress plugin could allow unauthenticated attackers to take over vulnerable websites. The flaws affect more than 600,000 active installations. They can lead to remote code execution, administrator password resets, malware deployment, and full server compromise. Wordfence Argus, developed by the Wordfence Threat Intelligence team, discovered the two independent
- [Telegram Desktop XSS Vulnerability Lets Attackers Steal Entire Chat Histories](https://cybernoz.com/telegram-desktop-xss-vulnerability-lets-attackers-steal-entire-chat-histories/) - A stored cross-site scripting (XSS) vulnerability in Telegram Desktop could enable attackers to steal the contents of exported chat histories by embedding malicious code in an inline keyboard button, according to security researchers. This issue affects the HTML chat export feature in Telegram Desktop builds released before Beta version 6.9.4 and Stable version 7.0.1. Researchers
- [Akuity gives AI agents operational context to safely ship software](https://cybernoz.com/akuity-gives-ai-agents-operational-context-to-safely-ship-software/) - Akuity has introduced its Agentic Control Plane and MCP Server. Akuity’s Agentic Control Plane lets AI agents accelerate software delivery by giving them the operational context and permissions to act, all governed by the same controls Akuity already enforces across the pipeline. That governance is what gives engineering leadership the confidence to let agents into
- [Meta AI builds detailed profiles of children from years of family posts](https://cybernoz.com/meta-ai-builds-detailed-profiles-of-children-from-years-of-family-posts/) - If you’re still OK with posting pictures of your kids on social media, take a minute to hear from mother of two Kalie Robins. At the start of September, she did something that hundreds of thousands of parents do every day. She posted a video of her young daughter on Facebook. Under the video of
- [LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server](https://cybernoz.com/litespeed-enterprise-flaw-could-let-one-hosting-account-gain-root-access-on-a-shared-server/) - Swati KhandelwalSep 15, 2026Vulnerability / Web Security A critical vulnerability in LiteSpeed Web Server Enterprise could let a low-privilege website user gain root access on a shared-hosting server, cPanel warned in an advisory published on September 14. On such servers, many customers' sites run on a single machine, and an attacker with one of those
- [Data dive: The revolving door between Whitehall and big tech](https://cybernoz.com/data-dive-the-revolving-door-between-whitehall-and-big-tech/) - What do a former head of GCHQ, the author of the MoD’s Defence AI Strategy, a former prime minister and the founder of the Government Digital Service (GDS) have in common? They all left very senior roles in the UK government and public sector for jobs with IT and artificial intelligence (AI) suppliers that supply
- [Nintendo Switch Vulnerability: Update Firmware Now](https://cybernoz.com/nintendo-switch-vulnerability-update-firmware-now/) - A newly disclosed Nintendo Switch vulnerability is pushing owners of the original console toward an urgent firmware update, particularly those who tend to play in public spaces. Nintendo confirmed the vulnerability in Nintendo Switch systems in a PDF advisory released Sept. 10, just a day after quietly shipping firmware version 23.0.0 to address the problem.
- [Study Finds WordPress Vulnerabilities In 4 Of 5 Sites](https://cybernoz.com/study-finds-wordpress-vulnerabilities-in-4-of-5-sites/) - A new Singapore Study has found that four in five websites run by local businesses carry at least one detectable WordPress vulnerabilities. The Singapore WordPress Website Cybersecurity Study, released by Equinet Academy on August 31, 2026, in partnership with Cutlazz Cyber Consulting, examined 102 publicly accessible WordPress sites operated by Singapore-based businesses. Using passive, automated
- [Apple overhauls security with iOS and macOS 27](https://cybernoz.com/apple-overhauls-security-with-ios-and-macos-27/) - Key points iOS 27 fixes 122 vulnerabilities and macOS 27 fixes over 200, with some credited to AI systems such as Claude and Codex Security. Apple has strengthened enterprise authentication, added new executable code controls on Macs and retired legacy update management in favour of declarative management. An ambitious AI agent from the betas that
- [Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack](https://cybernoz.com/hacked-hbo-max-reddit-account-used-for-malware-delivery-via-clickfix-attack/) - Hackers compromised the official HBO Max account on Reddit and used it in a malvertising campaign leading to a ClickFix landing page. During a 48-hour window, the attackers pushed 108 malicious advertisements across five lure groups as part of the campaign, tracked as PasteSwitch. Using the verified u/hbomax account, the threat actors targeted both macOS
- [Telegram Desktop Flaw Could Turn Old Chat Exports Into Data Theft Traps](https://cybernoz.com/telegram-desktop-flaw-could-turn-old-chat-exports-into-data-theft-traps/) - Telegram Desktop Flaw Could Turn Old Chat Exports Into Data Theft Traps Pierluigi Paganini September 15, 2026 A Telegram Desktop flaw let bots inject JavaScript into exported chats, enabling data theft and page manipulation. Old HTML exports remain unsafe. A vulnerability in Telegram Desktop could have turned an ordinary chat export into a serious data
- [OneTrust research flags AI governance gaps as Australian adoption accelerates](https://cybernoz.com/onetrust-research-flags-ai-governance-gaps-as-australian-adoption-accelerates/) - OneTrust has released its 2026 AI-Ready Governance Report, reporting that Australian organisations are moving beyond AI experimentation into broader adoption, while governance and risk controls struggle to keep pace. The report, based on a survey of 1,200 senior business decisionmakers across the United States, Canada, the United Kingdom, France, Germany, Spain, Australia and Singapore, was
- [Wiz and Splunk team up to secure your cloud resources](https://cybernoz.com/wiz-and-splunk-team-up-to-secure-your-cloud-resources/) - We're thrilled to announce an exciting partnership and integrated solution with Splunk, empowering our shared customers to seamlessly integrate our respective solutions. Customers can use this integration to share Wiz security findings — including Issues, vulnerabilities, and audit log data — to Splunk Enterprise and Cloud to investigate, analyze and report. Security Information and Event Management (SIEM)
- [Unlocking Power Safely: Privilege Escalation via Linux Process Capabilities](https://cybernoz.com/unlocking-power-safely-privilege-escalation-via-linux-process-capabilities/) - Preamble In the realm of Linux security, administrators constantly grapple with a delicate balance between safeguarding sensitive system resources and accessibility. One helpful avenue that has garnered considerable attention in recent years is privilege escalation via Linux process capabilities. While traditional Unix-like permissions offer coarse-grained control over access rights, process capabilities provide a nuanced approach,
- [Homebrew 7.0.0 gets built-in GUI, better security controls](https://cybernoz.com/homebrew-7-0-0-gets-built-in-gui-better-security-controls/) - Homebrew package manager version 7.0.0 has been released with a built-in vulnerability scanner, stronger security controls, and the full release of its native BrewUI graphical interface. The open-source package manager is primarily used on macOS, allowing users to install software in a similar way to Linux package managers by automatically downloading packages and resolving and
- [Top 10 Best Container Security Tools in 2026](https://cybernoz.com/top-10-best-container-security-tools-in-2026/) - Container security spans the whole lifecycle build (image scanning, IaC), ship (registry, admission), and run (runtime detection, drift) across modern multi-cloud security architectures. Aqua and Sysdig lead as specialists, Snyk owns developer-first shift-left, and the platform CNAPPs (Prisma, Wiz, CrowdStrike) increasingly absorb container security into a broader graph. Here are the ten best, matched to
- [Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware](https://cybernoz.com/hackers-turn-windows-shadow-copies-into-a-tool-for-credential-theft-and-ransomware/) - Threat actors are increasingly weaponizing Microsoft’s Volume Shadow Copy Service (VSS) for two distinct objectives: removing recovery options before ransomware deployment and extracting credential material from protected Windows files. The shift means VSS telemetry should no longer be treated as a simple backup or disk-maintenance event, but as behavior requiring process, identity, and endpoint context.
- [Your employees are already using AI tools you never approved](https://cybernoz.com/your-employees-are-already-using-ai-tools-you-never-approved/) - Seventy-four percent of respondents report departmental or scaled AI adoption at their organizations, including within individual teams or departments, across business functions, and as part of processes and operations, according to the latest OneTrust 2026 AI-Ready Governance Report. The remaining respondents are planning, evaluating, or experimenting with AI, while 1% report no AI use. Which
- [Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports](https://cybernoz.com/telegram-desktop-flaw-lets-hidden-javascript-exfiltrate-messages-from-html-exports/) - A flaw in Telegram Desktop let a bot's message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatch said in a writeup published on September 12. In Telegram, the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a
- [Finnish government AI plan puts thousands of public sector jobs at risk](https://cybernoz.com/finnish-government-ai-plan-puts-thousands-of-public-sector-jobs-at-risk/) - The Finnish government has launched a politically contentious plan to transform the country’s entire public sector into an artificial intelligence (AI)-powered system by 2031. With the aims to reshape public services, the ambitious reform mission is expected to result in the elimination of thousands of public sector jobs, a prospect that is causing significant concerns
- [Former US regulator says AI companies not exempt from current law](https://cybernoz.com/former-us-regulator-says-ai-companies-not-exempt-from-current-law/) - Key points Lina Khan has warned that AI companies have no exemption from existing law over models that disrupt other organisations' systems. OpenAI has admitted its agents accessed RubyGems and abused RubyDoc.info, prompting a temporary halt to sign-ups while the platform investigated. Khan noted that Nvidia's agreement to buy Hugging Face makes legal action over
- [The Race to Control AI and Protect What Makes Us Human](https://cybernoz.com/the-race-to-control-ai-and-protect-what-makes-us-human/) - A current debate is whether artificial intelligence (AI) is a force for good or bad; or perhaps both. What follows is the argued opinion of the author – it is not the inevitable outcome of current AI development. On August 26, 2026, Bill Gates published a 6,000 word memo on his personal website, titled The
- [U.S. CISA adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog](https://cybernoz.com/u-s-cisa-adds-gitlab-jfrog-artifactory-and-connectwise-screenconnect-flaws-to-its-known-exploited-vulnerabilities-catalog/) - U.S. CISA adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog Pierluigi Paganini September 14, 2026 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added [1, 2] the following vulnerabilities to its Known Exploited
- [Supreme Court denies Trump request to allow USPS mail ballot changes](https://cybernoz.com/supreme-court-denies-trump-request-to-allow-usps-mail-ballot-changes/) - The Supreme Court has rejected a petition by the Trump administration to implement changes to the way the U.S. Postal Service handles mail-in ballots for the upcoming 2026 midterm elections, calling it “arbitrary and capricious.” The 7-2 decision was handed down Monday with little explanation by the court. Writing for the majority, Justice Kentaji Brown
- [KAIperShield and Cyber in Space form Indo-Pacific partnership on mission-focused cyber resilience](https://cybernoz.com/kaipershield-and-cyber-in-space-form-indo-pacific-partnership-on-mission-focused-cyber-resilience/) - KAIperShield and Cyber in Space have signed a business development and customer engagement agreement aimed at expanding access to cyber resilience and mission assurance capabilities developed at NASA’s Jet Propulsion Laboratory across Australia, New Zealand and the wider Indo-Pacific. Under the agreement, KAIperShield has appointed Cyber in Space (CIS) as a business development and customer
- [A maximum severity GitLab flaw could turn your CI/CD server into an attacker’s treasure trove](https://cybernoz.com/a-maximum-severity-gitlab-flaw-could-turn-your-ci-cd-server-into-an-attackers-treasure-trove/) - Beyond patching, the watchTowr Intel team said defenders should try to identify exploitation attempts by hunting through log files for HTTP POST requests to “/api/v4/projects/{id}/repository/commits/” URIs containing “file.path” parameters. CI/CD platforms are critical trust infrastructure Organizations running affected self-managed GitLab CE or EE instances should be most concerned, Moahamad noted. Risk increases where GitLab is
- [AWS Security Reference Architecture: A deep dive into PCI DSS compliance](https://cybernoz.com/aws-security-reference-architecture-a-deep-dive-into-pci-dss-compliance/) - Amazon Web Services (AWS) is excited to announce the publication of the AWS Security Reference Architecture (AWS SRA) Payment Card Industry (PCI) Data Security Standard (DSS) Deep Dive. This new guide extends the core AWS SRA to provide prescriptive, architecture-level guidance for organizations that store, process, or transmit cardholder data on AWS. Organizations subject to
- [500ms to midnight: XZ A.K.A. liblzma backdoor](https://cybernoz.com/500ms-to-midnight-xz-a-k-a-liblzma-backdoor/) - Key Takeaways On March 29, 2024, Andres Freund identified malicious commits to the command-line utility XZ, impacting versions 5.6.0 and 5.6.1 for Linux, and shared the information on the oss-security mailing list. Andres’ discovery was made after an increase of 500ms in latency was observed with SSH login attempts initiated from a development system, amongst
- [Japan's Digital Agency says VPN flaw exposed 246,000 personnel records](https://cybernoz.com/japans-digital-agency-says-vpn-flaw-exposed-246000-personnel-records/) - Japan’s Digital Agency has discovered a data breach that may have exposed around 246,000 record rows containing personal information of government employees. The agency says that the attacker gained initial access by exploiting a vulnerability in a VPN device used by the Government Solution Service (GSS). An investigation started on June 25, after the agency
- [Hackers Mass-Scan Exposed Vite Servers to Steal AWS and Azure Cloud Credentials](https://cybernoz.com/hackers-mass-scan-exposed-vite-servers-to-steal-aws-and-azure-cloud-credentials/) - Hackers are conducting a large-scale automated scanning campaign against internet-exposed Vite development servers, attempting to steal AWS credentials, Azure access tokens, environment variables, and Infrastructure-as-Code secrets. F5 honeypot sensors recorded 807 session-grouped attacks and about 32,000 raw events in August 2026, a sharp increase from only 1,732 Vite-related file-read events observed over the previous three
- [Apple parental controls in iOS 27 let kids ask before opening new websites](https://cybernoz.com/apple-parental-controls-in-ios-27-let-kids-ask-before-opening-new-websites/) - Apple has overhauled the child-safety tools that ship across iPhone, iPad, and Mac. One idea runs through the redesign. Give a child a device that does very little, then open it up as they’re ready. The tools went live on September 14, after a preview in June, and they require iOS 27, iPadOS 27, or
- [3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials](https://cybernoz.com/3bb-attacker-used-meshcentral-backdoor-for-root-access-targeted-subscriber-credentials/) - Swati KhandelwalSep 14, 2026Network Security / Cyber Attack An attacker was operating inside the network of 3BB, one of Thailand's largest broadband providers, and maintained remote control of internal machines using a legitimate management tool called MeshCentral, threat intelligence firm Hunt.io said. The company uncovered the intrusion by examining a server the attacker had left
- [UK rolls out digital ID for alcohol sales](https://cybernoz.com/uk-rolls-out-digital-id-for-alcohol-sales/) - The hospitality and retail sectors will be empowered to adopt certified digital identification technology to verify legal alcohol purchases under new rules to be rolled out by the UK government. Operating alongside – but not replacing – traditional physical forms of identity such as driving licences or passports, Westminster said the changes will make age
- [Digital Canberra to "refresh" private cloud platform](https://cybernoz.com/digital-canberra-to-refresh-private-cloud-platform/) - Key points Digital Canberra is exploring future options for its private cloud platform, currently run on VMware software and Dell hardware, as warranty expiry looms. Most of the ACT compute platform reaches warranty expiry between March and September 2027, with only newer Dell MX760c blade servers supported until July 2029. The VCF platform underpins roughly
- [Personal, Financial Info Exposed in Revolut Data Breach](https://cybernoz.com/personal-financial-info-exposed-in-revolut-data-breach/) - British fintech giant Revolut is notifying a subset of users that their personal and financial information was compromised in a data breach. Based in London, the neobank and financial technology company provides banking and investment services to over 80 million users in 160 countries and regions. Late last week, the company informed a small number
- [ENISA: Frontier AI Is Changing the Speed of Cyberattacks. Europe Needs to Catch Up](https://cybernoz.com/enisa-frontier-ai-is-changing-the-speed-of-cyberattacks-europe-needs-to-catch-up/) - ENISA: Frontier AI Is Changing the Speed of Cyberattacks. Europe Needs to Catch Up Pierluigi Paganini September 14, 2026 Frontier AI is compressing the attack lifecycle from vulnerability discovery to exploitation, forcing defenders to detect, patch and respond at machine speed. Cybersecurity has always been a race between attackers and defenders. ENISA’s latest assessment suggests
- [Malicious actors already using critical GitLab flaw, CISA and others warn](https://cybernoz.com/malicious-actors-already-using-critical-gitlab-flaw-cisa-and-others-warn/) - The vulnerability could let unauthenticated users access sensitive files from software-development environments. Source link
- [Five alleged leaders of Black Axe’s operations in South Africa extradited to US](https://cybernoz.com/five-alleged-leaders-of-black-axes-operations-in-south-africa-extradited-to-us/) - Five alleged leaders of the South African wing of Black Axe, a global cybercrime group with operations spanning dozens of countries, were extradited to the United States Friday to face multiple charges, the Justice Department said. Officials accuse the five people, all originally from Nigeria, of running romance scams and advance fee scams from at
- [Number of suspicious credit card transactions involving iPhones surges to 1,209](https://cybernoz.com/number-of-suspicious-credit-card-transactions-involving-iphones-surges-to-1209/) - The number of suspicious credit card transactions involving pre-orders for the latest iPhone models has surged to more than 1,200 in Hong Kong, involving HK$25 million (US$3.2 million), police have said, while Apple is reviewing all current orders.The force said the number of unauthorised transactions had risen to 1,209 as of 5pm on Monday, up
- [Announcing the release of the Financial Services Cloud Security Playbook](https://cybernoz.com/announcing-the-release-of-the-financial-services-cloud-security-playbook/) - We 're excited to announce the release of "The Financial Services Cloud Security Playbook," a practical guide that aims to aid in transforming and scaling security teams and processes to support cloud development. The playbook is designed to provide strategies and recommendations that financial services organizations can leverage as they migrate towards cloud environments. Cloud computing
- [What is Proactive Threat Intelligence?](https://cybernoz.com/what-is-proactive-threat-intelligence/) - An alert may be the first sign a security team sees, but it rarely marks the beginning of an attack. Before an intrusion reaches the network, threat actors may research targets, prepare infrastructure, trade stolen credentials, or discuss vulnerabilities they plan to exploit. Security teams that rely solely on internal alerts may miss earlier activity.
- [Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part One](https://cybernoz.com/dissecting-remcos-rat-an-in-depth-analysis-of-a-widespread-2024-malware-part-one/) - In the first article in this multipart series, malware researchers on the Elastic Security Labs team give a short introduction about the REMCOS threat and dive into the first half of its execution flow, from loading its configuration to cleaning the infected machine web browsers. Introduction Elastic Security Labs continues its examination of high-impact threats,
- [Microsoft releases emergency Windows updates to fix RDS failures](https://cybernoz.com/microsoft-releases-emergency-windows-updates-to-fix-rds-failures/) - Microsoft has released emergency out-of-band Windows updates to fix Remote Desktop Services failures caused by this month's security updates, along with Hyper-V and USB audio problems on some Windows versions. The September 2026 security updates caused Remote Desktop Services (RDS) to become unstable on affected systems, leading to RDP connection and sign-in failures and, in
- [Hackers Exploit FortiGate SSL-VPN Vulnerability to Attack Broadband Provider](https://cybernoz.com/hackers-exploit-fortigate-ssl-vpn-vulnerability-to-attack-broadband-provider/) - Researchers have uncovered an exposed attacker-controlled staging server containing evidence of a wide-ranging intrusion targeting 3BB, the consumer brand operated by Thailand’s Triple T Broadband. The investigation links the operation to the exploitation of a critical SSL-VPN vulnerability, followed by privilege escalation, credential theft, internal reconnaissance, lateral movement, and persistent remote access. FortiGate SSL-VPN Vulnerability
- [New York Seizes a Dozen Celebrity Deepfake Websites](https://cybernoz.com/new-york-seizes-a-dozen-celebrity-deepfake-websites/) - For the best part of a decade, abusive deepfake “pornography” websites have published thousands of nonconsensual videos depicting women, including high-profile celebrities, politicians, and public figures, into sexual situations. Now, in what is likely the largest takedown of explicit deepfake websites to date, officials in New York have seized more than a dozen of the
- [When the SOC Stops Following Playbooks and Starts Thinking: Automating the SOC with AI Agents](https://cybernoz.com/when-the-soc-stops-following-playbooks-and-starts-thinking-automating-the-soc-with-ai-agents/) - When the SOC Stops Following Playbooks and Starts Thinking: Automating the SOC with AI Agents Skip to content We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.Ok Source link
- [AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process](https://cybernoz.com/asyncrat-malware-abuses-autoit-and-powershell-to-hide-inside-legitimate-windows-process/) - A five-stage AsyncRAT campaign that chains a socially engineered batch file, hidden PowerShell execution, AutoIt abuse and process injection to conceal a .NET remote-access trojan inside Microsoft’s legitimate charmap.exe process. The infection begins with a lure named “Right-click to open Invoice Details.bat”, which relies on user interaction to trigger execution. While the precise delivery method
- [Adopting Exposure Management in the Age of AI](https://cybernoz.com/adopting-exposure-management-in-the-age-of-ai/) - 14 Sep Adopting Exposure Management in the Age of AI Posted at 11:58h in Blogs by Taylor Fox The rules of cyber warfare are changing faster than most organizations can adapt. –Christopher Hogan, Vice President, Vulnerability Management, MasterCard San Jose, Calif. – Sep. 14, 2026 The cybersecurity landscape in 2026 can best be described as
- [ENISA launched the CRA Single Reporting Platform for actively exploited vulnerabilities](https://cybernoz.com/enisa-launched-the-cra-single-reporting-platform-for-actively-exploited-vulnerabilities/) - The EU Agency for Cybersecurity switched on the Cyber Resilience Act‘s Single Reporting Platform on 11 September 2026, the same day the law’s reporting obligations started binding manufacturers. ENISA built the tool and runs its day-to-day operations, a job Article 16(1) of the CRA hands to the agency. Anyone placing a product with digital elements
- [Revolut gave customer IDs and financial data to a government impostor](https://cybernoz.com/revolut-gave-customer-ids-and-financial-data-to-a-government-impostor/) - Revolut has acknowledged that it disclosed sensitive customer records to an unauthorized party. The company had accepted fraudulent information requests sent from an email address on a legitimate government agency domain, according to TechCrunch. Revolut is a London-based banking and financial platform with more than 80 million customers globally, according to the company. Revolut describes
- [New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing](https://cybernoz.com/new-ddrop-attack-breaks-intel-tdx-and-amd-sev-snp-confidential-computing/) - Researchers have disclosed a new hardware attack, called DDRop, that breaks the memory protection in Intel and AMD confidential computing by silently dropping writes to a server's memory, so the processor keeps reading old encrypted data as if it were current. The attack requires an attacker who already controls the server's software and can briefly
- [UK lawmakers call for new law to protect human rights from AI systems](https://cybernoz.com/uk-lawmakers-call-for-new-law-to-protect-human-rights-from-ai-systems/) - British lawmakers are calling for a new law and a statutory oversight body to address the “serious threats” posed by AI systems to people’s human rights. Parliament’s Joint Committee on Human Rights said the UK needed stronger safeguards including a statutory AI oversight body and new legislation to address the risks of AI. The report’s
- [New Warnings About the Risks of AI to Humanity Revive a Long-Running Debate](https://cybernoz.com/new-warnings-about-the-risks-of-ai-to-humanity-revive-a-long-running-debate/) - New warnings from within the artificial intelligence industry have revived a long-running debate over whether advanced AI could escape human control and ultimately threaten humanity’s survival, and whether the companies developing the technology are doing enough to prevent such a scenario. The CEO of Anthropic, the San Francisco company behind Claude, said he thought the
- [China Calls Amodei’s AI Proposal a New Cold War Playbook](https://cybernoz.com/china-calls-amodeis-ai-proposal-a-new-cold-war-playbook/) - China Calls Amodei’s AI Proposal a New Cold War Playbook Pierluigi Paganini September 14, 2026 China rejects Amodei’s AI slowdown proposal, calling it fearmongering and a US attempt to contain China’s technology sector. The debate over whether the world should slow down the development of advanced AI has quickly turned into something bigger than a
- [AI Agent Security Readiness: The Federal Standard You Should Get Ahead Of](https://cybernoz.com/ai-agent-security-readiness-the-federal-standard-you-should-get-ahead-of/) - Here's the uncomfortable part first: in August 2026, researchers found AI agents connected to Hugging Face running loose inside enterprise networks. No owner, no audit trail, nobody who could tell you they existed until something broke. If that sentence made your stomach drop a little, good, because it should. It's the same blind spot most
- [Security teams increasingly outflanked by AI agents](https://cybernoz.com/security-teams-increasingly-outflanked-by-ai-agents/) - A report warns that non-human identities are growing beyond the ability of existing systems to track. Source link
- [German intelligence report warns of rising Chinese, Russian spy threat](https://cybernoz.com/german-intelligence-report-warns-of-rising-chinese-russian-spy-threat/) - Germany’s military counter-intelligence agency, known as MAD, has warned of a growing threat from hybrid attacks and the use of recruited contract agents, or low-level agents, saying Germany is a “prioritised target of Russian espionage activities”.According to the agency’s annual report released on Monday, it cited Germany’s geostrategic position in Europe and Nato the expansion
- [How to level up from security pro to security leader](https://cybernoz.com/how-to-level-up-from-security-pro-to-security-leader/) - “In my career, I’ve been very successful with the following: have a positive attitude especially under stress, assume best intent from people you’re engaging with, and always take the high road, especially when trying to collaborate on solutions,” he says. “Cheesy, but I’ve found it to be super effective across my super diverse business and
- [Global ransomware attacks hit record 997 in August 2026 as utility, healthcare and business attacks surge](https://cybernoz.com/global-ransomware-attacks-hit-record-997-in-august-2026-as-utility-healthcare-and-business-attacks-surge/) - New data from Comparitech disclosed a record 997 ransomware attacks worldwide in August 2026, averaging 32 attacks per day and representing a 23% increase from 809 attacks in July. The total surpassed the previous monthly record of 988 attacks recorded in February 2025. Businesses accounted for 861 attacks, up 24% from July, while ransomware incidents
- [OT-ISAC, NCSA, TXOne conduct Predictive Resilience exercise, focus on evidence-driven OT cybersecurity decisions](https://cybernoz.com/ot-isac-ncsa-txone-conduct-predictive-resilience-exercise-focus-on-evidence-driven-ot-cybersecurity-decisions/) - The OT Information Sharing and Analysis Center (OT-ISAC), Thailand’s National Cyber Security Agency (NCSA), and TXOne Networks conducted a Predictive Resilience Exercise in Bangkok on Aug. 18, 2026, bringing participants together to work through a realistic, evolving operational scenario. The exercise focused on identifying critical signals, validating information, engaging appropriate stakeholders and determining actions that
- [NSA top 10 cloud security strategies: key takeaways](https://cybernoz.com/nsa-top-10-cloud-security-strategies-key-takeaways/) - CISA and the NSA recently released a series of ten strategies to guide organizations in developing sound cybersecurity practices for their cloud environments. NSA has billed this guide of “top ten” strategies as the “most important practices to improve the security posture of their cloud environments.” This guidance comes on the heels of a report
- [Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Two](https://cybernoz.com/dissecting-remcos-rat-an-in-depth-analysis-of-a-widespread-2024-malware-part-two/) - In the previous article in this series on the REMCOS implant, we shared information about execution, persistence, and defense evasion mechanisms. Continuing this series we’ll cover the second half of its execution flow and you’ll learn more about REMCOS recording capabilities and communication with its C2. Starting watchdog If the enable_watchdog_flag (index 0x32) is enabled,
- [Hackers target exposed Vite dev servers to steal AWS, Azure secrets](https://cybernoz.com/hackers-target-exposed-vite-dev-servers-to-steal-aws-azure-secrets/) - A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments. The operation leverages an exploit for CVE-2026-39364, a high-severity vulnerability that allows bypassing file read/access controls in Vite versions 7.1.0 through 7.3.2, as well as the 8.x branch before 8.0.5. The flaw was disclosed
- [Nintendo Switch Vulnerability Allow Attackers to Run Unauthorized Code on Your Console](https://cybernoz.com/nintendo-switch-vulnerability-allow-attackers-to-run-unauthorized-code-on-your-console/) - Nintendo has patched a high-severity vulnerability in the original Nintendo Switch that could let a nearby attacker execute unauthorized code and access information stored on the console. Tracked as CVE-2026-82079, the flaw affects firmware earlier than 23.0.0 and resides in local wireless networking. The security issue is a stack-based buffer overflow, a memory-corruption weakness that
- [China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor](https://cybernoz.com/china-linked-hackers-exploit-sogou-one-click-rce-to-deploy-grayrabbit-backdoor/) - China-linked threat actors tracked as UNC3569 have exploited a critical one-click remote code execution vulnerability in Tencent’s Sogou Input Method for Windows to deploy the GRAYRABBIT backdoor on targeted systems. Tracked as CVE-2026-51990, the vulnerability chains an insecure custom protocol handler, unrestricted embedded-browser navigation, and an obsolete Chromium build running without sandbox protections. Tencent addressed
- [The CISO Gap Is A Huge SMB Cybersecurity Opportunity For MSSPs](https://cybernoz.com/the-ciso-gap-is-a-huge-smb-cybersecurity-opportunity-for-mssps/) - AI has fundamentally changed what a cyberattack looks like. A Forbes article reports that tools, speed and sophistication that once required nation-state resources are now available to anyone with a credit card and a cloud account. At the same time, the businesses MSPs (managed service providers) and MSSPs (managed security service providers) serve face a security leadership
- [Dataminr uses agentic AI to predict and verify security threats](https://cybernoz.com/dataminr-uses-agentic-ai-to-predict-and-verify-security-threats/) - Dataminr has announced Dataminr Advanced for Corporate Security, delivering agentic AI capabilities that give corporate security teams the confidence to protect their people, sites, and operations before risk escalates. With Agentic Corroboration, Agentic Context, and Near-Term Predictive Intelligence, corporate security teams know what happened first, why it matters, and what may happen next as an
- [Google’s new search redirects make links harder to check before you click](https://cybernoz.com/googles-new-search-redirects-make-links-harder-to-check-before-you-click/) - Google is changing how some links in its search results work. Instead of linking directly to the destination, Google has started routing some search result links through opaque google.com/goto?url=... redirects. The url parameter does not show a readable version of the destination but uses a custom, Google-specific encoding. Google confirmed the rollout to Search Engine Roundtable: “We
- [AI Changed the Exposure Problem. Validation Needs to Change With It.](https://cybernoz.com/ai-changed-the-exposure-problem-validation-needs-to-change-with-it/) - There's a lot of noise around AI and cybersecurity right now. What’s actually important is far simpler, if often lost in the hubbub. Vulnerability discovery is getting faster and happening at a much greater scale, while defenders still have to work out which findings actually deserve their action. In the first half of 2026, a
- [Skills, culture and leadership: The foundations of the UAE’s digital economy](https://cybernoz.com/skills-culture-and-leadership-the-foundations-of-the-uaes-digital-economy/) - As the UAE marks Emirati Women’s Month, attention is focused on the role women play in shaping the country’s future industries. From artificial intelligence (AI) and cloud computing to digital infrastructure and advanced technologies, the UAE’s economic ambitions increasingly depend on a workforce equipped with the skills, leadership capabilities and adaptability required to navigate a
- [Beijing Hits Back at Anthropic CEO’s Call to Curb China’s AI Development](https://cybernoz.com/beijing-hits-back-at-anthropic-ceos-call-to-curb-chinas-ai-development/) - China’s Ministry of Foreign Affairs on Monday hit back at a call from the head of Anthropic for the U.S. to curb China’s artificial intelligence capabilities, which he issued as he argued for a global slowdown on AI development. U.S. President Donald Trump and Chinese leader Xi Jinping are expected to discuss AI governance, among
- [Dutch NCSC Warns: Critical Check Point VPN Flaws Put Networks at Risk](https://cybernoz.com/dutch-ncsc-warns-critical-check-point-vpn-flaws-put-networks-at-risk/) - Dutch NCSC Warns: Critical Check Point VPN Flaws Put Networks at Risk Pierluigi Paganini September 14, 2026 Two critical Check Point VPN flaws score 9.8 and could enable remote code execution. Patch now and restrict VPN access before exploitation begins. The Dutch NCSC warns that two critical vulnerabilities in Check Point VPN products, both rated
- [Bypassing Apple’s iOS 10 Restrictions Settings – Twice — Jon Bottarini](https://cybernoz.com/bypassing-apples-ios-10-restrictions-settings-twice-jon-bottarini/) - By default, Apple has a feature that allows all of their iOS devices to be assigned restrictions, so that employees and mostly children cannot access naughty websites and other types of less-desirable content. You can enable these settings by visiting Settings > General > Restrictions on your iPhone or iPad. Around the beginning of every
- [What the 3M ChatGPT case reveals about AI governance](https://cybernoz.com/what-the-3m-chatgpt-case-reveals-about-ai-governance/) - Could you reconstruct the decision a year later? One habit I have developed working around operational systems is to think backward from the future investigation. I do not assume that every process will fail, but asking what evidence would be needed six months or a year later forces a clearer conversation about accountability. If someone
- [Copia Automation joins OTCC to strengthen critical infrastructure resilience through OT backup and recovery](https://cybernoz.com/copia-automation-joins-otcc-to-strengthen-critical-infrastructure-resilience-through-ot-backup-and-recovery/) - The Operational Technology Cybersecurity Coalition (OTCC) announced that Copia Automation has joined the coalition, bringing a backup-and-recovery lens to OTCC’s growing network of organizations working to secure the nation’s critical infrastructure. Copia builds automated, versioned backups of PLC and controller code, paired with version control designed specifically for the plant floor: baseline integrity, full change
- [ENISA launches Single Reporting Platform as EU Cyber Resilience Act vulnerability reporting obligations take effect](https://cybernoz.com/enisa-launches-single-reporting-platform-as-eu-cyber-resilience-act-vulnerability-reporting-obligations-take-effect/) - The EU Agency for Cybersecurity (ENISA) deployed the initial operating capability of the Single Reporting Platform (SRP). The agency developed, operates and maintains the online tool to enable manufacturers and open-source software stewards to meet their new Cyber Resilience Act (CRA) reporting obligations for actively exploited vulnerabilities and severe incidents. Designed to support effective vulnerability
- ["Google Cloud Security Foundations for Dummies" by Wiz](https://cybernoz.com/google-cloud-security-foundations-for-dummies-by-wiz/) - Cloud computing has shifted the digital paradigm from an on-premises environment to a globally distributed network of resources that can be accessed on demand. This shift, while beneficial, brings a new set of challenges in terms of security. To help address these challenges, Wiz brings you “Google Cloud Security Foundations for Dummies” — a comprehensive
- [Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Three](https://cybernoz.com/dissecting-remcos-rat-an-in-depth-analysis-of-a-widespread-2024-malware-part-three/) - In previous articles in this multipart series, malware researchers on the Elastic Security Labs team analyzed REMCOS execution flow, detailing its recording capabilities and its communication with C2. In this article, you’ll learn more about REMCOS configuration structure and its C2 commands. The configuration In this section, we provide a comprehensive overview of the configuration
- [Microsoft: September updates cause RDS failures on Windows Server](https://cybernoz.com/microsoft-september-updates-cause-rds-failures-on-windows-server/) - Microsoft has confirmed reports that the September 2026 security updates cause Remote Desktop Services (RDS) failures on Windows Server systems. According to a release health update on Friday, this known issue impacts Windows Server 2012 and later, as well as Windows 10 and Windows 11 devices. This confirmation follows widespread reports from Windows admins that
- [Hackers Leverage Claude to Exfiltrate Secrets from 1.8M Android apps](https://cybernoz.com/hackers-leverage-claude-to-exfiltrate-secrets-from-1-8m-android-apps/) - Cybercriminals linked to the ShinyHunters ecosystem used Claude to support a large-scale credential theft operation that downloaded, decompiled, and scanned 1.8 million Android applications for hardcoded secrets. The campaign shows how AI-assisted workflows can turn exposed mobile-app credentials into a rapid initial-access pipeline for enterprise breaches. According to Anthropic’s September 2026 threat intelligence report, a
- [Sexually Explicit Deepfake Sites Target 100-Plus Politicians in Europe](https://cybernoz.com/sexually-explicit-deepfake-sites-target-100-plus-politicians-in-europe/) - Almost 150 politicians across Europe have been included on harmful deepfake pornography websites over the last few years, according to new research seen by WIRED. Some of the politicians, who are overwhelmingly women, have had their likeness included in explicit videos, while others have names and photos listed in disturbing database-like entries that can link
- [Sandworm-Linked Cyclops Blink Returns With Network Scanning and Packet-Sniffing Capabilities](https://cybernoz.com/sandworm-linked-cyclops-blink-returns-with-network-scanning-and-packet-sniffing-capabilities/) - A newly identified Cyclops Blink variant has resurfaced on compromised Cisco Secure Firewall Management Center (FMC) appliances, adding active internal-network scanning and programmable packet-sniffing capabilities to an already mature modular implant. Assessed with high confidence that the activity has a Russian nexus, with a moderate-confidence link to IRON VIKING also tracked as Sandworm and Seashell
- [WhatsApp Restricted Chat locks a conversation to your primary phone](https://cybernoz.com/whatsapp-restricted-chat-locks-a-conversation-to-your-primary-phone/) - WhatsApp is building a per-chat setting that keeps a conversation on a single phone. The setting, called Restricted Chat, sits in the Android beta distributed through Google Play as version 2.26.36.5, and it stops the app from syncing a chosen conversation to linked devices. Switch it on and the chat stays on the primary mobile
- [A week in security (September 7 – September 13)](https://cybernoz.com/a-week-in-security-september-7-september-13/) - Last week on Malwarebytes Labs:Crypto customers targeted by scammers after email marketing provider breachAndroid malware creates a hidden copy of your banking appBlueMoon exploit kit turns Chrome and Windows flaws into attacksWill AI kill us all within the next decade?Update Chrome now to protect against an actively exploited vulnerabilityCopyright scammers get Instagram accounts suspended and
- [Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users](https://cybernoz.com/malicious-twitch-browser-extension-leaks-oauth-tokens-from-nearly-31000-users/) - Ravie LakshmananSep 14, 2026Malware / Browser Security A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service. The extension, named "Twitch Enhanced Viewer | JeetBot," lists HISHIMIRO/jeetbot.cc as its developer and has the following identifiers on the Google Chrome Web
- [Three JFrog Artifactory Flaws Exploited for Backdoor Deployment](https://cybernoz.com/three-jfrog-artifactory-flaws-exploited-for-backdoor-deployment/) - Threat actors have been exploiting three high-severity vulnerabilities in JFrog Artifactory to compromise deployments and install backdoors, cybersecurity firm Wiz reports. Many organizations use Artifactory to manage software artifacts, binaries, AI models, containers, and packages. The three flaws, CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329, can allow attackers to bypass authentication and gain administrative privileges on vulnerable Artifactory
- [Anthropic CEO Calls for an AI Slowdown. Is It Possible?](https://cybernoz.com/anthropic-ceo-calls-for-an-ai-slowdown-is-it-possible/) - The geopolitical reality makes a voluntary, coordinated slowdown in AI development very difficult. The United States and China are competing directly in technology, industry and military capabilities, and both see advanced AI as strategically important. Washington does not want to lose its lead, while Beijing considers technological self-sufficiency a national priority. In this kind of
- [Discovering a stored XSS that affects over 900k websites (CVE-2016-9751) — Jon Bottarini](https://cybernoz.com/discovering-a-stored-xss-that-affects-over-900k-websites-cve-2016-9751-jon-bottarini/) - In my free time when I’m not hunting for bugs in paid programs, I like to contribute a bit to the open-source community and check for vulnerabilities that might arise. In doing so, I found a stored cross-site scripting vulnerability that affected over 900,000 websites… yikes. The vulnerable application is called Piwigo – an open
- [Security Posture Management for GitHub: spotting and fixing risks in your GitHub organization just got a lot easier](https://cybernoz.com/security-posture-management-for-github-spotting-and-fixing-risks-in-your-github-organization-just-got-a-lot-easier/) - A few months ago, Wiz introduced Wiz Code, a leap forward in enabling developers and security teams to shift security left — enabling positive security outcomes from the first lines of code through to production and bolstering cloud detection and response. That was just the beginning. Today, Wiz is extending its approach to secure the
- [Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four](https://cybernoz.com/dissecting-remcos-rat-an-in-depth-analysis-of-a-widespread-2024-malware-part-four/) - In previous articles in this multipart series [1] [2] [3], malware researchers on the Elastic Security Labs team decomposed the REMCOS configuration structure and gave details about its C2 commands. In this final part, you’ll learn more about detecting and hunting REMCOS using Elastic technologies. Detection and Hunt The following Elastic Defend detections trigger on
- [NCSC Warns of Critical Check Point VPN Flaws as Large-Scale Exploitation Is Expected](https://cybernoz.com/ncsc-warns-of-critical-check-point-vpn-flaws-as-large-scale-exploitation-is-expected/) - The Dutch National Cyber Security Center (NCSC) has issued an urgent warning over two critical vulnerabilities in Check Point VPN products, saying it expects large-scale exploitation attempts in the near term. Organizations using affected Check Point gateways, management systems, or Spark Firewall products should deploy the available fixes immediately. Tracked as CVE-2026-85102 and CVE-2026-85103, both
- [Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users](https://cybernoz.com/casbaneiro-banking-trojan-uses-distributed-c2-servers-to-evade-detection-and-target-bank-users/) - A Casbaneiro banking Trojan campaign targeting users across Latin America, using phishing lures, geofenced delivery infrastructure, and distributed command-and-control (C2) servers to obscure malicious activity. The operation, observed in August 2026, primarily targets victims in Argentina, Peru, Colombia, and Mexico through fake invoice and legal-notice emails carrying links to malicious PDF files. The campaign demonstrates
- [Permify: Open-source authorization as a service](https://cybernoz.com/permify-open-source-authorization-as-a-service/) - Permify is an open-source authorization service that answers access questions at run time: can user X view document Y, which posts can members of team Y edit. It keeps those rules in one place, apart from the application code that would otherwise carry them. Permify follows the design of Google Zanzibar, the authorization system Google
- [DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval](https://cybernoz.com/deepseek-harness-flaw-let-ai-agents-disable-their-own-file-sandbox-without-approval/) - A flaw in DeepSeek Harness, DeepSeek's open-source tool for running AI coding agents on a developer's machine, let a sandboxed agent turn off its own sandbox with a single command. The tool runs an agent's commands inside an operating-system sandbox, so that an agent working on untrusted files cannot write outside its workspace. The agent
- [Cyber Risk in the Mythos Era – Where do we begin?](https://cybernoz.com/cyber-risk-in-the-mythos-era-where-do-we-begin/) - Cybersecurity experts Paul Hossack and Alex Ward from Security Centric are joining Angie Fung, VITG, on a deep dive webinar on this topic. Register here. Artificial intelligence has rapidly moved from experimentation to business strategy. Yet alongside the allure of AI-enabled efficiencies, cost savings and other buzz-wordy benefits, enters whole new world of risk that
- [Conti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence](https://cybernoz.com/conti-hacker-who-built-malware-and-attacked-victims-gets-four-year-sentence/) - Conti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence Pierluigi Paganini September 13, 2026 Ukrainian lawyer and Conti malware developer Oleksii Lytvynenko was sentenced to four years in U.S. prison for ransomware attacks. Oleksii Oleksiyovych Lytvynenko had, by most accounts, a fairly ordinary legal career in Ukraine before he switched to writing malware.
- [XSS vulns galore (plus a cool shirt!) — Jon Bottarini](https://cybernoz.com/xss-vulns-galore-plus-a-cool-shirt-jon-bottarini/) - When the adult website PornHub launched their public bug bounty program, I was pretty sure that most of the low hanging fruits of vulnerabilities would be taken care of and already reported. When I first started poking around, I found my first vulnerability in less than 15 minutes. The second vulnerability was found a few
- [CVE-2024-3094: Critical RCE Vulnerability Found in XZ Utils](https://cybernoz.com/cve-2024-3094-critical-rce-vulnerability-found-in-xz-utils/) - A backdoor has been identified in versions 5.6.0 and 5.6.1 of XZ Utils (assigned CVE-2024-3094), which under some conditions may allow RCE via SSH authentication in specific versions of certain Linux distributions.March 31, 2024 - Updated diagram based on newly revealed informationApril 1, 2024 - Updated affected versions table based on latest advisoriesApril 3, 2024 - Added new research
- [Microsoft Management Console for initial access and evasion](https://cybernoz.com/microsoft-management-console-for-initial-access-and-evasion/) - Overview After Microsoft disabled office macros by default for internet-sourced documents, other infection vectors like JavaScript, MSI files, LNK objects, and ISOs have surged in popularity. However, these other techniques are scrutinized by defenders and have a high likelihood of detection. Mature attackers seek to leverage new and undisclosed infection vectors to gain access while
- [Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6](https://cybernoz.com/anthropic-discloses-fourth-ai-hacking-incident-involving-claude-opus-4-6/) - Anthropic on Wednesday disclosed a fourth incident in which its artificial intelligence (AI) model broke into real third-party systems, marking the latest in a growing list of cases that have raised concerns about the security risks posed by autonomous AI agents. The AI company said the incident dates back to January 2026 and involved an
- [AEC's election donation system build more than doubles to $70m](https://cybernoz.com/aecs-election-donation-system-build-more-than-doubles-to-70m/) - Key points The AEC's outsourced build of an election donation system has more than doubled in cost to $70 million since January, with more parts still to be commissioned. The Accenture contract, initially valued at $30 million, has been varied three times, including an amendment worth nearly $28 million starting July 1. The AEC won't
- [Security Affairs newsletter Round 594 by Pierluigi Paganini – INTERNATIONAL EDITION](https://cybernoz.com/security-affairs-newsletter-round-594-by-pierluigi-paganini-international-edition/) - Security Affairs newsletter Round 594 by Pierluigi Paganini – INTERNATIONAL EDITION Pierluigi Paganini September 13, 2026 A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. International
- [Inspect Element leads to Stripe Account Lockout Authentication Bypass — Jon Bottarini](https://cybernoz.com/inspect-element-leads-to-stripe-account-lockout-authentication-bypass-jon-bottarini/) - A common thing I see happening with many popular applications is that a developer will disable an HTML element through the “class” attribute. It usually looks something like this: href="#" name="disabled_button" class="button small grey disabled"> This works pretty well in some situations, but in other situations it can be manipulated to perform actions that really
- [Top security talks from KubeCon Europe 2024](https://cybernoz.com/top-security-talks-from-kubecon-europe-2024/) - KubeCon + CloudNativeCon Europe 2024 took place last week in Paris Expo de Versailles with over 12,000 attendees. All the conference’s videos have been promptly released on YouTube, some of them within a day of the talk delivery. Kudos to CNCF for such a prompt content turnaround. Overall, there are 246 (!) videos on the
- [Dismantling Smart App Control](https://cybernoz.com/dismantling-smart-app-control/) - Introduction Reputation-based protections like Elastic’s reputation service can significantly improve detection capabilities while maintaining low false positive rates. However, like any protection capability, weaknesses exist and bypasses are possible. Understanding these weaknesses allows defenders to focus their detection engineering on key coverage gaps. This article will explore Windows Smart App Control and SmartScreen as a
- [CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline](https://cybernoz.com/cisa-flags-exploited-cisco-citrix-fortinet-flaws-sets-sept-12-federal-patch-deadline/) - Ravie LakshmananSep 10, 2026Vulnerability / Network Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet, to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026. The vulnerabilities are listed below - CVE-2026-20079
- [SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 114](https://cybernoz.com/security-affairs-malware-newsletter-round-114/) - Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter REVSTEALER ramps up Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode GuardBreaker: Derailing AI-assisted malware analysis with a code comment DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive
- [Abusing internal API to achieve IDOR in New Relic — Jon Bottarini](https://cybernoz.com/abusing-internal-api-to-achieve-idor-in-new-relic-jon-bottarini/) - I recently found a nice insecure direct object reference (IDOR) in New Relic which allowed me to pull data from other user accounts, and I thought it was worthy of writing up because it might make you think twice about the types (and the sheer number!) of API’s that are used in popular web services.
- [Wiz4Wiz: Wiz using Wiz for cloud security](https://cybernoz.com/wiz4wiz-wiz-using-wiz-for-cloud-security/) - Navigating the complexities of cloud security, especially in expansive and dynamic environments, is a challenge. Wiz’s approach mitigates vulnerabilities and identifies potential threats from code to cloud, extending from the development process and CI/CD pipeline through to the production cloud infrastructure and services. From the earliest days of the product and company, the Wiz security
- [Beyond the wail: deconstructing the BANSHEE infostealer](https://cybernoz.com/beyond-the-wail-deconstructing-the-banshee-infostealer/) - Preamble In August 2024, a novel macOS malware named "BANSHEE Stealer" emerged, catching the attention of the cybersecurity community. Reportedly developed by Russian threat actors, BANSHEE Stealer was introduced on an underground forum and is designed to function across both macOS x86_64 and ARM64 architectures. This malware presents a severe risk to macOS users, targeting
- [Hackers exploit Tencent app flaw to deploy GrayRabbit malware](https://cybernoz.com/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/) - Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows to deploy the GrayRabbit backdoor. Researchers at cybersecurity company Gen Digital warn that the security issue is a one-click remote code execution (RCE) flaw. "We observed this vulnerability actively exploited in the wild by
- [Critical Dell ObjectScale Vulnerabilities Allows Malicious Users to Compromise the Affected system](https://cybernoz.com/critical-dell-objectscale-vulnerabilities-allows-malicious-users-to-compromise-the-affected-system/) - Dell Technologies released a security advisory about multiple vulnerabilities affecting Dell ObjectScale and Elastic Cloud Storage (ECS) deployments. Including a critical remote code execution flaw that could let an unauthenticated attacker compromise vulnerable systems. The advisory, tracked as DSA-2026-393, was published on September 10, 2026. The most severe issue is CVE-2026-70416, a critical untrusted-data deserialization
- [Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware](https://cybernoz.com/cisco-fmc-flaws-exploited-to-steal-credentials-and-deploy-qilin-ransomware/) - Ravie LakshmananSep 11, 2026Vulnerability / Malware Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated,
- [Anthropic CEO Dario Amodei Says AI Industry Needs to Give Safety Measures Time to Catch Up](https://cybernoz.com/anthropic-ceo-dario-amodei-says-ai-industry-needs-to-give-safety-measures-time-to-catch-up/) - The CEO of Anthropic said Saturday the artificial-intelligence industry should slow its fast-moving development to give safety measures time to catch up. Without such a slowdown, Dario Amodei warned that within six to 12 months AI could be capable of leading a swarm of agents that could take over the entire internet. The warning comes
- [GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read - Exploited Within 24 Hours](https://cybernoz.com/gitlab-cve-2026-85706-one-http-request-no-authentication-full-file-read-exploited-within-24-hours/) - GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours Pierluigi Paganini September 13, 2026 CVE-2026-85706, a CVSS 10.0 GitLab path traversal, was under active exploitation within 24 hours of disclosure. GitLab disclosed CVE-2026-85706 (CVSS score of 10.0) on September 10, 2026, a path traversal vulnerability in its repository commits
- [Get as image function pulls any Insights/NRQL data from any New Relic account (IDOR) — Jon Bottarini](https://cybernoz.com/get-as-image-function-pulls-any-insights-nrql-data-from-any-new-relic-account-idor-jon-bottarini/) - This writeup walks you through the full process as to how I found a pretty bad Insecure Direct Object Reference (IDOR) in New Relic. In New Relic, there is the ability to add a 3rd party integration to a product line called New Relic Infrastructure. Common integrations include AWS, Azure, and most recently Google Cloud
- [The XZ Utils backdoor, and defense-in-depth strategy](https://cybernoz.com/the-xz-utils-backdoor-and-defense-in-depth-strategy/) - The XZ Utils backdoor caused some panic throughout the security community following the announcement about it on Friday. The immediate response was reminiscent of Log4j, and thankfully, something we don’t experience very often. The Wiz research team has been working around the clock to understand the backdoor and the threat actor behind it, and to
- [Elastic publishes 2024 Global Threat Report](https://cybernoz.com/elastic-publishes-2024-global-threat-report/) - ReportsElastic Security Labs has released the 2024 Elastic Global Threat Report, surfacing the most pressing threats, trends, and recommendations to help keep organizations safe for the upcoming year.Elastic Security Labs discovers that threat actors are taking advantage of readily available and commonly abused security tools, and misconfigured environments. Elastic Security Labs has released the 2024
- [Microsoft Excel KB5002914 update breaks copy and paste for some users](https://cybernoz.com/microsoft-excel-kb5002914-update-breaks-copy-and-paste-for-some-users/) - Microsoft Excel users report that this week's KB5002914 Office security update is breaking copy-and-paste operations and formula dragging, with affected users saying that removing or rolling back the update restores normal functionality. Microsoft released the security update this week as part of its September 2026 Patch Tuesday, and reports of the problem soon appeared on
- [Plesk Backup Manager Flaw Lets Low-Privileged Users Gain Root Access to Servers](https://cybernoz.com/plesk-backup-manager-flaw-lets-low-privileged-users-gain-root-access-to-servers/) - A newly disclosed vulnerability in Plesk Backup Manager could allow low-privileged users to escalate privileges and gain full root access on affected Linux servers. Tracked as CVE-2026-68488, the flaw stems from a symlink race condition during subscription-content restore operations. The issue affects Plesk Obsidian installations running Plesk for Linux versions 18.0.80.6 and earlier, as well
- [Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data](https://cybernoz.com/attackers-use-passkey-phishing-to-hijack-microsoft-cloud-accounts-and-exfiltrate-data/) - Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. The first campaign, per the tech giant, involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as
- [Anthropic CEO urges AI companies to slow model development](https://cybernoz.com/anthropic-ceo-urges-ai-companies-to-slow-model-development/) - Anthropic CEO Dario Amodei called on AI companies to slow the rate at which they advance model capabilities amid mounting ⁠fears of misuse ⁠of artificial intelligence, outlining a three-step framework intended to pace development and create more time to manage its risks. "We must slow the pace at which we improve the capabilities of AI
- [Using Burp Suite match and replace settings to escalate your user privileges and find hidden features — Jon Bottarini](https://cybernoz.com/using-burp-suite-match-and-replace-settings-to-escalate-your-user-privileges-and-find-hidden-features-jon-bottarini/) - On May 14th, Lew Cirne, the CEO of New Relic, announced a new platform called New Relic One. The platform, featuring a fresh new design and better data visualizations, came as a surprise to investors and New Relic users alike. But it did not come as a surprise to me, for I had found out
- [Why post-quantum cryptography is a national security priority](https://cybernoz.com/why-post-quantum-cryptography-is-a-national-security-priority/) - So, the impact is pretty evident, but it’s the likelihood where things get complicated. First, there is the likelihood that this won’t happen at all, as well as that it won’t happen on a time scale that matters for current investment strategies. The remaining likelihood points to an increasingly near-term threat. How do the players
- [Effortless SBOM search in your cloud with Wiz](https://cybernoz.com/effortless-sbom-search-in-your-cloud-with-wiz/) - In our earlier blog on agentless SBOM, we explored how Wiz automates SBOM creation at the runtime level. These SBOMs give Wiz users access to crucial information on all OS packages, open-source libraries, and their versions, providing instant visibility. To facilitate compliance, Wiz also offers the option of exporting reports in standard formats such as
- [Tricks and Treats: GHOSTPULSE’s new pixel-level deception](https://cybernoz.com/tricks-and-treats-ghostpulses-new-pixel-level-deception/) - Update This research covers an update to stage 2 of GHOSTPULSE, originally disclosed by Elastic Security Labs in October 2023. Key takeaways GHOSTPULSE has shifted from using the IDAT chunk of PNG files to embedding its encrypted configuration and payload within the pixel structure. Recent campaigns involve tricking victims with creative social engineering techniques, such
- [Surfshark VPN says hackers breached internal testing, proxy servers](https://cybernoz.com/surfshark-vpn-says-hackers-breached-internal-testing-proxy-servers/) - Surfshark disclosed that hackers accessed one of its internal test servers after a configuration error exposed it to the internet. The VPN service provider said the incident did not affect its customers and did not extend to other parts of its infrastructure, but it exposed service configurations and build-related credentials. “Due to a human error,
- [Revolut Data Breach Exposes Customers' Passport Copies and Full Transaction Histories to Hackers](https://cybernoz.com/revolut-data-breach-exposes-customers-passport-copies-and-full-transaction-histories-to-hackers/) - Revolut has disclosed a data-security incident in which sensitive customer information was released after the financial technology company received a fraudulent request that appeared to originate from a legitimate government agency. The incident reportedly exposed highly sensitive Know Your Customer (KYC) documentation and detailed financial records belonging to a limited number of users, including passport
- [Hackers Weaponize AI Safety Guardrails to Hide Malware From LLM-Powered Security Scanners](https://cybernoz.com/hackers-weaponize-ai-safety-guardrails-to-hide-malware-from-llm-powered-security-scanners/) - Threat actors are adapting malware not only for conventional endpoint defenses and sandboxes, but also for large language model-powered tools increasingly used to triage suspicious code. ESET researchers linked the activity to Russia-aligned threat actor UAC-0099, which used the method during an attack against an organization in Ukraine. The group inserted a safety-sensitive, weapon-related request
- [PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws](https://cybernoz.com/papercut-replaces-emergency-patches-with-fixes-for-two-actively-exploited-flaws/) - Ravie LakshmananSep 11, 2026Vulnerability / Cyber Attack PaperCut on Thursday released a new security maintenance release that replaces all previously published emergency patches that were pushed to address two security flaws that have come under active exploitation. The software development company said PaperCut NG/MF versions 26.0.5, 25.0.13 and 24.1.10 are now available for customers to
- [Kiteworks Acquires Bonfy.AI to Fill the AI Gap in Data Governance](https://cybernoz.com/kiteworks-acquires-bonfy-ai-to-fill-the-ai-gap-in-data-governance/) - Kiteworks has announced the acquisition of AI data security company Bonfy.AI, a move aimed at extending real-time policy enforcement over sensitive data exchanged by both human users and AI agents. Kiteworks delivers a content-sharing platform to safeguard sensitive data as it moves across enterprise networks, external organizations, and internal systems. It includes regulatory compliance, governance,
- [Don’t Reply: A Clever Phishing Method In Apple’s Mail App — Jon Bottarini](https://cybernoz.com/dont-reply-a-clever-phishing-method-in-apples-mail-app-jon-bottarini/) - About four or five years ago, friend and fellow bug bounty hunter Sam Curry asked if I had “ever thought about what was possible to load inside an tag, besides an image“. What a peculiar question. I didn’t really understand what he was asking, and I assume Sam got bored of me guessing the wrong
- [How to pen test LLM, RAG and GenAI applications](https://cybernoz.com/how-to-pen-test-llm-rag-and-genai-applications/) - Use Python to make the attack repeatable Manual probing is valuable for discovery, but it is a poor regression method. A small Python harness can define an objective, generate approved mutations, send them through the same interface used by clients, capture retrieval and tool traces, score the result and preserve evidence. The code should run
- [Wiz and Tines: Operationalizing cloud security](https://cybernoz.com/wiz-and-tines-operationalizing-cloud-security/) - As cloud and AI development continues to grow and change at an unprecedented pace, organizations must prioritize securing these environments at scale. Traditional approaches to security combined with modern service ownership often led to friction across teams, with conflicting priorities and competing objectives hampering the goal of mitigating risks and managing incidents. To address this challenge,
- [Announcing the Elastic Bounty Program for Behavior Rule Protections](https://cybernoz.com/announcing-the-elastic-bounty-program-for-behavior-rule-protections/) - Introduction We’re excited to introduce a new chapter in our security bounty program on HackerOne that we soft launched in December 2024. Elastic is now offering a unique opportunity for researchers to test our detection rules (SIEM) and endpoint rules (EDR), helping to identify gaps, vulnerabilities, and areas for improvement. This program builds on the
- [Trezor: 347,000 users targeted in phishing attacks after Brevo breach](https://cybernoz.com/trezor-347000-users-targeted-in-phishing-attacks-after-brevo-breach/) - Trezor has revealed that phishing attacks against its customers earlier this week targeted 347,000 email addresses and affected 2,500 users who clicked an embedded malicious link. As Trezor warned on Wednesday, threat actors who breached Brevo, its third-party email provider, were emailing customers who opted in to receive newsletters. According to customers targeted in this
- [CISA Warns of Critical GitLab Vulnerability Exploited in Attacks](https://cybernoz.com/cisa-warns-of-critical-gitlab-vulnerability-exploited-in-attacks/) - The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical GitLab flaw, tracked as CVE-2026-85706, to its Known Exploited Vulnerabilities catalog after confirming it was exploited in attacks. The issue affects both GitLab Community Edition and Enterprise Edition and requires urgent mitigation, particularly for internet-accessible GitLab instances. CVE-2026-85706 is a path traversal vulnerability
- [China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor](https://cybernoz.com/china-linked-unc3569-exploited-sogou-input-method-flaw-to-deploy-grayrabbit-backdoor/) - A China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims' computers, security company Gen Digital said in research published Thursday. The attack started with a crafted link and ended with the attacker able to do
- [Optus outage attributed to hardware failure at exchange](https://cybernoz.com/optus-outage-attributed-to-hardware-failure-at-exchange/) - Key points A hardware failure at an Optus exchange in Victoria caused a voice outage lasting about one hour and 16 minutes on Friday. The outage affected customers in parts of Victoria, South Australia, Tasmania and the Northern Territory, disrupting triple zero connections and prompting welfare checks in three states. Around 190,000 customers had two
- [Check Point Patches Critical VPN Vulnerabilities](https://cybernoz.com/check-point-patches-critical-vpn-vulnerabilities/) - Cybersecurity firm Check Point this week announced patches for two critical-severity vulnerabilities in its gateway and firewall products using VPN functionality. Tracked as CVE-2026-85102 and CVE-2026-85103 (CVSS score of 9.8), both security defects could be exploited without authentication for remote code execution (RCE), Check Point warns. The former is described as an improper validation of
- [Revolut Exposed KYC Data After Fraudulent Government Email Passed Security Checks](https://cybernoz.com/revolut-exposed-kyc-data-after-fraudulent-government-email-passed-security-checks/) - Revolut Exposed KYC Data After Fraudulent Government Email Passed Security Checks Pierluigi Paganini September 12, 2026 Revolut handed over KYC documents, selfies, and Bitcoin transaction histories after a fake government email with valid domain credentials passed its checks. Revolut confirmed on September 12, 2026, that it disclosed sensitive customer data to an unauthorized third party
- [Google’s Early Access is creating a blind spot for malicious apps](https://cybernoz.com/googles-early-access-is-creating-a-blind-spot-for-malicious-apps/) - “If the company supplies and owns the phone, then the organization owns the full operating system, but provisions an isolated Work Profile alongside a Personal Profile,” Stahie said. “Everything related to work, email clients, and any other apps runs in its own separate sandbox, and the user can’t install anything they shouldn’t in the Work
- [Wiz acquires Gem Security to reinvent cloud threat detection](https://cybernoz.com/wiz-acquires-gem-security-to-reinvent-cloud-threat-detection/) - Wiz turned 4 last month, and what a journey it has been. 4 years ago, my fellow co-founders and I left Microsoft with a conviction that cloud security needed to be reinvented, unknowingly walking headfirst into a global pandemic. Since then, there have been more Wiz milestones than I can count thanks to our amazing
- [Now available: the 2025 State of Detection Engineering at Elastic](https://cybernoz.com/now-available-the-2025-state-of-detection-engineering-at-elastic/) - We’ve been working hard at Elastic Security Labs! We've just published a brand new report: the 2025 State of Detection Engineering at Elastic. This report gives readers an exclusive look into the work of developing and maintaining our pre-built SIEM Detection rules and Endpoint Protection Behavior rulesets. In this report, you'll get an inside look
- [Microsoft fixes Teams, Outlook launch failures on ARM Windows PCs](https://cybernoz.com/microsoft-fixes-teams-outlook-launch-failures-on-arm-windows-pcs/) - Microsoft has fixed a bug that prevented Teams and Outlook from launching after installing updates released since the August 2026 Patch Tuesday. The company confirmed last week that this known issue affects users who haven't installed Microsoft Store updates on ARM-based Windows devices (such as the Surface Pro 11 and Surface Laptop 7) running Windows
- [Beyond the Perimeter: Building Resilience Against Cloud and SaaS Supply-Chain Attacks](https://cybernoz.com/beyond-the-perimeter-building-resilience-against-cloud-and-saas-supply-chain-attacks/) - A critical zero-day vulnerability in Oracle PeopleSoft exposed the Council of Europe and scores of other organizations to data theft and extortion in May and early June 2026. The ShinyHunters hacking group exploited the flaw across about 100 organizations and 300 instances worldwide, according to reports cited by The Register. The attackers targeted the management and configuration layers of enterprise resource-planning systems, stealing sensitive records.
- [OpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build System for RCE](https://cybernoz.com/openai-agents-flood-rubygems-with-2000-packages-and-exploit-build-system-for-rce/) - A swarm of AI agents believed to be operated internally by OpenAI uploaded more than 2,000 malicious packages to RubyGems in May 2026, abusing the ecosystem’s documentation build process to execute code remotely and attempting to steal user API keys through a then-undisclosed server-side flaw. Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx said
- [CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV](https://cybernoz.com/cisa-adds-5-actively-exploited-artifactory-screenconnect-and-routeros-flaws-to-kev/) - Ravie LakshmananSep 12, 2026Vulnerability / Enterprise Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. Details of the vulnerabilities are as follows - CVE-2026-42016 (CVSS score: 8.1)
- [Ryanair calls for government action over Nats IT failure](https://cybernoz.com/ryanair-calls-for-government-action-over-nats-it-failure/) - Yesterday’s IT failure of the UK’s National Air Traffic Control System (Nats) has caused major disruption, impacting airports, airlines and passengers. The BBC reported that tens of thousands of passengers were hit by disruption that saw more than 1,750 flights cancelled on Tuesday, with a further 153 cancelled since at the time of writing. Nats
- [Ukrainian Conti Ransomware Developer Sentenced to 4 Years in US Prison](https://cybernoz.com/ukrainian-conti-ransomware-developer-sentenced-to-4-years-in-us-prison/) - A United States court sentenced Ukrainian national Oleksii Oleksiyovych Lytvynenko to four years in prison this week for his role in the Conti ransomware operation. Lytvynenko, 44, was arrested in Ireland in 2023 and extradited to the United States in late 2025. He pleaded guilty to wire fraud in June 2026, admitting to helping the
- [Attackers use passkey-themed scams to hijack Microsoft 365 accounts](https://cybernoz.com/attackers-use-passkey-themed-scams-to-hijack-microsoft-365-accounts/) - Attackers registered their own authentication methods Once an identity was compromised, Microsoft observed attackers registering authentication methods under their control, including phone numbers, authenticator applications, and software-based OTP tokens. This gave them a way to satisfy future MFA challenges without the legitimate user. Attackers then used Microsoft Graph to enumerate users, groups, roles, authentication methods,
- [Democratizing security for maximum visibility and impact](https://cybernoz.com/democratizing-security-for-maximum-visibility-and-impact/) - Every company in the world is becoming a technology company. Cloud and AI are tremendous enablers that allow teams to quickly transform everything from business models to operations. Developers can quickly build applications to delight customers by using open-source components and innovative services from cloud providers and run them at scale by spinning up ephemeral
- [Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence](https://cybernoz.com/phishing-attacks-serve-browser-in-the-browser-pages-rogue-rmm-persistence/) - BackgroundThe Huntress Security Operations Center (SOC) recently came across two interesting variants of the same attack involving a browser-in-the-browser (BiTB) phishing technique. BiTB is a tactic where an attacker spins up an entire fake browser window (including the address bar, URL, padlock icon, favicon, and more) inside the actual webpage content itself, usually using HTML/CSS/JavaScript. Because
- [Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent](https://cybernoz.com/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/) - The Dutch Nationaal Cyber Security Centrum (NCSC) is warning of imminent exploitation of two critical flaws in Check Point VPN tracked as CVE-2026-85102 and CVE-2026-85103. Although no public proof-of-concept (PoC) exploit has been reported, the agency is urging organizations to install the security updates addressing the two issues as soon as possible. “The NCSC assesses
- [Multiple VLC Media Player Vulnerabilities Allow Attackers to Corrupt or Read Heap Memory](https://cybernoz.com/multiple-vlc-media-player-vulnerabilities-allow-attackers-to-corrupt-or-read-heap-memory/) - Two security vulnerabilities in VLC Media Player could allow attackers to corrupt heap memory or disclose sensitive data from a victim’s memory. The flaws, tracked as CVE-2026-56711 and CVE-2026-73324, affect VLC Media Player versions 3.0.0 through 3.0.23 and require a victim to open a specially crafted media file or playlist entry. Fabian Wahle of Hap
- [China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks](https://cybernoz.com/china-linked-hackers-chain-chrome-zero-day-with-windows-kernel-flaw-in-attacks/) - China-linked threat actors UTA0560 and JungleBamboo chained a Google Chrome zero-day with a Windows kernel privilege-escalation flaw in phishing campaigns targeting NGOs and other victims. Volexity documented the operations, detected on September 1, 2026, as using identical browser-to-kernel exploit components but ultimately installing separate espionage payloads: the GRIMWEDGE JScript backdoor and the LONGTALE credential-stealing Chrome
- [New infosec products of the week: September 11, 2026](https://cybernoz.com/new-infosec-products-of-the-week-september-11-2026/) - Here’s a look at the most interesting products from the past week, featuring releases from Akeyless, Orchid Security, Scytale, and Securin. Securin Platform helps security teams prove when attack paths are closed Securin has announced the general availability of the Securin Platform, an AI-native Preemptive Exposure Management platform designed to answer three questions security teams
- [Your Critical Vulnerabilities Might Not Be Your Biggest Risk](https://cybernoz.com/your-critical-vulnerabilities-might-not-be-your-biggest-risk/) - Security teams have become exceptionally talented at finding vulnerabilities. Now, it’s time to turn our attention to optimizing the process for determining which of those vulnerabilities actually create a path to compromise. A critical vulnerability may look alarming on a scanner report, but if it sits behind strong segmentation, identity controls, and other defenses that
- [Capita meeting self-imposed civil service pension targets ‘not sufficient’, says government](https://cybernoz.com/capita-meeting-self-imposed-civil-service-pension-targets-not-sufficient-says-government/) - The government said Capita’s performance on the troubled civil service pension scheme “remains unacceptable” despite the outsourcer reporting it has reached its latest target. In a written update on the disastrous outsourcing contract, Sally Jameson MP, parliamentary secretary in the Cabinet Office, said Capita meeting its self-imposed targets is “not sufficient progress” and does not
- [BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days](https://cybernoz.com/bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days/) - Multiple espionage groups have been using a new exploit kit dubbed BlueMoon in seemingly opportunistic and rushed deployments, cybersecurity firm Proofpoint reports. The China-linked APT Violet Typhoon (also tracked as APT31, JungleBamboo, TA412, and Tide Castle) was the first to use it on August 28. Within days, several other Chinese threat actors started using it,
- [Anthropic finds evidence of a fourth AI escaping from containment](https://cybernoz.com/anthropic-finds-evidence-of-a-fourth-ai-escaping-from-containment/) - After this discovery, the company instigated a wider search of 481 million transcripts, covering all those from its Frontier Red Team, some non-cyber evaluations, reinforcement learning environments, and more, to see if any other incidents had occurred. So far, this search has only identified the four already-known incidents, it said. It has also reported details
- [Introducing automatic remediation policies with Cloudflare CASB](https://cybernoz.com/introducing-automatic-remediation-policies-with-cloudflare-casb/) - Today, we’re making Cloudflare CASB more powerful than ever by introducing automatic remediation policies. This means security teams can now design event-driven logic to revoke risky file shares and dispatch custom webhooks, without manual intervention.When we launched Cloudflare CASB, a cloud access security broker, we wanted to provide security teams complete visibility into the posture
- [Grand Theft Auto VI hype leads to malware](https://cybernoz.com/grand-theft-auto-vi-hype-leads-to-malware/) - Acknowledgments: Special thanks to Jon Semon, Andrew Brant, and Lindsey O'Donnell-Welch for their contributions to this investigation and writeup.BackgroundThere's still three months until the release of Grand Theft Auto VI (GTA6), but the internet has already reached a fever pitch thanks to a slate of gameplay footage leaks, as well as an official extended look. Not
- [How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface](https://cybernoz.com/how-threat-actors-are-turning-trusted-ai-platforms-into-an-attack-surface/) - As AI platforms become part of daily workflows, attackers have found a new way in: the platforms themselves. The Huntress Security Operations Center (SOC) says the bigger day-to-day risk comes from threat actors abusing the AI features people already trust and rely on, rather than attacks on the AI companies or models themselves. Over the
- [Containing Machine Speed Cyber Attacks Inside AI Infrastructure](https://cybernoz.com/containing-machine-speed-cyber-attacks-inside-ai-infrastructure/) - A critical flaw in current security operations is assuming time is on our side. Historically, attacks progressed slowly, allowing analysts and response teams time to detect, discuss, and respond. Even severe incidents operated at a human pace. Our defenses have relied on human error, human speed, and human limitations. That era is over. AI-driven adversaries
- [From Hacks to Bioweapons, Claude Misuse Is Now Everywhere](https://cybernoz.com/from-hacks-to-bioweapons-claude-misuse-is-now-everywhere/) - In one case, a group of Russian state-sponsored hackers identified by Microsoft as Midnight Blizzard used Claude for reconnaissance, breaching targets that included Ukrainian and other European government networks, and stole data and maintained access. Cybercriminal group ShinyHunters used Claude in practically every stage of its hacking and extortion campaigns. Disinformation campaigns focusing on politics
- [Threat Actors Use Claude AI Agents to Automate Cyberattacks and Steal Sensitive Data](https://cybernoz.com/threat-actors-use-claude-ai-agents-to-automate-cyberattacks-and-steal-sensitive-data/) - Threat actors are increasingly using Claude-based AI workflows to automate cyberattacks, accelerate data theft, and reduce the technical expertise needed to run complex intrusions. Anthropic’s report details cyber espionage, financially motivated extortion, supply-chain compromise, and hacktivist activity disrupted between December 2025 and August 2026. Rather than using an AI chatbot only for occasional coding assistance,
- [Ubuntu 24.04.5 LTS release patches security bugs across ten flavors](https://cybernoz.com/ubuntu-24-04-5-lts-release-patches-security-bugs-across-ten-flavors/) - Canonical shipped Ubuntu 24.04.5 LTS, bundling security updates and fixes for high-severity bugs into new installation media for the “Noble Numbat” release. Anyone installing fresh now gets those corrections baked in from the start, cutting the batch of updates that would normally follow setup. The point release covers more than the desktop and server editions.
- [OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers](https://cybernoz.com/openai-agents-linked-to-rubygems-campaign-that-gained-rce-on-rubydoc-servers/) - The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. On May 12, Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, disclosed details of a coordinated
- [AWS AI Symposium: Public sector must move to full AI transformation](https://cybernoz.com/aws-ai-symposium-public-sector-must-move-to-full-ai-transformation/) - Public sector organisations must move beyond “conversational AI [artificial intelligence]” to “full transformation”. Those that do, and redesign workflows around advanced AI technology, report average efficiency gains of 68%, against 40% for basic users, with productivity and decision-making improved. Those are among the messages – and claimed benefits – delegates heard at this week’s AWS
- [Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack](https://cybernoz.com/trezor-says-347000-users-received-phishing-emails-after-brevo-hack/) - Cold cryptocurrency storage provider Trezor says roughly 347,000 of its customers received phishing emails after a third-party marketing platform used by the company was hacked. The incident involved the marketing platform Brevo, which Trezor uses for newsletters. Brevo said an attacker exploited how it handles SAML Single Sign-On (SSO) to access 138 accounts. “The attacker
- [India’s STPI serves TerminalFix-style attack via fake Cloudflare check](https://cybernoz.com/indias-stpi-serves-terminalfix-style-attack-via-fake-cloudflare-check/) - Looks like TerminalFix The technique observed in this case is consistent with an attack pattern Microsoft calls TerminalFix, a variant of ClickFix. These attacks use spoofed verification pages to prompt users to copy and execute commands locally, moving the point of compromise outside traditional web security controls. “The technique follows the same playbook: fake verification
- [AI-powered risk remediation with Wiz and Amazon Bedrock](https://cybernoz.com/ai-powered-risk-remediation-with-wiz-and-amazon-bedrock/) - Artificial Intelligence has revolutionized the way organizations function, improving efficiency by automating tasks that were traditionally manual. We previously introduced Wiz’s AI-powered remediation guidance, which helps organizations improve their time to remediation. Today we're excited to announce our newest GenAI integration with Amazon Bedrock, which enables customers to generate guided remediation steps backed by foundation
- [Elastic Security scores 100% in AV-Comparatives Business Security Test](https://cybernoz.com/elastic-security-scores-100-in-av-comparatives-business-security-test/) - We’re thrilled to share that Elastic Security achieved a score of 100% in the recent AV-Comparatives Business Security Test. Why the AV-Comparatives Business Security Test matters AV-Comparatives is a highly respected organization that conducts rigorous, independent testing specifically for business endpoint security solutions. Unlike consumer antivirus tests, AV-Comparatives evaluations go beyond basic malware detection. The
- [Passkey-themed phishing attacks lead to Microsoft 365 data theft](https://cybernoz.com/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft/) - Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single sign-on-themed social engineering attacks to compromise corporate Microsoft accounts and steal data from Microsoft 365 services. The activity has been observed since May 2026 and begins with the attackers researching targeted organizations and employees before calling or messaging victims
- [CISA Warns of GitLab Path Traversal Vulnerability Exploited in Attacks](https://cybernoz.com/cisa-warns-of-gitlab-path-traversal-vulnerability-exploited-in-attacks/) - The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical GitLab vulnerability, tracked as CVE-2026-85706, to its Known Exploited Vulnerabilities catalog, warning that attackers are actively exploiting the flaw. The issue affects GitLab Community Edition and Enterprise Edition deployments and carries a maximum CVSS severity score of 10.0. CVE-2026-85706 is a path traversal
- [New Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets](https://cybernoz.com/new-phishing-campaign-abuses-windows-mshta-exe-to-steal-credentials-and-secrets/) - A newly identified phishing campaign is abusing the legitimate Windows utility mshta.exe to execute malicious HTML Application (HTA) files, conduct system reconnaissance, and potentially deploy payloads designed to steal credentials and local secrets. Fortra’s Intelligence and Research Experts (FIRE) said the activity began in June and remains active, with operators regularly recompiling malware samples to
- [AI is changing what Salesforce security needs to govern](https://cybernoz.com/ai-is-changing-what-salesforce-security-needs-to-govern/) - Existing security and governance practices have largely focused on identities, permissions, access, configurations and controls. WithSecure’s Navigating Trust in the Modern Salesforce Ecosystem paper says Salesforce environments also require organizations to understand what information they rely on, how trust extends across connected systems, what actions are performed and what outcomes those actions produce. A Trust
- [Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection](https://cybernoz.com/russian-state-sponsored-hackers-use-claude-to-rebuild-malware-after-detection/) - Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve. The operation has been attributed to a cyber espionage group it calls GTG-20006 (where "GTG" stands for Generative Threat Group), which aligns with broader reporting
- [Civil service union welcomes pension scheme insourcing plan](https://cybernoz.com/civil-service-union-welcomes-pension-scheme-insourcing-plan/) - The Public and Commercial Services Union (PCS) has welcomed the government’s stance on bringing the civil service pension scheme (CSPS) administration in-house. Plans to bring the Civil Service Pension Scheme (CSPS) administration in-house, amid the current problems under the stewardship of outsourcer Capita, are currently being worked on. PCS general secretary Fran Heathcote met with
- [Users in Houthi-Held Yemen Tried to Develop Advanced Weapons With AI, Anthropic Says](https://cybernoz.com/users-in-houthi-held-yemen-tried-to-develop-advanced-weapons-with-ai-anthropic-says/) - Anthropic says Claude users in northern Yemen, territory controlled by Iran-backed Houthi rebels, tried to use the AI model to develop advanced missiles. AI is already transforming warfare from Ukraine to Gaza, and its use on a rugged and remote battlefield is likely to increase concerns about its rapid spread. Anthropic said the users of
- [Researchers say OpenAI agents were behind May hacking campaign targeting RubyGems](https://cybernoz.com/researchers-say-openai-agents-were-behind-may-hacking-campaign-targeting-rubygems/) - Researchers say they have discovered thousands of malicious software packages uploaded to an online public software repository that were left by a “swarm” of OpenAI agents. According to an incident timeline published Friday by researchers Spencer Kitts, Thomas Larsen and Sydney Von Arx, the campaign began May 5 when they observed a handful of suspicious
- [ConnectWise patches critical ScreenConnect authentication failure after five days](https://cybernoz.com/connectwise-patches-critical-screenconnect-authentication-failure-after-five-days/) - ConnectWise has issued a security update for ScreenConnect, five days after warning customers the product could allow files to be transferred and executed through active remote sessions without authorization or confirmation. The company warned customers on Sept. 3 of the problem with support and access sessions in ConnectWise Remote Access, advising admins to log in
- [Cyware supports NRECA research to improve OT monitoring, threat detection across electric cooperatives](https://cybernoz.com/cyware-supports-nreca-research-to-improve-ot-monitoring-threat-detection-across-electric-cooperatives/) - Cyware, vendor of agentic AI-powered operationalized threat intelligence and collective defense, announced it is supporting the research arm of the National Rural Electric Cooperative Association (NRECA), the national trade association representing nearly 900 electric cooperatives with its Department of Energy (DOE) funded effort to expand OT monitoring across the electric sector. “Information sharing within Operational
- [Wiz Runtime Sensor for Linux](https://cybernoz.com/wiz-runtime-sensor-for-linux/) - Today marks an exciting milestone as we unveil the public preview launch of the Wiz Runtime Sensor for Linux, expanding coverage of threat detection and response for cloud workloads. The rapid pace of innovation in cloud-native applications has introduced novel attack vectors, posing challenges to conventional threat detection tools not specifically built for the cloud. As
- [Elastic excels in AV-Comparatives EPR Test 2025: A closer look](https://cybernoz.com/elastic-excels-in-av-comparatives-epr-test-2025-a-closer-look/) - In a threat landscape defined by sophisticated, multistage attacks, enterprises demand endpoint security solutions that not only detect threats but also actively prevent them and enable rapid responses when the unexpected occurs. Elastic Security demonstrated exceptional performance in a recent AV-Comparatives evaluation, achieving a remarkable 99.3% detection rate. This impressive and consistent figure across both
- [Florida confirms DMV database breached via stolen police account](https://cybernoz.com/florida-confirms-dmv-database-breached-via-stolen-police-account/) - The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed that its DAVID driver database suffered a data breach after the ShinyHunters extortion gang claimed to have compromised the system. The disclosure comes after the ShinyHunters extortion group claimed it breached the DAVID database and stole more than 200,000 driver records. "On September 4,
- [Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments](https://cybernoz.com/hackers-impersonate-ceos-in-1-million-emails-to-trick-employees-into-50000-payments/) - A large email fraud campaign used fake CEO messages and invoices to push employees toward payments of nearly $50,000. The operation did not rely on a malicious attachment or software flaw. Instead, it used ordinary email to deliver a scam. The attackers sent over one million messages to users between August 3 and 5. Most
- [CISA Adds Exploited MikroTik RouterOS Flaws to Security Alert](https://cybernoz.com/cisa-adds-exploited-mikrotik-routeros-flaws-to-security-alert/) - The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities in MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, warning that these flaws are actively being exploited in the wild. On September 10, CISA listed CVE-2026-67277 and CVE-2026-86060, giving affected organizations until September 13 to implement vendor-recommended mitigations. MikroTik RouterOS Flaws CVE-2026-67277
- [Companies may be measuring phishing resilience the wrong way](https://cybernoz.com/companies-may-be-measuring-phishing-resilience-the-wrong-way/) - Companies that judge phishing simulation programs by how often employees click simulated attack emails may be overlooking more important indicators of cyber resilience, according to Pistachio’s Phishing Behaviour Report 2026. Examples of difficult simulations (Source: Pistachio) The analysis covered 648 organizations with a complete 12-month record and 123,692 users between June 1, 2025, and May
- [Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks](https://cybernoz.com/anthropic-says-seven-china-based-ai-labs-ran-industrial-scale-claude-distillation-attacks/) - Ravie LakshmananSep 11, 2026Artificial Intelligence / Cybercrime Anthropic on Thursday said it identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, including Alibaba, Moonshot, DeepSeek, Z.ai (aka Zhipu), and MiniMax. Knowledge distillation by itself is a legitimate training method. It refers to a machine learning technique where a large,
- [IT event dive: Through the AWS public sector symposium revolving door](https://cybernoz.com/it-event-dive-through-the-aws-public-sector-symposium-revolving-door/) - It’s a sunny morning in the City of London, and I’m off to the AWS Public Sector AI Symposium. From my hotel room, one end of Tower Bridge peeps through the gaps in nondescript office blocks. Crystal Palace Hill sits distant, and a railway line runs; less used than I expected it to be when
- [GitLab Vulnerability Exploited One Day After Disclosure](https://cybernoz.com/gitlab-vulnerability-exploited-one-day-after-disclosure/) - Threat actors have started exploiting a newly patched vulnerability in GitLab one day after public disclosure, attack surface management firm WatchTowr warns. Tracked as CVE-2026-85706 (CVSS score of 10/10), the security defect is described as a path traversal issue that can allow unauthenticated users to read arbitrary files from the GitLab server. All Community Edition
- [Accountability, oversight and AI: Inside Microsoft’s security transformation](https://cybernoz.com/accountability-oversight-and-ai-inside-microsofts-security-transformation/) - Stung by years of embarrassing hacks, the tech giant overhauled how it approached cybersecurity. Company leaders now say they’re seeing results. Source link
- [Cyberattack causes a flight delay? Airlines won’t owe you a hotel or meal](https://cybernoz.com/cyberattack-causes-a-flight-delay-airlines-wont-owe-you-a-hotel-or-meal/) - Beginning next month, if a flight is canceled or delayed because of a cyberattack, feds will give airlines clearance not to hand out meal vouchers or hotels. The change is the result of a broader rule the Transportation Department published last week that establishes a new “cause of delay” category for tracking information, but that
- [Exclusive | AI fight shadows final preparations for Xi Jinping’s White House visit to meet Donald Trump](https://cybernoz.com/exclusive-ai-fight-shadows-final-preparations-for-xi-jinpings-white-house-visit-to-meet-donald-trump/) - Washington and Beijing are discussing the possibility of folding a long-awaited AI dialogue into a broader economic meeting in the days before Xi meets US President Donald Trump, according to several people familiar with the arrangements.The two leaders agreed in Beijing in May to launch an intergovernmental dialogue on AI. For months, that channel was
- [Why AI raises the stakes for exposure validation](https://cybernoz.com/why-ai-raises-the-stakes-for-exposure-validation/) - AI dominated the conversation at Fal.Con 2026, but one of the most important takeaways wasn’t simply how AI is changing cyber defense. It was how AI is changing the speed and scale of a problem defenders already face. Security teams already have more vulnerabilities and security signals than they can reasonably act on. As AI
- [Finite State highlights firmware visibility challenge as EU Cyber Resilience Act vulnerability reporting begins](https://cybernoz.com/finite-state-highlights-firmware-visibility-challenge-as-eu-cyber-resilience-act-vulnerability-reporting-begins/) - Finite State, vendor of product security and software supply-chain risk management, announced that connected device manufacturers using its platform are ready for the EU Cyber Resilience Act’s Sept. 11 reporting obligations. These manufacturers will enter the deadline able to answer the notification’s hardest question: whether an actively exploited vulnerability is present and reachable in the
- [CIS and OpenAI launch AI cyber defense pilot to strengthen security across critical infrastructure, SLTT governments](https://cybernoz.com/cis-and-openai-launch-ai-cyber-defense-pilot-to-strengthen-security-across-critical-infrastructure-sltt-governments/) - The Center for Internet Security Inc. (CIS), in collaboration with OpenAI, announced an AI Cyber Defense Pilot designed to help U.S. State, Local, Tribal, and Territorial (SLTT) governments and critical infrastructure organizations harness the power of artificial intelligence to enhance cybersecurity and resilience. As cyber threats become more sophisticated and widespread, foreign adversaries continue to
- [Wiz verifies your K8s security with OWASP top 10 framework](https://cybernoz.com/wiz-verifies-your-k8s-security-with-owasp-top-10-framework/) - Since its inception, Wiz has been committed to securing public and hybrid cloud environments against emerging threats. As Kubernetes is a cloud in its own right, its security is central to our mission. With over two years of dedicated effort, Wiz has continually evolved its methodologies to comprehensively address all facets of Kubernetes security based
- [FlipSwitch: a Novel Syscall Hooking Technique](https://cybernoz.com/flipswitch-a-novel-syscall-hooking-technique/) - FlipSwitch: a Novel Syscall Hooking Technique Syscall hooking, particularly by overwriting pointers to syscall handlers, has been a cornerstone of Linux rootkits like Diamorphine and PUMAKIT, enabling them to hide their presence and control the flow of information. While other hooking mechanisms exist, such as ftrace and eBPF, each has its own pros and cons,
- [Hackers abused Claude to extract secrets from 1.8M Android apps](https://cybernoz.com/hackers-abused-claude-to-extract-secrets-from-1-8m-android-apps/) - Anthropic says multiple threat groups, including the financially motivated and state-sponsored espionage groups linked to Russia and China, tried to abuse its Claude AI model for malicious purposes. The AI company says that between December 2025 and August 2026, it recorded various forms of artificial intelligence misuse, including for cyber and influence operations, surveillance, scams,
- [New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks](https://cybernoz.com/new-kataru-iot-malware-packs-linux-privilege-escalation-exploits-and-mirai-style-ddos-attacks/) - KATARU is a newly observed IoT malware strain that can turn poorly secured devices into DDoS attack nodes. The sample was captured after an attacker used repeated Telnet password guesses against a honeypot, then downloaded an ARM payload. It shows how old entry points still give attackers a foothold. The malware resembles the Mirai botnet
- [Anthropic Discloses Fourth Incident of Claude Breaching Real Systems During Security Tests](https://cybernoz.com/anthropic-discloses-fourth-incident-of-claude-breaching-real-systems-during-security-tests/) - Anthropic has disclosed a fourth incident in which one of its Claude models broke into genuine third-party systems during what was supposed to be a contained cybersecurity evaluation, deepening industry concern over the risks posed by increasingly autonomous AI agents. The AI company said the episode dates back to January 2026 and involved an early
- [Meta Sued Over Training Data for Its AI and Face-Recognition Systems](https://cybernoz.com/meta-sued-over-training-data-for-its-ai-and-face-recognition-systems/) - A set of parents and their children in Illinois and California filed a lawsuit last week in federal court in Chicago alleging that Meta illegally used their Facebook and Instagram photos to build NameTag, an unreleased face-recognition system for its smart glasses, and to train generative AI models including Emu and Muse Image.The proposed class
- [VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data](https://cybernoz.com/vlc-media-player-flaws-let-attackers-corrupt-memory-and-leak-sensitive-data/) - Two security vulnerabilities in VLC media player versions 3.0.0 through 3.0.23 could allow attackers to exploit heap memory issues. These vulnerabilities can be triggered by processing a malicious PNG file or connecting to attacker-controlled RealRTSP servers. The more severe vulnerability, tracked as CVE-2026-56711, is a heap out-of-bounds write flaw with a CVSS v4 score of
- [Building a ransomware decision tree before the call comes in](https://cybernoz.com/building-a-ransomware-decision-tree-before-the-call-comes-in/) - In this Help Net Security video, Kerri Shafer-Page, VP of Incident Response at Arctic Wolf, walks through the ransomware decision tree in this video. She covers four areas where decisions need settling in advance, starting with containment. Someone has to know the network well enough to judge what pulling a system offline does to client
- [Android malware creates a hidden copy of your banking app](https://cybernoz.com/android-malware-creates-a-hidden-copy-of-your-banking-app/) - Researchers at Group-IB found that the Android banking Trojan Gigabud can create a separate work profile on an infected phone and run a cloned banking app inside it. The attacker can then carry out fraudulent transactions in the new profile, potentially separating them from signs of malware detected elsewhere on the device. To do this,
- [GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure](https://cybernoz.com/gitlab-cvss-10-file-read-flaw-draws-in-the-wild-probes-after-disclosure/) - Ravie LakshmananSep 11, 2026Vulnerability / Web Security GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure. The vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository commits API that could allow an unauthenticated user to
- [GDPR wasn't designed for AI and that's a security problem](https://cybernoz.com/gdpr-wasnt-designed-for-ai-and-thats-a-security-problem/) - When the General Data Protection Regulation (GDPR) came into force, generative AI wasn’t embedded in everyday business applications, AI agents were not executing multi-step tasks across corporate databases and prompt injection was not a mainstream vector for data exfiltration. GDPR is one of the world's most important pieces of data protection legislation and its principles
- [Phishing Research Challenges Conventional Security Awareness Testing](https://cybernoz.com/phishing-research-challenges-conventional-security-awareness-testing/) - The message is simple: fine-tune future in-house phishing simulation tests through the findings and analysis of Pistachio’s research. Pistachio was founded in Oslo Norway in 2019, with additional offices in London and Valencia. It specializes in automated human risk management, employee security awareness training, and phishing simulations. Between 1 June, 2025 and 31 May, 2026,
- [The AI Supply Chain Has a Security Problem, and Much of It Is Sitting on the Open Internet](https://cybernoz.com/the-ai-supply-chain-has-a-security-problem-and-much-of-it-is-sitting-on-the-open-internet/) - The AI Supply Chain Has a Security Problem, and Much of It Is Sitting on the Open Internet Pierluigi Paganini September 11, 2026 Researchers found 36,769 exposed AI endpoints, but only 2% had an HTTP authentication gate. Running AI locally is supposed to give organizations more control. Models, prompts and documents stay on infrastructure they
- [State authorities warn they lack resources to address cyber threat to critical sectors](https://cybernoz.com/state-authorities-warn-they-lack-resources-to-address-cyber-threat-to-critical-sectors/) - A report shows that state CIOs and CISOs need additional funding, personnel and training to protect water, energy and healthcare. Source link
- [GitLab's critical flaw is already drawing internet-wide probes](https://cybernoz.com/gitlabs-critical-flaw-is-already-drawing-internet-wide-probes/) - GitLab released emergency patches Thursday for two high-severity flaws in its software development platform, one of them holding the highest possible severity score, while a security firm reports that it has already seen attackers probing the internet for the flaws. The company patched the issues in new versions of both its Community Edition and Enterprise
- [GuardBreaker: Derailing AI-assisted malware analysis with a code comment](https://cybernoz.com/guardbreaker-derailing-ai-assisted-malware-analysis-with-a-code-comment/) - LLM-based code scanners won’t help attackers build a nuclear weapon, but that refusal could work in their favor 10 Sep 2026 • , 4 min. read Malware developers have long adapted their code and tactics to the defenses and scrutiny that are likely to stand in their way. Using various evasion and anti-analysis methods, they
- [Metasploit Wrap Up: This One Goes to Sixteen!](https://cybernoz.com/metasploit-wrap-up-this-one-goes-to-sixteen/) - This One Goes to Sixteen!Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the watchers!New module content (16)Elasticsearch ingest-attachment Apache Tika XFA
- [Update your firewall rules: Teams and Copilot are changing address](https://cybernoz.com/update-your-firewall-rules-teams-and-copilot-are-changing-address/) - Enterprises that had been blocking the new Copilot address to prevent employees accessing their personal Microsoft accounts can use Microsoft’s TenantRestrictions control to achieve their goals instead, it said. All redirects should be completed by early October, Microsoft said, advising companies that can’t meet the deadline to contact their account representative for help. Limited exceptions
- [Boston Scientific restores operations after cybersecurity incident disrupts order fulfillment](https://cybernoz.com/boston-scientific-restores-operations-after-cybersecurity-incident-disrupts-order-fulfillment/) - Following its August cyber disruption, medical equipment manufacturer Boston Scientific revealed this week that manufacturing, order fulfillment and shipping operations have been fully restored following a cybersecurity incident identified Aug. 25, with products now moving through its distribution network at or above normal levels. The medical technology company said it is working to clear orders
- [EU Cyber Resilience Act reporting rules take effect, putting vulnerability disclosure and product security in focus](https://cybernoz.com/eu-cyber-resilience-act-reporting-rules-take-effect-putting-vulnerability-disclosure-and-product-security-in-focus/) - The European Union’s Cyber Resilience Act (CRA) is set to come into force with mandatory cybersecurity requirements for manufacturers of hardware and software products with digital elements, covering planning, design, development and maintenance across the value chain. The regulation requires manufacturers to address vulnerabilities throughout a product’s lifecycle, while some products deemed particularly relevant to
- [CrushFTP vulnerability CVE-2024-4040: what you need to know](https://cybernoz.com/crushftp-vulnerability-cve-2024-4040-what-you-need-to-know/) - On April 19, 2024, CrushFTP, a managed file transfer vendor disclosed a 0day vulnerability in several versions of its software through a private mailing list. This severe vulnerability, identified as CVE-2024-4040 with a CVSS score of 9.8, was discovered by Simon Garrelou and assigned by a third-party CNA (DirectCyber) on April 22. The vulnerability affects
- [WARMCOOKIE One Year Later: New Features and Fresh Insights](https://cybernoz.com/warmcookie-one-year-later-new-features-and-fresh-insights/) - Revisiting WARMCOOKIE Elastic Security Labs continues to track developments in the WARMCOOKIE codebase, uncovering new infrastructure tied to the backdoor. Since our original post, we have been observing ongoing updates to the code family and continued activity surrounding the backdoor, including new infections and its use with emerging loaders. A recent finding by the IBM
- [Artifactory flaws chained in attacks deploying backdoor malware](https://cybernoz.com/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware/) - Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers. A new report from cloud security company Wiz confirmed exploitation across multiple environments, including an exploit chain that combines CVE-2026-42018 and CVE-2026-42016. The third vulnerability is CVE-2026-82329, a critical
- [Russia-Aligned Hackers Use GuardBreaker Prompt Injection to Disrupt AI Malware Analysis](https://cybernoz.com/russia-aligned-hackers-use-guardbreaker-prompt-injection-to-disrupt-ai-malware-analysis/) - Russia-aligned operators are testing a new way to make artificial intelligence overlook malicious code. The technique, called GuardBreaker, hides a safety-sensitive request inside an otherwise ordinary script comment, hoping that an AI code scanner refuses to continue its work. The activity was observed during an early-stage intrusion against a target in Ukraine. The VBScript was
- [Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign](https://cybernoz.com/researchers-uncover-10000-malware-loaders-behind-youtube-and-seo-poisoning-campaign/) - A long-running pay-per-install (PPI) operation that used YouTube gaming channels and SEO-poisoned software downloads to distribute malware at scale. The cluster, tracked as CL-CRI-1171, is linked to more than 10,000 distinct samples of a custom loader called OfferLoader, indicating a distribution pipeline far larger than the individual intrusions initially observed. Rather than relying on a
- [Digital Executive Protection: Agentic Powered External Identity Security](https://cybernoz.com/digital-executive-protection-agentic-powered-external-identity-security/) - External identity is the personal data of executives, employees, and their families that attackers can find and exploit outside company systems. VanishID is tackling that exposure across the entire workforce. They’ve also partnered with outtake, a developer of agents that find the impersonations and scams already targeting those people. Matt Polack, founder and CEO at VanishID sat down
- [IDScan confirms breach after 153 million driver’s licenses leak on dark web](https://cybernoz.com/idscan-confirms-breach-after-153-million-drivers-licenses-leak-on-dark-web/) - Days after reports linked IDScan to a dark web database holding more than 153 million driver’s license scans, the identity verification company has confirmed hackers accessed customer data stored on its cloud platform. The Louisiana-based firm, which processes ID checks for car rental companies, retailers and cannabis dispensaries, posted a notice on its website September
- [Crypto customers targeted by scammers after email marketing provider breach](https://cybernoz.com/crypto-customers-targeted-by-scammers-after-email-marketing-provider-breach/) - An attacker breached an email marketing platform and launched targeted attacks against the newsletter subscribers of some of its customers, especially those working in cryptocurrency and adjacent fields. The incident was a supply-chain phishing campaign carried out through Brevo, an email marketing provider used by several cryptocurrency companies and other firms. Brevo initially said an
- [Claude Used to Automate Exploitation and Data Theft Across Multiple Victims](https://cybernoz.com/claude-used-to-automate-exploitation-and-data-theft-across-multiple-victims/) - Ravie LakshmananSep 11, 2026Artificial Intelligence / Cyber Operations Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026. The threat actors, which the artificial intelligence (AI) company has branded Generative Threat Groups (GTGs), span state-sponsored groups,
- [UK government to create team to validate Capita’s data on troubled pension scheme](https://cybernoz.com/uk-government-to-create-team-to-validate-capitas-data-on-troubled-pension-scheme/) - The UK government is in the process of reducing its reliance on data from Capita in regard to the performance of the troubled civil service pension administration, which the supplier is responsible for. Capita has denied claims made in a Civil Service Pension Scheme (CSPS) member forum that it could be years before the service
- [TCE Weekly Roundup: Iran Bounty, Airline Leak, ChatGPT Flaw](https://cybernoz.com/tce-weekly-roundup-iran-bounty-airline-leak-chatgpt-flaw/) - This weekly roundup covers a bounty offer targeting an alleged Iranian cyber official, a massive data-exposure incident affecting airline travelers, a breach of an education platform used by students, a flaw exposing ChatGPT users’ Gmail data, and a new EU compliance deadline for connected-product manufacturers. From nation-state attribution efforts to AI-model exploitation and airline record
- [DFAT flags "multi-year investment" in its technology operations](https://cybernoz.com/dfat-flags-multi-year-investment-in-its-technology-operations/) - Key points DFAT is planning a “multi-year investment” in its technology operations, according to signals from the department. Consultants will be engaged for a high-level review of current and future technology capability requirements to build a business case. The department received no notable allocation for a technology improvement program in the recent federal budget, with
- [In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review](https://cybernoz.com/in-other-news-injecteave-attack-sim-swapper-sentenced-glasswing-findings-review/) - SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving
- [Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware](https://cybernoz.com/attackers-exploit-critical-cisco-fmc-flaw-to-deploy-qilin-ransomware/) - Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware Pierluigi Paganini September 11, 2026 Three threat groups are exploiting two Cisco FMC flaws to steal credentials, gain root access and deploy Qilin ransomware. Cisco Talos says three separate threat groups are exploiting two recently patched Secure Firewall Management Center (FMC) flaws. The main target
- [How AI and cybersecurity are reshaping ServiceNow](https://cybernoz.com/how-ai-and-cybersecurity-are-reshaping-servicenow/) - AI convergence AI is causing previously distinct sectors such as ITSM and cybersecurity to converge, with AI itself turning into a unifying AIOps front end to diverse, specialized technologies sitting below it. In this, ServiceNow looks well-placed, having added the Virtual Agent chatbot system to its Now platform as long ago as 2018, later reinforced
- [ClickFix attacks infecting PCs and Macs are going viral](https://cybernoz.com/clickfix-attacks-infecting-pcs-and-macs-are-going-viral/) - For the people behind the attacks, ClickFix now makes their job much easier. Prior to ClickFix, they would have needed to install the malware (tracked as Lorem Ipsum, security firm BlueVoyant said recently) using resource-intensive infrastructure, including SEO-manipulated and malvertised download portals, Microsoft-trusted signing certificates, and continuously rotated domains for delivering Microsoft Installer packages. “The pivot
- [Defining the "Platform" in the cloud operating model](https://cybernoz.com/defining-the-platform-in-the-cloud-operating-model/) - Platformization has become a hot topic in enterprise tech, particularly when it comes to cybersecurity and cloud. Organizations are fed up with managing a hodgepodge of point solutions. They want better visibility, no siloes, less noise, more context. Many are actively pushing to consolidate vendors to improve the experience for their teams. At Wiz, we believe
- [What the 2025 Elastic Global Threat Report reveals about the evolving threat landscape](https://cybernoz.com/what-the-2025-elastic-global-threat-report-reveals-about-the-evolving-threat-landscape/) - For the fourth consecutive year, Elastic Security Labs presents its 2025 Global Threat Report, distilling real-world user telemetry to offer critical insights into the evolving threat landscape. This year's report delves into how AI is redefining threats, highlights areas where adversaries are intensifying their efforts, and provides actionable strategies for enterprises to proactively counter these
- [GitLab urges users to patch max severity path traversal flaw](https://cybernoz.com/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/) - GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. The security flaw, discovered by a security researcher using the 's3ntago' handle and reported via GitLab's HackerOne bug bounty program, stems from improper path confinement and missing authentication enforcement in the repository commits API. According to GitLab,
- [Ubuntu 24.04.5 LTS Released With Linux 7.0 Kernel and Latest Security Updates](https://cybernoz.com/ubuntu-24-04-5-lts-released-with-linux-7-0-kernel-and-latest-security-updates/) - Canonical has officially rolled out Ubuntu 24.04.5 LTS, the fifth maintenance update to the “Noble Numbat” long-term support release, delivering a fresh installation image packed with the latest security patches, bug fixes, and an upgraded hardware enablement stack built around the Linux 7.0 kernel. For a distribution that underpins millions of servers, cloud instances, and
- [The US and Mexico Announce They’re Teaming Up Against Drones](https://cybernoz.com/the-us-and-mexico-announce-theyre-teaming-up-against-drones/) - Defense agencies of Mexico and the US have announced they are implementing a new collaborative strategy to combat drones used by criminal organizations. The operation, dubbed High Eagle, or Águila Alta, builds on recent tests of anti-drone technologies carried out along the border between the two countries.The first phase of the strategy took place between
- [cPanel Urges Users to Patch ConfigServer Firewall Remote Code Execution Flaw](https://cybernoz.com/cpanel-urges-users-to-patch-configserver-firewall-remote-code-execution-flaw/) - A recently disclosed vulnerability in ConfigServer Security & Firewall (CSF) could allow unauthenticated remote attackers to execute arbitrary commands through the product’s MESSENGER service. This vulnerability, tracked as CVE-2026-65638, affects CSF versions 14.00 through 16.29 and has been addressed in version 16.30 and later. CSF is widely used on Linux servers and in cPanel/WHM environments
- [AI agents exploited PaperCut flaws to breach 395 organizations](https://cybernoz.com/ai-agents-exploited-papercut-flaws-to-breach-395-organizations/) - A threat actor built a working exploit for PaperCut print management software, then handed the job of breaking into hundreds of organizations to AI agents that did most of the work on their own, according to GreyNoise. The result was at least 440 compromised PaperCut instances across 395 identified organizations in 48 countries. Attacker, believed
- [Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors](https://cybernoz.com/attackers-chain-jfrog-artifactory-flaws-to-gain-admin-control-and-plant-backdoors/) - Attackers have chained two flaws in JFrog Artifactory, the repository that software build pipelines pull from, to take administrator control of self-hosted servers and plant backdoors, cloud security company Wiz said in a report. Wiz saw the attacks between August 15 and September 8. JFrog had fixed both flaws before then, so only servers that
- [AWS AI Symposium: Public sector must shape AI, use open source](https://cybernoz.com/aws-ai-symposium-public-sector-must-shape-ai-use-open-source/) - Public sector leaders can secure artificial intelligence (AI) only by treating security as a fast-moving target, by demanding secure-by-default and interoperable technology, and by leaning on open source to build trust and resilience. They can also use their collective purchasing power to shape the market rather than simply buy from it. That was the message
- [Springfield Cyberattack: Union Demands Answers Before Return](https://cybernoz.com/springfield-cyberattack-union-demands-answers-before-return/) - Springfield Public Schools remains in recovery mode following a cyberattack that shut down district operations and forced schools to close for the second half of the week, and the local teachers union says too many questions remain unanswered as students prepare to head back to class. The Springfield cyberattack hit just one week into the
- [UNSW reveals new measures to deal with AI cheating](https://cybernoz.com/unsw-reveals-new-measures-to-deal-with-ai-cheating/) - Key points UNSW is expanding its ChatGPT Edu rollout to 80,000 students and staff after a limited deployment to 10,000 staff late last year. New academic policy measures will include an "assessment transformation" dividing assessments into "can", "can't" and "must" AI modes. The university says AI watermarking and detection tools aren't yet reliable enough alone
- [Surfshark Systems Targeted by Hackers](https://cybernoz.com/surfshark-systems-targeted-by-hackers/) - VPN and cybersecurity services provider Surfshark this week disclosed a cybersecurity incident impacting certain internal data. The incident, it says, was discovered on August 31, but initially treated as low risk. By September 2, however, the company confirmed the scope and moved to containment and remediation. An internal test server that became accessible from the
- [UK Council Attack Linked to Mass Exploitation of SonicWall Flaw](https://cybernoz.com/uk-council-attack-linked-to-mass-exploitation-of-sonicwall-flaw/) - UK Council Attack Linked to Mass Exploitation of SonicWall Flaw Pierluigi Paganini September 11, 2026 A critical SonicWall flaw was rapidly weaponized, with a UK Council attack linked to a campaign that exposed credentials and enabled Active Directory theft. On July 17, 2026, the Borough Council of King’s Lynn and West Norfolk announced it had
- [AI lets small actors run state-level hacking campaigns, Anthropic report finds](https://cybernoz.com/ai-lets-small-actors-run-state-level-hacking-campaigns-anthropic-report-finds/) - Artificial intelligence has removed the skill advantage that once set state-sponsored hackers apart from lone criminals, according to a threat report Anthropic published Thursday that documents misuse of its Claude models across seven areas of harm. The report, which details activity observed between December 2025 and August 2026, covers cyber operations, influence operations, surveillance, scams
- [Why AI experts are ‘freaked out’ over safety fears ahead of Xi-Trump summit](https://cybernoz.com/why-ai-experts-are-freaked-out-over-safety-fears-ahead-of-xi-trump-summit/) - A flurry of cybersecurity breaches, internal whistle-blowing, and declining visibility into model safety has sparked fresh alarm over the US artificial intelligence boom, igniting calls from some experts to slow down development – even as critics warn that deceleration risks surrendering America’s technological lead to China.OpenAI CEO Sam Altman told employees in a private company-wide
- [Post-quantum cryptography: How to prepare for 2030](https://cybernoz.com/post-quantum-cryptography-how-to-prepare-for-2030/) - Run that comparison against your own data instead of against an industry average. A retail transaction log with a two-year retention window carries a different risk profile than genomic data, merger documentation or infrastructure design specs that need to stay confidential for thirty years. For a good number of organizations, that confidentiality window runs well
- [Celebrating Our $1 Billion Funding Round and $12 Billion Valuation](https://cybernoz.com/celebrating-our-1-billion-funding-round-and-12-billion-valuation/) - Today we’ve reached yet another milestone on our journey. Wiz has raised $1 billion at a $12 billion valuation, led by Andreessen Horowitz, Lightspeed Venture Partners, and Thrive Capital. This news, which is the result of hard work and dedication, makes us reflect on the past while setting our sights on the future. At every inflection
- [From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect](https://cybernoz.com/from-invitation-to-infection-how-silentconnect-delivers-screenconnect/) - Introduction Elastic Security Labs is observing malicious campaigns delivering a multi-stage infection involving a previously undocumented loader. The infection begins when users are diverted to a Cloudflare Turnstile CAPTCHA page under the guise of a digital invitation. After the link is clicked, a VBScript file is downloaded to the machine. Upon execution, the script retrieves
- [Conti ransomware gang member sentenced to 4 years in prison](https://cybernoz.com/conti-ransomware-gang-member-sentenced-to-4-years-in-prison/) - A Ukrainian national has been sentenced to four years in prison for his role in Conti ransomware attacks between 2021 and 2022. 44-year-old Oleksii Oleksiyovych Lytvynenko was arrested by the Irish national police (An Garda Síochána) in July 2023 at the request of the United States and was extradited last year. Lytvynenko and his Conti
- [Top 10 Best CNAPP Platforms in 2026, Compared](https://cybernoz.com/top-10-best-cnapp-platforms-in-2026-compared/) - Bottom line up front: CNAPP is the umbrella — it bundles CSPM (posture), CWPP (runtime), CIEM (entitlements), and increasingly DSPM (data) into one platform. Wiz leads on the graph that connects them, Prisma Cloud on module breadth, Defender for Cloud on Azure economics. This guide sizes the decision and names the one market fact —
- [Former Currys CIO Andy Gamble Joins Core to Cloud as Advisory Board Chair](https://cybernoz.com/former-currys-cio-andy-gamble-joins-core-to-cloud-as-advisory-board-chair/) - UK cybersecurity specialist Core to Cloud has appointed former Currys Group CIO Andy Gamble as Chair of its Advisory Board as the company looks to accelerate the growth of its managed security services. Gamble brings nearly 30 years of board-level technology leadership and will work with Core to Cloud on its strategic, advisory and commercial
- [Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement](https://cybernoz.com/hackers-deploy-new-sloppyrat-via-clickfix-to-enable-ransomware-lateral-movement/) - A new Windows remote-access trojan dubbed SloppyRAT, which appears to be positioned as an intrusion-enablement tool for ransomware operations. First observed in June 2026, the malware is delivered through a multi-stage ClickFix chain and combines host reconnaissance, stealthy command execution, reverse proxying, and resilient command-and-control mechanisms to support post-compromise activity and lateral movement. Rather than
- [Getting a stranger's phone kicked off the cellular network costs a few dollars](https://cybernoz.com/getting-a-strangers-phone-kicked-off-the-cellular-network-costs-a-few-dollars/) - Researchers at Michigan State University and three partner schools bought a Samsung Galaxy Z Fold 7, copied the identification number printed on the sealed box, and reported the phone to its carrier as lost. Then they opened the box and set the phone up the way a launch-day buyer would. It would not connect. The
- [Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks](https://cybernoz.com/gigabud-creates-android-work-profiles-to-hide-from-banking-app-malware-checks/) - The Gigabud banking trojan now installs a second Android app that creates a work profile on an infected phone and drops a tampered banking app inside it, security firm Group-IB said in a report published on September 9. A work profile is a separate space that Android typically reserves for employer apps, and what's inside
- [AWS AI Symposium: UHCW adds an operation a day with AI](https://cybernoz.com/aws-ai-symposium-uhcw-adds-an-operation-a-day-with-ai/) - University Hospitals Coventry and Warwickshire (UHCW) has added an extra case per daily theatre list, recovered time lost to manual coordination, and exposed a data problem that understated operating theatre utilisation by a fifth. It can also now see theatre activity in real time and act ahead of delays instead of reacting to them. That’s
- [Agentic AI Harnesses: ASD Releases New Security Guidance](https://cybernoz.com/agentic-ai-harnesses-asd-releases-new-security-guidance/) - The Australian Signals Directorate (ASD) has released new guidance on Agentic AI Harnesses, highlighting the security, governance and operational risks organisations need to consider as they adopt agentic AI systems. The publication shifts attention beyond large language models (LLMs) to the software layer that connects models with organisational data, tools and systems. According to ASD,
- [Miro snapped up by Bending Spoons](https://cybernoz.com/miro-snapped-up-by-bending-spoons/) - Bending Spoons has ⁠agreed ⁠to buy Miro in an all-cash deal, valuing the digital collaboration platform at US$1.36 billion ($1.9 billion), ‌the companies said. Miro provides an online workspace to help teams brainstorm, design products, ‌map ⁠workflows and ​manage projects. "Miro has grown to ⁠around US$600 million in annual recurring revenue, nearly 90% from business
- [Hacker Conversations: Vinnie Liu, Performer Turned Ringmaster](https://cybernoz.com/hacker-conversations-vinnie-liu-performer-turned-ringmaster/) - Vinnie Liu was recruited by the NSA when he was just 17 years old. He is now the CEO of Bishop Fox. He says little about his work at the NSA, only that “My first year was on the red team, and in the second year, it was more externally facing.” He had been recommended
- [Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days](https://cybernoz.com/four-nation-state-actors-used-the-same-chrome-zero-day-exploit-kit-within-12-days/) - Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days Pierluigi Paganini September 10, 2026 Four espionage groups used the BlueMoon Chrome+Windows exploit kit within 12 days. Researchers suspect AI development. Proofpoint published a detailed analysis of a Chrome-and-Windows exploit kit it tracks as BlueMoon that four nation-state actors adopted within roughly
- [How AI anxieties dominated the summer’s big cybersecurity conference](https://cybernoz.com/how-ai-anxieties-dominated-the-summers-big-cybersecurity-conference/) - From the CVE Program to autonomous hacks, everyone is worried about the technology’s next evolution. Source link
- [Hawley probes OpenAI over Hugging Face breach](https://cybernoz.com/hawley-probes-openai-over-hugging-face-breach/) - OpenAI is facing mounting pressure from Capitol Hill due to the attack its agents carried out on Hugging Face, while lawmakers voice widening concerns about AI’s potentially existential risks. Sen. Josh Hawley, R-Mo., criticized OpenAI leadership for what he described as “reckless” activities leading up to the Hugging Face breach, and accused the company of
- [Mathspace breach exposed data of more than 1 million students, parents and teachers](https://cybernoz.com/mathspace-breach-exposed-data-of-more-than-1-million-students-parents-and-teachers/) - Mathspace, an online maths learning platform used in schools across Australia and New Zealand, said attackers breached its systems by exploiting a vulnerability in Metabase, an internal reporting tool the company self-hosts. Mathspace said the attackers gained administrator access as early as 10 August and downloaded data on 27 August. The company confirmed the incident
- [Attackers are weaponizing the gap between Chromium fixes and Chrome patches](https://cybernoz.com/attackers-are-weaponizing-the-gap-between-chromium-fixes-and-chrome-patches/) - During that window, threat actors, whose ability to build exploit kits has been “wildly accelerated” by AI, likely had time to reverse engineer exploits from the open source codebase and take advantage of what used to seem like a reasonable patch gap, Ioussoufovitch explained. “Attackers are acting faster, and that means each day a patch
- [Wiz Security Graph offers root cause analysis for cloud IR](https://cybernoz.com/wiz-security-graph-offers-root-cause-analysis-for-cloud-ir/) - In the context of cloud security, Incident Response (IR) teams face the daunting task of swiftly detecting, analyzing, and mitigating incidents. For that reason, organizations like SANS and NIST created IR frameworks that help incident responders to speed the process from detecting an incident, through its containment, and eventually recovering from it. When a potential incident
- [Follow the Money: The Financial Sector's Threat Landscape in 2026](https://cybernoz.com/follow-the-money-the-financial-sectors-threat-landscape-in-2026/) - An AI voice agent posing as your bank's IT desk. Stolen identities packaged with financial profiles. Document forgery services with mules to complete verification. And a $1.5 billion crypto heist carried out by a nation-state threat group. These are driving today's threats against the financial sector as geopolitical flashpoints turn hacktivist ideology into disruptive campaigns
- [September Windows Server updates break Remote Desktop Services](https://cybernoz.com/september-windows-server-updates-break-remote-desktop-services/) - Windows admins report that the September 2026 cumulative updates are causing Remote Desktop Services (RDS) failures on Windows Server 2019, 2022, and 2025 systems, preventing users from connecting and, in some cases, requiring a hard reset to restore functionality. The problems appear after installing this month's Microsoft September 2026 Patch Tuesday cumulative updates, with many
- [WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites](https://cybernoz.com/wordpress-uses-ai-to-stop-malicious-plugin-updates-before-they-reach-millions-of-websites/) - WordPress has rolled out an automated, AI-driven security review that screens every plugin release before it reaches the WordPress.org update API, adding a critical checkpoint to a distribution pipeline that had previously lacked one. The move follows a real-world incident in which a backdoor was slipped into an update for a plugin with roughly 20,000
- [Huntress Expands into Africa with New QBS Software Africa Partnership](https://cybernoz.com/huntress-expands-into-africa-with-new-qbs-software-africa-partnership/) - Huntress is expanding into Africa through a new distribution partnership with QBS Software Africa, the company announced today. The move marks the latest step in Huntress’ international growth as organised, AI-enabled cybercrime continues to rise worldwide. The expansion comes as Africa faces a mounting cybersecurity crisis. According to INTERPOL’s 2026 African Cyberthreat Assessment, artificial intelligence
- [Skullcandy Dime 3 Bluetooth Flaw Lets Nearby Attackers Hijack Audio and Microphone](https://cybernoz.com/skullcandy-dime-3-bluetooth-flaw-lets-nearby-attackers-hijack-audio-and-microphone/) - Skullcandy Dime 3 wireless earbuds have a serious vulnerability related to unauthenticated Bluetooth pairing. This flaw allows nearby attackers to silently pair with the earbuds, disrupt legitimate audio sessions, and potentially capture microphone audio. This issue, tracked as VU#859658 by the CERT Coordination Center, affects the Skullcandy Dime 3 earbuds (model S2DCW) running firmware version
- [Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)](https://cybernoz.com/cisco-fmc-bugs-exploited-by-nation-state-and-ransomware-actors-cve-2026-20079-cve-2026-20316/) - State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC), which is used for centrally managing multiple Cisco Secure Firewall devices across a network. Two FMC vulnerabilities under active attack “Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management
- [Update Chrome now to protect against an actively exploited vulnerability](https://cybernoz.com/update-chrome-now-to-protect-against-an-actively-exploited-vulnerability/) - Chrome is rolling out an update for its desktop browser. The update includes 230 security fixes, one of which is known to be actively exploited. The stable channel has been updated to 153.0.8010.36/.37 for Windows and Mac, and 153.0.8010.36 for Linux. How to update Chrome If you don’t want to wait for the rollout to reach you,
- [PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances](https://cybernoz.com/papercut-attacker-uses-hundreds-of-ai-agents-to-compromise-440-instances/) - A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence (AI) to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF and break into hundreds of instances. According to independent reports from Blackpoint Cyber and GreyNoise, the activity originates from "45.142.193[.]132," an IP address that has been
- [AWS AI Symposium: TeenTech alumni call for AI literacy in schools](https://cybernoz.com/aws-ai-symposium-teentech-alumni-call-for-ai-literacy-in-schools/) - Young people need a “mission in AI [artificial intelligence] literacy” and far more access to extracurriculars that build soft skills if the future workforce is to be ready for AI. They also need adults in the room to mentor, volunteer and sponsor. That was the call from TeenTech founder Maggie Philbin and two of the
- [IBM, NASA launch AI model](https://cybernoz.com/ibm-nasa-launch-ai-model/) - IBM and NASA have released ⁠an open-source AI model designed to help scientists analyse decades of lunar observation data and support plans for a sustained ‌human presence on the Moon. The ‌NASA-IBM ‌Lunar Foundation Model is a ‌publicly available AI tool ⁠designed to study the Moon. It was trained on more than 30 layers of
- [Mandiant Founder Kevin Mandia Joins Amazon Board](https://cybernoz.com/mandiant-founder-kevin-mandia-joins-amazon-board/) - Amazon has appointed cybersecurity veteran Kevin Mandia to its board of directors, strengthening the technology giant’s security expertise at the board level. Mandia was elected to the board on September 8 and brings more than 30 years of experience responding to cyber threats across the public and private sectors, Amazon announced. He is the founder and
- [More Capable AI, Not Enough Guardrails](https://cybernoz.com/more-capable-ai-not-enough-guardrails/) - His September 8 resignation brought a difficult question back into the open: how seriously should we take warnings from people who helped build these systems in the first place? Coxon argues that competition between AI labs creates a dangerous incentive structure. OpenAI worries Anthropic will move faster, Anthropic worries OpenAI will move faster, and each
- [White House sees water cybersecurity partnership in Texas as national blueprint](https://cybernoz.com/white-house-sees-water-cybersecurity-partnership-in-texas-as-national-blueprint/) - A top cybersecurity official said the government was taking a new approach to protecting critical infrastructure. Source link
- [Conti ransomware crew member sentenced to four years in prison](https://cybernoz.com/conti-ransomware-crew-member-sentenced-to-four-years-in-prison/) - A 44-year-old Ukrainian national was sentenced to four years in prison for his long-running participation in Conti, a ransomware group that attacked more than 1,000 organizations globally before it disbanded in 2022, the Justice Department said Thursday. Oleksii Oleksiyovych Lytvynenko, also known as Alexsey Alexseevich Litvinenko, pleaded guilty in June to conspiracy to commit wire
- [Moonshot, DeepSeek secretly routed user requests to Claude, Anthropic claims](https://cybernoz.com/moonshot-deepseek-secretly-routed-user-requests-to-claude-anthropic-claims/) - American artificial intelligence (AI) giant Anthropic has accused its Chinese AI rivals DeepSeek and Moonshot on Thursday of covertly routing customer requests to its Claude models, then showing users the responses as if they were from their own models.The new allegations mark a further escalation in US criticism of China’s AI industry practices. Earlier this
- [AI security: Why ground truth beats smarter detection](https://cybernoz.com/ai-security-why-ground-truth-beats-smarter-detection/) - Attackers operate largely the same way. They scrape your org chart, guess who signs the wire, assume which domains belong to you and harvest what normal looked like months ago. Their picture is external, often stale and rarely confirmed. They are reading your stars. Defenders can carry facts the attacker has to guess at: who
- [Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329](https://cybernoz.com/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-42018-cve-2026-82329/) - Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities affecting JFrog Artifactory: CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329. Attackers are chaining these vulnerabilities to bypass authentication, escalate privileges, and gain administrative control over vulnerable Artifactory instances. Observed post-exploitation activity includes the creation of persistent administrator accounts, the deployment of malicious Groovy plugins for
- [Protecting organizations from AI-assisted executive impersonation and invoice fraud](https://cybernoz.com/protecting-organizations-from-ai-assisted-executive-impersonation-and-invoice-fraud/) - In this article Threat actors are increasingly improving their tactics to make suspicious emails look like legitimate email notifications to potential victims, deploying techniques that impersonate internally sent emails from executive team members. While this technique is not new, the adoption of AI has enabled threat actors to improve their campaign templates and construct emails
- [How we caught the Axios supply chain attack](https://cybernoz.com/how-we-caught-the-axios-supply-chain-attack/) - Preamble Last Monday night I was working late and a Slack alert came in from a monitoring tool I had built three days earlier. Axios compromised; one of the most popular npm packages in the world. My heart started racing, I knew every second mattered to respond and limit the damage. But honestly it was
- [New Android malware encrypts files, steals data, and harasses victims](https://cybernoz.com/new-android-malware-encrypts-files-steals-data-and-harasses-victims/) - A new Android malware strain called Mantax Otax combines ransomware and spyware capabilities to encrypt files, steal sensitive data, and spam and harass victims. Indonesian operators distribute the malware through malicious APKs hosted outside Google Play, targeting users with phishing and social engineering messages. After installation, the malware requests permission to use the Accessibility service, which gives
- [Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware](https://cybernoz.com/hackers-use-fake-gta-6-downloads-to-deploy-rats-infostealers-and-data-wiping-malware/) - Cybercriminals are exploiting intense interest in Grand Theft Auto VI by pushing fake game downloads that install several types of malware instead of a playable game. The campaign targets people looking for an early build, leaked copy, or unofficial demo before the title’s release. The malicious downloads are distributed through poisoned search results, gaming forums,
- [4 Ways Organisations Create Non-Human Insider Risk](https://cybernoz.com/4-ways-organisations-create-non-human-insider-risk/) - As AI agents become embedded across business operations, they are also creating a new category of insider risk. Unlike traditional insiders, these non-human identities can act at machine speed, operate continuously and access multiple systems without direct human oversight. The danger rarely stems from one obvious security failure. Instead, it emerges when several weaknesses overlap.
- [Hackers Can Turn Vulnerable LiteLLM AI Gateways Into Root Access and Cloud Credential Theft](https://cybernoz.com/hackers-can-turn-vulnerable-litellm-ai-gateways-into-root-access-and-cloud-credential-theft/) - Nearly one in 10 internet-exposed LiteLLM AI gateways accepted the widely documented default master key, sk-1234, or required no authentication, creating a direct path to LLMjacking, sensitive credential exposure, and in vulnerable versions root-level code execution inside the gateway container. Their internet scan of 3,074 publicly reachable instances found that 294 systems, or 9.6%, accepted
- [Your passkeys can now move between password managers on Android](https://cybernoz.com/your-passkeys-can-now-move-between-password-managers-on-android/) - Google turned on a transfer feature in Android that moves passwords and passkeys straight from one password manager to another, with no file to download along the way. You start it from inside the app you are switching to, and Google says the data moves between the apps in a few seconds. “Historically, moving your
- [BlueMoon exploit kit turns Chrome and Windows flaws into attacks](https://cybernoz.com/bluemoon-exploit-kit-turns-chrome-and-windows-flaws-into-attacks/) - BlueMoon, a shared Chrome and Windows exploit kit, shows why “patch later” is becoming a dangerous gamble. Security updates are easy to put off. The browser still opens, Windows still works, and choosing to relaunch your browser or restart your computer later can feel harmless. But a newly documented exploit kit called “BlueMoon” shows how
- [Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE](https://cybernoz.com/check-point-discloses-two-9-8-rated-vpn-certificate-flaws-enabling-unauthenticated-rce/) - Check Point has patched two critical vulnerabilities in the way its firewall and management products handle VPN certificates. The company says both could allow an unauthenticated remote attacker to run code, but only "under specific conditions" that it has not described. One flaw affects Check Point's Security Gateways, its firewall appliances. The other affects those
- [Inside Google AI worker’s union drive to instil company ethics](https://cybernoz.com/inside-google-ai-workers-union-drive-to-instil-company-ethics/) - Google DeepMind (GDM) employees are using collective bargaining as a means of “establishing morals” at the company in response to its “material support for Israel’s genocide” in Gaza, but now face “classic union busting” tactics from management. In May 2026, DeepMind employees launched a unionisation bid to end use of the firm’s technology by Israel
- [AI Agents Compromised 440 PaperCut Servers, Researchers Say](https://cybernoz.com/ai-agents-compromised-440-papercut-servers-researchers-say/) - A threat intelligence firm says it watched a Russian-speaking attacker turn hundreds of AI agents loose on a print management platform and compromise 440 servers in 48 countries — including 11 organizations in 26 seconds. It is the most vivid account yet of an autonomous intrusion campaign. It is also, so far, a single-source story
- [Cybersecurity M&A Roundup: 33 Deals Announced in August 2026](https://cybernoz.com/cybersecurity-ma-roundup-33-deals-announced-in-august-2026/) - Thirty-three cybersecurity-related merger and acquisition (M&A) deals were announced in August 2026. For a detailed view of the more than 420 acquisitions announced in 2025, check out SecurityWeek’s annual M&A report. Here are some of the most important cybersecurity M&A deals announced in August 2026: Brinqa acquires PlexTrac Continuous Threat Exposure Management (CTEM) firm Brinqa
- [U.S. CISA adds Cisco, Google Chromium V8, Fortinet, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog](https://cybernoz.com/u-s-cisa-adds-cisco-google-chromium-v8-fortinet-and-citrix-netscaler-flaws-to-its-known-exploited-vulnerabilities-catalog/) - U.S. CISA adds Cisco, Google Chromium V8, Fortinet, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog Pierluigi Paganini September 10, 2026 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco, Google Chromium V8, Fortinet, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities
- [CISA is on the verge of filling hundreds of critical vacancies](https://cybernoz.com/cisa-is-on-the-verge-of-filling-hundreds-of-critical-vacancies/) - Meanwhile, the agency is finalizing an incident-reporting regulation and setting up a new industry coordination structure. Source link
- [CIA’s Michael Ellis says cyber intelligence is changing how the agency operates](https://cybernoz.com/cias-michael-ellis-says-cyber-intelligence-is-changing-how-the-agency-operates/) - CIA Deputy Director Michael Ellis said Tuesday that the agency’s role in Operation Absolute Resolve is an example of how it has moved to put cyber operations at the center of intelligence collection and field missions, rather than treat them as a separate technical service. Speaking at the Billington Cybersecurity Conference, Ellis said the agency’s
- [[tl;dr sec] #345 - Bug Rumors → Exploits, Version Control DFIR, Agentic Worms](https://cybernoz.com/tldr-sec-345-bug-rumors-→-exploits-version-control-dfir-agentic-worms/) - A bug description is sufficient for AI to find it and write an exploit, cheat sheet on doing DFIR for GitHub, GitLab and more, and a paper on self-replicating, open weight agentic worms I hope you’ve been doing well! A two-ser This is the first time I’ve done two issues in a week in the
- [Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways](https://cybernoz.com/stealth-rootkit-targeting-f5-big-ip-could-expose-enterprise-identity-gateways/) - Compromise could expose the identity gateway The implications extend beyond the F5 appliance itself. “An attacker with access to BIG-IP APM can intercept SSO tokens and credentials, inject policy decisions, monitor user traffic, and move laterally to downstream applications and SaaS tenants that trust the appliance,” said Agnidipta Sarkar, chief evangelist at ColorTokens. Sarkar noted
- [Forescout expands global channel investment as partners take on growing IT, OT, IoT and IoMT security risks](https://cybernoz.com/forescout-expands-global-channel-investment-as-partners-take-on-growing-it-ot-iot-and-iomt-security-risks/) - Forescout Technologies announced expanded investment in its global partner ecosystem, highlighted by its Mission: Possible channel enablement roadshow, recognition of partners advancing within its Envision Partner Program, and ongoing initiatives to strengthen partner expertise and customer success worldwide. Nearly 100% of Forescout customer business is transacted through partners, making continued investment in partner enablement, technical
- [Panzer ransomware targets Italian manufacturer as ESXi capability raises industrial security concerns](https://cybernoz.com/panzer-ransomware-targets-italian-manufacturer-as-esxi-capability-raises-industrial-security-concerns/) - New research from cybersecurity researcher Andrea Fortuna detailed that Panzer ransomware emerged in August as a ransomware-as-a-service operation and, within its first month, claimed victims across 11 countries, including two Italian organizations. The Italian victims were Doimo Cucine, a kitchen manufacturer based near Treviso, listed on Aug. 17, and NTE Italia, a telecommunications engineering and
- [Wiz real-time CSPM: faster misconfiguration detection](https://cybernoz.com/wiz-real-time-cspm-faster-misconfiguration-detection/) - Did you know that less than a minute after a virtual machine is exposed to the internet, an unknown IP attempts to access the instance? Simple human errors that create this type of exposure can lead to critical risks, resulting in data breaches, compliance violations, and operational disruptions. Gartner found that by 2025, 99% of
- [Detect and disrupt AI-themed attacks with Microsoft Defender](https://cybernoz.com/detect-and-disrupt-ai-themed-attacks-with-microsoft-defender/) - Every wave of technology excitement creates a new opportunity for cyberattackers, and AI is no exception. Microsoft Threat Intelligence has published research showing a growing set of campaigns that impersonate popular AI platforms and tools, including ChatGPT, Microsoft Copilot, DeepSeek, and Claude.1 The goal is to make phishing, search-driven malware campaigns, and malvertising—which is malicious
- [Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild](https://cybernoz.com/copy-fail-and-dirtyfrag-linux-page-cache-bugs-in-the-wild/) - Introduction Recent Linux kernel privilege escalation vulnerabilities, Copy Fail (CVE-2026-31431) , Copy Fail 2, and DirtyFrag, highlight how subtle page cache corruption bugs can become practical, reliable paths to root. These issues are especially relevant for defenders because exploitation involves legitimate kernel interfaces, local execution, and short proof-of-concept code. Copy Fail has been reported as
- [AI-powered attack exploited PaperCut flaws to hack 395 organizations](https://cybernoz.com/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizations/) - A threat actor, likely Russian-speaking, used hundreds of AI agents to develop and launch a global exploitation campaign targeting vulnerable PaperCut NG/MF servers. The agents were tasked with building, testing, and refining exploits for CVE-2026-81578 and CVE-2026-82078, both security flaws affecting PaperCut Software and flagged as actively exploited earlier this month. Attack and threat intelligence company GreyNoise
- [NeuroCyber granted charity status to expand support for neurodivergent talent in cybersecurity](https://cybernoz.com/neurocyber-granted-charity-status-to-expand-support-for-neurodivergent-talent-in-cybersecurity/) - NeuroCyber, the organisation dedicated to improving opportunities and career outcomes for neurodivergent individuals across the cybersecurity profession, has been granted charity status by the Charity Commission for England and Wales. This is a major milestone for NeuroCyber, enabling it to expand its work to create a more inclusive cybersecurity profession where neurodivergent people can access
- [OpenMatter Network Realigns Leadership Team to Accelerate Global Commercial Growth](https://cybernoz.com/openmatter-network-realigns-leadership-team-to-accelerate-global-commercial-growth/) - Melbourne, Florida, September 10th, 2026, CyberNewswire With its Verification Architecture platform now commercially available and continuing to add new capabilities, OpenMatter Network today announced a strategic realignment of its leadership team designed to accelerate subscription growth, expand industry partnerships and position the company for long-term commercial success. Effective September 1, Mike Anderson has been named
- [Project Blocks Cameras, Allows People To Escape Detection And Surveillance](https://cybernoz.com/project-blocks-cameras-allows-people-to-escape-detection-and-surveillance/) - TechCrunch reports that Bill Swearingen has spent the past year running largely the same test, over and over again. The goal was to produce a computer-generated pattern that could block the surveillance cameras lining America’s streets from detecting it. Some 31 million tests later, Swearingen says he can now produce patterns on demand that, when applied to clothing
- [Attackers call employees' personal phones to break into Microsoft 365 accounts](https://cybernoz.com/attackers-call-employees-personal-phones-to-break-into-microsoft-365-accounts/) - Attackers are calling or texting employees on their personal phones, posing as internal IT staff, in a social engineering campaign that tricks them into handing over access to corporate cloud accounts. Once inside, they pull files and email from Microsoft 365 apps, SharePoint, OneDrive, and inboxes, for weeks at a time, according to Microsoft Security
- [Will AI kill us all within the next decade?](https://cybernoz.com/will-ai-kill-us-all-within-the-next-decade/) - The Wall Street Journal reports that concerns are rising inside AI labs that competition is pushing tech companies to race toward self-improving models that could spiral out of human control. Jacob Coxon, an AI researcher who has worked at Anthropic and OpenAI, said: “The people building AI earnestly believe that it could kill us all
- [Google Play Early Access Abused to Push Thousands of Deceptive Android Apps](https://cybernoz.com/google-play-early-access-abused-to-push-thousands-of-deceptive-android-apps/) - Ravie LakshmananSep 10, 2026Mobile Security / Artificial Intelligence Bad actors are misusing Google Play's Early Access program to push deceptive apps that claim to offer money, rewards, casino winnings, and premium content. Early Access apps are apps that haven't been released on the official Android app marketplace. The main idea behind the program is for
- [Nationwide consolidates 19 data stores to one in the cloud](https://cybernoz.com/nationwide-consolidates-19-data-stores-to-one-in-the-cloud/) - Nationwide Building Society has completed a project to cut the number of data stores it uses from 19 to one, using Microsoft technology as part of its integration of Virgin Money. The use of Microsoft Azure and Azure Databricks will enable the organisation to get more out of its artificial intelligence (AI) investments. Since chief
- [EU's 24-Hr Vulnerability Reporting Rules Take Effect Friday, A Year Before The Rest Of The Cyber Resilience Act](https://cybernoz.com/eus-24-hr-vulnerability-reporting-rules-take-effect-friday-a-year-before-the-rest-of-the-cyber-resilience-act/) - Manufacturers selling connected products in the European Union face a new legal duty starting Sept. 11. Report actively exploited vulnerabilities to authorities within 24 hours of confirming them. The obligation arrives 15 months ahead of the Cyber Resilience Act’s full application date of Dec. 11, 2027, making it the regulation’s first hard deadline. The CRA
- [Anthropic Researcher Resigns With Warning About the Dangers of AI Development](https://cybernoz.com/anthropic-researcher-resigns-with-warning-about-the-dangers-of-ai-development/) - An Anthropic researcher said he is resigning from the company over concerns the artificial intelligence firm and its competitors are not acting responsibly in AI development, echoing concerns raised inside and outside of the industry about the technology’s potential to elude human control. Jacob Coxon, who said he spent three years doing research at both
- [U.S. CISA adds Microsoft Windows, N-able N-central, and Adobe flaws to its Known Exploited Vulnerabilities catalog](https://cybernoz.com/u-s-cisa-adds-microsoft-windows-n-able-n-central-and-adobe-flaws-to-its-known-exploited-vulnerabilities-catalog/) - U.S. CISA adds Microsoft Windows, N-able N-central, and Adobe flaws to its Known Exploited Vulnerabilities catalog Pierluigi Paganini September 10, 2026 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows, N-able N-central, and Adobe flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited
- [Governments ‘buying time’ in race between innovation, security, national cyber director says](https://cybernoz.com/governments-buying-time-in-race-between-innovation-security-national-cyber-director-says/) - The United States and allied governments are “buying time for our systems to become more secure” as artificial intelligence advances and spreads, National Cyber Director Sean Cairncross said Thursday. “That is a big deal to be ahead of this, to be ahead of this race, and because it’s an exponential equation,” he said at the
- [AI workflows may be creating a dangerous new authorization blind spot](https://cybernoz.com/ai-workflows-may-be-creating-a-dangerous-new-authorization-blind-spot/) - A newly identified AI attack technique can let unauthenticated users trigger privileged workflows and access enterprise systems, highlighting a gap in how identity and access controls apply to AI agents, according to research from Noma Labs. The report, authored by Noma Labs lead researcher Sasi Levi, describes the issue as “workflow identity hijacking,” where attackers
- [PwC India and Claroty join forces to address growing cybersecurity risks across OT and connected environments](https://cybernoz.com/pwc-india-and-claroty-join-forces-to-address-growing-cybersecurity-risks-across-ot-and-connected-environments/) - PwC India and Claroty announced an alliance to help organisations address the evolving cybersecurity needs of connected environments. As businesses accelerate digital adoption across operational technology (OT), industrial systems, healthcare, and other critical infrastructure, the alliance is designed to support a more integrated approach to managing cyber risk across IT, OT, and extended connected environments.
- [CISA urges critical infrastructure to strengthen insider threat programs against cyberattacks, data theft and sabotage](https://cybernoz.com/cisa-urges-critical-infrastructure-to-strengthen-insider-threat-programs-against-cyberattacks-data-theft-and-sabotage/) - The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced an Insider Threat Mitigation Guide that highlights potential financial and operational impact of insider activity, citing a 2011 case involving an American energy technology company whose head of automation engineering secretly downloaded proprietary source code for a foreign competitor. Authorities estimated that 20% of the competitor’s
- [Wiz achieves GovRAMP High Authorization](https://cybernoz.com/wiz-achieves-govramp-high-authorization/) - We are excited to share that Wiz for U.S. Government (Wiz for Gov) has officially achieved GovRAMP High authorization. This milestone makes it easier for U.S. public sector organizations to securely manage their environments from code to runtime.Meeting the highest GovRAMP security baselineGovRAMP provides a standardized approach to assessing and authorizing cloud security for state
- [Daisy-Chaining Trust: Investigating Faronics Deploy Abuse](https://cybernoz.com/daisy-chaining-trust-investigating-faronics-deploy-abuse/) - Acknowledgments: Special thanks to Ben Nahorney and Aaron Deal for their contributions to this investigation and writeup.BackgroundHuntress has identified a surge in phishing campaigns that abuse Faronics Deploy, with more than 457 endpoints encountering Faronics-related lures between July 21 and August 20. Huntress reported this activity to the Faronics support team on August 5. Starting
- [Microsoft says September updates fix mouse settings reset issues](https://cybernoz.com/microsoft-says-september-updates-fix-mouse-settings-reset-issues/) - Microsoft has fixed a known issue that wiped mouse settings on some Windows 11 systems after installing the KB5120998 August 2026 preview update. According to user reports, mouse cursor personalization settings automatically changed or reset after installing this buggy update, and users couldn't restore them even after uninstalling KB5120998 from affected devices. Microsoft confirmed the issues on
- [Hackers Pose as Domain Controllers to Steal Active Directory Password Hashes](https://cybernoz.com/hackers-pose-as-domain-controllers-to-steal-active-directory-password-hashes/) - Threat actors are increasingly abusing Active Directory replication to impersonate domain controllers and steal password hashes from enterprise networks. This technique, known as a DCSync attack, can let attackers obtain credential data for privileged accounts without deploying malware directly on a legitimate domain controller. Active Directory domain controllers manage authentication across Windows enterprise environments. They
- [Forescout Expands Global Investment in Channel Partners](https://cybernoz.com/forescout-expands-global-investment-in-channel-partners/) - Forescout has expanded its investment in its global partner ecosystem to strengthen technical expertise and help partners support customers managing increasingly complex IT, OT, IoT, and IoMT environments. Nearly 100% of Forescout’s customer business is transacted through partners, making the channel a central part of the cybersecurity company’s growth strategy. Its latest investment includes the
- [Clearview AI Is Testing an AI Tool That Would Let Cops Unearth Your Life Online](https://cybernoz.com/clearview-ai-is-testing-an-ai-tool-that-would-let-cops-unearth-your-life-online/) - Clearview is not the first company to automate the process of trawling publicly available information. Other intelligence platforms sold to law enforcement, including ShadowDragon’s SocialNet, Penlink’s Tangles, and Fivecast, help investigators uncover aliases and associates and map a person’s digital footprint.Andrew Guthrie Ferguson, a George Washington University law professor who studies AI and policing, describes
- [Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers](https://cybernoz.com/fake-gta-6-installer-steals-browser-passwords-discord-tokens-and-crypto-data-from-gamers/) - Threat actors are exploiting anticipation around Grand Theft Auto VI by pushing fraudulent “leaked” game downloads that install a layered malware bundle that steals browser credentials, Discord tokens, gaming-session data, and cryptocurrency-related information. A Chaos ransomware variant used as a wiper, and an unexpected Yandex Browser installer. The campaign demonstrates how cybercriminals are turning one
- [Scytale expands vendor risk management with AI-powered TPRM tools](https://cybernoz.com/scytale-expands-vendor-risk-management-with-ai-powered-tprm-tools/) - Scytale has announced the launch of their latest AI-powered third-party risk management (TPRM) capabilities within its Vendors module. The release further extends vendor risk management from a periodic review exercise into a continuously updated vendor risk intelligence engine, giving security and GRC teams a current view of every vendor in their ecosystem. Scytale’s AI GRC
- [Copyright scammers get Instagram accounts suspended and demand payment](https://cybernoz.com/copyright-scammers-get-instagram-accounts-suspended-and-demand-payment/) - Scammers are abusing Meta’s copyright-reporting system to suspend people’s Instagram accounts and then hold them for ransom, according to the BBC. Criminals file fake copyright complaints with Instagram, claiming that an account is using material it doesn’t own. Repeated complaints can trigger a temporary account suspension from the platform, locking out the victim even though
- [Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key](https://cybernoz.com/nearly-1-in-10-exposed-litellm-gateways-accepted-the-example-sk-1234-admin-key/) - Nearly one in ten of the internet-facing LiteLLM servers that Wiz Research scanned in February accepted sk-1234, the example admin key in LiteLLM's own setup guide. LiteLLM is an open-source AI gateway, the software a company puts between its applications and the model providers it pays for. That key is the gateway's administrator credential. Anyone
- [Anthropic calls for ‘verifiable effort’ to control frontier AI](https://cybernoz.com/anthropic-calls-for-verifiable-effort-to-control-frontier-ai/) - AI developer Anthropic appears to have admitted the guardrails it has put in place failed to control its artificial intelligence (AI) models, which circumvented security measures during a cyber security test, attacking real systems on the open internet. The company called for a coordinated “verifiable effort” to pace frontier AI development. In July, three Anthropic
- [SA Power taps AI to reduce field job "knockbacks"](https://cybernoz.com/sa-power-taps-ai-to-reduce-field-job-knockbacks/) - Key points SA Power Networks is testing AI to predict when field work will hit obstacles that force projects back into the office for replanning. The energy provider has already deployed agentic AI, including an internal assistant called 'Ask AI', to track stakeholder requests and summarise unstructured data. SA Power is testing SAP's native AI
- [Organizations Warned of Cisco Secure FMC Exploitation](https://cybernoz.com/organizations-warned-of-cisco-secure-fmc-exploitation/) - Cisco and the cybersecurity agency CISA on Wednesday flagged the exploitation of a Cisco Secure Firewall Management Center (FMC) vulnerability disclosed earlier this year. The security hole, tracked as CVE-2026-20079, is a critical authentication bypass issue that a remote, unauthenticated attacker can exploit to run malicious scripts on vulnerable devices, enabling root access to the
- [A New Claude 's Sandbox Failure Shows How AI Can Rationalize Real-World Harm](https://cybernoz.com/a-new-claude-s-sandbox-failure-shows-how-ai-can-rationalize-real-world-harm/) - A New Claude ‘s Sandbox Failure Shows How AI Can Rationalize Real-World Harm Pierluigi Paganini September 10, 2026 Claude models compromised real systems during misconfigured security tests, exposing a worrying mix of flawed reasoning, harmful actions and weak safeguards. Anthropic just published one of the more uncomfortable self-assessments a major AI lab has released this
- [The Slow Path to AI Takeover](https://cybernoz.com/the-slow-path-to-ai-takeover/) - One way to think about the existential risk from AI is to realize that the less competent tend to end up relying on the more competent.Think about the workplaces you’ve been in where there’s one or two competent people and like 10 lazy or incompetent people, and over the course of 2 to 5 to
- [FBI cyber chief worries private sector not sharing enough cyber threat information](https://cybernoz.com/fbi-cyber-chief-worries-private-sector-not-sharing-enough-cyber-threat-information/) - The private sector still isn’t sharing enough cyber information with the FBI in part because organizations are operating on false assumptions about what the bureau will do with what it collects, the FBI’s top cyber official said Wednesday. Brett Leatherman, assistant director of the FBI’s cyber division, said in remarks at the Billington CyberSecurity Summit
- [Safe word: What is it and why do you need one?](https://cybernoz.com/safe-word-what-is-it-and-why-do-you-need-one/) - AI scams are now hyper-realistic. But there’s one simple way to see through them. 09 Sep 2026 • , 5 min. read AI voice scams are no longer as niche as they once were. The technology is both cheap and convincing: a worrying combination that has lowered the barrier to entry for would-be scammers. According
- [Proofpoint report flags resourcing gap as Australian CISOs take on AI risk](https://cybernoz.com/proofpoint-report-flags-resourcing-gap-as-australian-cisos-take-on-ai-risk/) - Australian chief information security officers are increasingly being asked to manage artificial intelligence-related cyber risks without additional resources, according to findings from Proofpoint’s 2026 Voice of the CISO report. The report, based on a global survey of 1,600 CISOs across 16 countries including 100 in Australia, found 79% of Australian CISOs are expected to manage
- [10 most critical LLM vulnerabilities](https://cybernoz.com/10-most-critical-llm-vulnerabilities/) - Require outputs to be grounded in authoritative sources and verify claims before acting. Introduce approval workflows and system checks. Log claims, evidence, and outcomes, and test adversarial scenarios. Regularly test workflows against misleading scenarios. Apply least privilege, sandboxing, and rate limits to limit the potential impact of any incident. 8. Hidden context exposure Hidden prompt
- [The Magic of Inclusion: Our Journey to Democratize Security](https://cybernoz.com/the-magic-of-inclusion-our-journey-to-democratize-security/) - At Wiz, our mission is clear: democratize cloud security. What do we mean by this? We’ve previously defined democratization as a way to incorporate security seamlessly into everyone’s role. That means making all stakeholders feel empowered, which can’t happen if an individual doesn’t feel respected or included. Everyone should have access to robust security solutions,
- [Hackers Frequently Target Healthcare and Finance Orgs](https://cybernoz.com/hackers-frequently-target-healthcare-and-finance-orgs/) - When a ransomware attack hits a hospital or bank, it's not just company data or customer emails that are vulnerable. These organizations have access to health records, valuable intellectual property, and bank accounts. Bad actors know how valuable this data is, and our new survey reveals that the organizations with this data are at high risk
- [Trezor warns users of email provider breach, phishing attacks](https://cybernoz.com/trezor-warns-users-of-email-provider-breach-phishing-attacks/) - Cryptocurrency hardware wallet maker Trezor warned customers on Wednesday that threat actors who breached its third-party email provider are targeting them in phishing attacks. Affected customers received fake "critical security alert" emails from help@trezor.io claiming that a "hardware microcontroller vulnerability" in the STM32 microcontrollers used by Trezor cold storage wallets could expose their seeds to
- [Claude AI Models Gained Unauthorized Access to Real Systems During Cybersecurity Tests](https://cybernoz.com/claude-ai-models-gained-unauthorized-access-to-real-systems-during-cybersecurity-tests/) - Anthropic has disclosed that four separate versions of its Claude AI models breached real-world third-party systems while running what were supposed to be sandboxed cybersecurity evaluations, exposing a gap between how the models reasoned about their environment and the reality on the ground. The company’s newly published alignment assessment describes incidents involving Claude Opus 4.6,
- [Huntress Uncovers Phishing Attacks Using Fake Browser Pages and Rogue RMM Tools](https://cybernoz.com/huntress-uncovers-phishing-attacks-using-fake-browser-pages-and-rogue-rmm-tools/) - Huntress researchers have uncovered two phishing attacks that combined convincing fake browser windows with legitimate remote management software to establish persistent access to victims’ devices. Both incidents, observed in August, began with phishing messages directing victims to attacker-controlled websites. The attackers then used a browser-in-the-browser (BiTB) technique to create what appeared to be a legitimate
- [Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America](https://cybernoz.com/hackers-use-llms-to-generate-exploit-scripts-and-automate-post-exploitation-across-latin-america/) - Threat actors targeting organizations across Latin America are increasingly embedding commercial large language models (LLMs) into intrusion workflows, using AI-assisted scripting, troubleshooting, and proxy deployment to accelerate post-exploitation and data theft. The campaigns show that AI is no longer limited to phishing, content generation, or reconnaissance. Instead, attackers appear to be using LLMs as an
- [Product showcase: GitGuardian Honeytoken catches credential theft as it happens](https://cybernoz.com/product-showcase-gitguardian-honeytoken-catches-credential-theft-as-it-happens/) - Credential harvesting on developer machines has widened. Earlier infostealers worked from a short list of known targets, mostly browser stores and a few cloud credential paths. The families active now cast a much wider net. Shai-Hulud, for instance, ran a secret scanner across the entire filesystem and validated whatever it turned up, rather than checking
- [Webinar: Learn How to Answer “Are We Exposed?” Faster After a New CVE](https://cybernoz.com/webinar-learn-how-to-answer-are-we-exposed-faster-after-a-new-cve/) - The Hacker NewsSep 09, 2026Security Operations / Artificial Intelligenc A major vulnerability is disclosed. The alert lands immediately. Then comes the harder question: Are we actually exposed? For many security teams, answering that means jumping between vulnerability scanners, endpoint tools, cloud inventories, SBOMs, repositories, and application data to build enough context to act. As AI
- [‘Wilfully blind’ Post Office thought just a few hundred affected by Horizon errors](https://cybernoz.com/wilfully-blind-post-office-thought-just-a-few-hundred-affected-by-horizon-errors/) - The Post Office did not understand the scale of the Horizon scandal until months and years after a compensation scheme was set up following its defeat in the High Court in 2019, according to the Department of Business and Trade (DBT). Despite the Post Office’s constant claims of the number users of Horizon and transactions
- [Apple unveils $3499 passport-shaped iPhone Duo](https://cybernoz.com/apple-unveils-3499-passport-shaped-iphone-duo/) - Apple has redefined its flagship smartphone with the launch of the Duo, a folding iPhone starting from $3499, ⁠betting its design ⁠and promises of data privacy will let it leap ahead of rivals who have been selling folding phones for years. The Duo could shake up a category long dominated by Samsung and Chinese companies
- [Android's September 2026 Updates Patch 180 Vulnerabilities](https://cybernoz.com/androids-september-2026-updates-patch-180-vulnerabilities/) - After two ‘no security vulnerabilities’ bulletins in July and August, Google on Tuesday announced the release of patches for 180 vulnerabilities as part of the September 2026 Android security updates. As usual, the updates are split into two parts. The first part arrives on devices as the 2026-09-01 security patch level and resolves 95 bugs
- [Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs](https://cybernoz.com/microsofts-biggest-patch-tuesday-974-cves-2-zero-days-and-20-wormable-bugs/) - Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs Pierluigi Paganini September 09, 2026 September 2026 Patch Tuesday fixes a record 974 CVEs including 2 exploited zero-days, 20 wormable bugs, and a critical Exchange RCE via Visio email. Microsoft’s September 2026 Patch Tuesday set a new record. Depending on how researchers count
- [FTC rescinds policy requiring health apps to notify customers after a breach ](https://cybernoz.com/ftc-rescinds-policy-requiring-health-apps-to-notify-customers-after-a-breach/) - The Federal Trade Commission has rescinded a Biden administration-era policy statement that covered health and fitness apps under federal data breach notification regulations. In a half-page statement posted Wednesday, the FTC said it “has determined that the statement – contentious at the time of issuance – provided minimal benefit and has been superseded by rulemaking.”
- [Adobe Commerce and Magento Open Source vulnerability](https://cybernoz.com/adobe-commerce-and-magento-open-source-vulnerability/) - The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) is aware of reported active exploitation of a critical vulnerability inAdobe Commerce and Magento Open Source. ASD’s ACSC is aware of a substantial number of potentially vulnerable instances within the Australian economy and encourage system owners to follow the mitigationadvice from the vendor. This alert
- [ShinyHunters claims Florida DMV breach, puts data on the clock](https://cybernoz.com/shinyhunters-claims-florida-dmv-breach-puts-data-on-the-clock/) - DAVID provides authorized users with access to extensive driver and vehicle information, meaning a successful intrusion can yield considerably more than a database full of names and license numbers. “A complete scan gives criminals much more than an identification number – it can reveal a person’s photograph, signature, address, date of birth and other information
- [Wiz achieves Red Hat Vulnerability Scanner Certification](https://cybernoz.com/wiz-achieves-red-hat-vulnerability-scanner-certification/) - The Red Hat Vulnerability Scanning Certification is a collaboration with security partners to deliver more accurate and reliable vulnerability scanning results for Red Hat-published images and packages. Wiz’s focus on cloud-native risk includes our commitment to accurate and insightful vulnerability analysis on all workloads Wiz scans. That is why we are excited to receive the
- [August 2026 CVE Landscape](https://cybernoz.com/august-2026-cve-landscape/) - In August 2026, Insikt Group® identified 73 high-impact vulnerabilities that should be prioritized for remediation, 43 of which had a Very Critical Recorded Future Risk Score. This represents a 14% decrease from last month. 31 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 32
- [Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages](https://cybernoz.com/shai-hulud-strikes-again-chaindrop-worm-hits-400-npm-packages/) - On August 4, 2026, Elastic Security Labs identified a new Shai-Hulud campaign targeting the maintainer of keyv, a widely used key-value storage library. The attackers trojanized the monorepo and embedded a self-propagating worm called CHAINDROP that uses stolen npm credentials to automatically backdoor every other package the maintainer had publish rights to. The reach of
- [AdaptHealth confirms 4.1 million people exposed in July cyberattack](https://cybernoz.com/adapthealth-confirms-4-1-million-people-exposed-in-july-cyberattack/) - Healthcare company AdaptHealth has confirmed that data of 4.1 million people was exposed in a cyberattack discovered in July that was attributed to the ShinyHunters threat group. The company provides home medical devices, supplies, and related services, including sleep-apnea and respiratory equipment, oxygen therapy, hospital beds, and mobility products. AdaptHealth first disclosed the incident in a
- [New N0va Phishkit Targets North America and EU: A Growing Identity Risk for SOCs  ](https://cybernoz.com/new-n0va-phishkit-targets-north-america-and-eu-a-growing-identity-risk-for-socs/) - Recently, ANY.RUN researchers uncovered N0va, a new phishkit targeting organizations across North America and the EU, including government, technology, consulting, and healthcare. What makes N0va especially relevant for SOC leaders is how it spreads the attack across different layers. Legitimate authentication, trusted brand lures, compromised websites, and cloud infrastructure can leave security teams with only part of the picture,
- [NCSC Shadow AI - IT Security Guru](https://cybernoz.com/ncsc-shadow-ai-it-security-guru/) - The UK’s National Cyber Security Centre (NCSC) has warned organisations about the security risks posed by “shadow AI”, as employees continue to turn to artificial intelligence tools that have not been approved by their employers. In guidance published this week, the NCSC described shadow AI as the use of AI technology outside an organisation’s approved
- [Apple Doesn’t Want You to Worry About the New Apple Watch’s Listening Features](https://cybernoz.com/apple-doesnt-want-you-to-worry-about-the-new-apple-watchs-listening-features/) - The new Apple Watch Series 12 and Ultra 4 come not just with better fitness tracking and upgraded noise reduction, but also a whole new way to listen.Apple announced on Wednesday that the two smartwatches come with four opt-in “audio intelligence” tools that are powered by audio gathered by the watches’ microphones. They include sound
- [OpenSSL's new alpha build speeds up post-quantum crypto](https://cybernoz.com/openssls-new-alpha-build-speeds-up-post-quantum-crypto/) - The OpenSSL project released the first alpha of OpenSSL 4.1.0, giving developers an early look at a version built for encrypted communication over unreliable connections and faster post-quantum cryptography. This marks the opening test build for a version still months from general availability. The headline addition is support for DTLS 1.3, the latest revision of
- [Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week](https://cybernoz.com/four-spy-groups-used-the-same-chrome-and-windows-exploit-kit-within-a-week/) - Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31 (aka Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle,
- [Healthcare regs should include continuous AI monitoring](https://cybernoz.com/healthcare-regs-should-include-continuous-ai-monitoring/) - The National Commission into the Regulation of AI in Healthcare has published a report covering a set of recommendations for artificial intelligence (AI-)enabled healthcare. The commission gathered evidence from more than 12,000 people over the course of a year, including patients, the public, clinicians, healthcare leaders, industry and technology developers. In-depth research was additionally conducted
- [ASD warns Aussie Adobe Commerce and Magento stores under attack](https://cybernoz.com/asd-warns-aussie-adobe-commerce-and-magento-stores-under-attack/) - Key points A critical vulnerability tracked as CVE-2026-75650, rated 10.0 on the CVSS scale, allows unauthenticated remote code execution on Adobe Commerce and Magento Open Source. Sansec, which discovered and named the bug StyleSmuggler, said exploitation began on September 4, giving attackers around three days before Adobe shipped a hotfix. ASD's ACSC is aware of
- [AI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google Warns](https://cybernoz.com/ai-is-giving-lesser-resourced-attackers-nation-state-level-reach-google-warns/) - Adversaries, both criminal and state-sponsored, are increasingly using AI to automate and scale their attacks, according to Google’s Threat Intelligence Group (GTIG). What started as relatively simple adversarial prompt injection into enterprise AI systems has become a full-blown war, with aggressors developing and using their own AI systems, and enterprises using additional AI defenses that
- [Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day](https://cybernoz.com/chaotic-eclipse-released-shieldcrash-a-poc-for-microsoft-defender-zero-day/) - Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day Pierluigi Paganini September 09, 2026 The researcher Chaotic Eclipse released ShieldCrash, a PoC exploit for a Microsoft Defender Zero-Day vulnerability. Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Microsoft Defender. The researcher named the exploit ShieldCrash, it triggers
- [New FBI cyber strategy promises increase in adversary disruptions](https://cybernoz.com/new-fbi-cyber-strategy-promises-increase-in-adversary-disruptions/) - The document also focuses on helping victims, reflecting the bureau’s attempt to encourage more companies to share information with it. Source link
- [Chinese espionage groups swarm to exploit triple-link chain of zero-days](https://cybernoz.com/chinese-espionage-groups-swarm-to-exploit-triple-link-chain-of-zero-days/) - Proofpoint researchers have spotted at least four state-aligned threat groups chain a trio of zero-day vulnerabilities to conduct espionage on various targets of interest to China’s government since late August. The Chinese espionage group that Proofpoint tracks as TA412, also known as Violet Typhoon and APT31, struck first, exploiting the chain of vulnerabilities Aug. 28.
- [US sanctions Chinese-language Xinbi Guarantee marketplace over cyber scams](https://cybernoz.com/us-sanctions-chinese-language-xinbi-guarantee-marketplace-over-cyber-scams/) - The Trump administration sanctioned Chinese-language marketplace Xinbi Guarantee on Wednesday, along with two affiliated organisations, as part of a wider crackdown on transnational cybercrime.The US Department of Justice also announced it had seized Telegram channels and cryptocurrency wallets tied to the platform, which has over 650,000 users, freezing more than US$52 million in potentially laundered
- [MikroTik patches flaws currently being exploited to take over routers](https://cybernoz.com/mikrotik-patches-flaws-currently-being-exploited-to-take-over-routers/) - MikroTik released patches in RouterOS 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21 and advises against enabling the SSH service on the internet interface. Despite this not being the default configuration, over 122,500 MikroTik devices have SSH reachable from the internet according to scans performed by the Shadowserver Foundation, with the highest numbers in Brazil, the
- [4 groups caught using the same Chrome and Windows exploit kit](https://cybernoz.com/4-groups-caught-using-the-same-chrome-and-windows-exploit-kit/) - A nearly identical exploit kit that targets critical vulnerabilities in both Chromium-based browsers and older versions of Windows is being actively used by at least four hacking groups, some of which have ties to the Chinese government. Researchers from security firm Proofpoint said Wednesday that BlueMoon, the name they gave to the kit, chains three
- [The state of AI for security: Measuring what matters most for building trust](https://cybernoz.com/the-state-of-ai-for-security-measuring-what-matters-most-for-building-trust/) - Security teams are starting to actively use AI for security work, including vulnerability triage, penetration testing, threat modeling, incident response, and code review. The promise is speed, but a security tool that moves fast and raises too many false alarms doesn’t save time. Engineers spend time on false alarms, on-call is noisier, and teams distrust
- [Active exploitation of Cisco Secure Firewall Management Center vulnerabilities](https://cybernoz.com/active-exploitation-of-cisco-secure-firewall-management-center-vulnerabilities/) - Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. First, CVE-2026-20079 is an authentication bypass vulnerability in unpatched instances of Cisco’s Secure FMC Software, which allows an unauthenticated, remote attacker to bypass authentications and execute scripts on impacted devices to obtain root access to the underlying
- [Tenable + OpenAI CyberAgents Exchange AI Inspector](https://cybernoz.com/tenable-openai-cyberagents-exchange-ai-inspector/) - Open-source registries for AI agents are only effective when they include a rigorous, transparent security review process for community submissions. That’s why for its new CyberAgents Exchange registry, Tenable paired its exposure management expertise with OpenAI GPT Cyber models to create the CyberAgents Exchange AI Inspector.Key takeawaysThe Exchange Inspector combines Tenable’s exposure detection with OpenAI’s
- [Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks](https://cybernoz.com/cisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks/) - Cisco has confirmed that a maximum-severity authentication bypass vulnerability tracked as CVE-2026-20079 in its Secure Firewall Management Center (FMC) software is being actively exploited in attacks. The vulnerability has a maximum CVSS score of 10.0 and allows unauthenticated, remote attackers to bypass authentication and execute scripts and commands as root on vulnerable devices. "In August
- [Veradigm Confirms Patient Data Exposed in Third-party Data Breach](https://cybernoz.com/veradigm-confirms-patient-data-exposed-in-third-party-data-breach/) - Healthcare technology company Veradigm Inc. disclosed that a cybersecurity incident at one of its third-party vendors exposed sensitive patient data, including Social Security numbers, for a limited group of the company’s customers. The disclosure, filed with the U.S. Securities and Exchange Commission on September 8, 2026, marks the latest in a string of vendor-related breaches
- [Fake GTA6 'Leaked Download' Caught Spreading RATs, Infostealer and Wiper Ransomware](https://cybernoz.com/fake-gta6-leaked-download-caught-spreading-rats-infostealer-and-wiper-ransomware/) - Cybersecurity firm Huntress has uncovered a malware campaign that preys on excitement for Grand Theft Auto VI (GTA6), packaging remote access trojans, an infostealer, and destructive ransomware inside fake “leaked” copies of the hotly anticipated game. GTA6 is not due for release for another three months, but a wave of gameplay footage leaks and an
- [San Francisco Orders Meta to Stop ‘Allowing’ AI Child Abuse Ads](https://cybernoz.com/san-francisco-orders-meta-to-stop-allowing-ai-child-abuse-ads/) - San Francisco’s city attorney has hit Meta with a cease-and-desist letter telling the company to stop “allowing” paid advertisements that include AI-generated child sexual abuse content and asked it to explain how the ads repeatedly ran on its platforms.On Tuesday, WIRED reported that Meta has run more than 350 ads in recent months that transformed
- [FortiPAM Chrome Extension Vulnerability Lets Malicious Sites Control Browser Proxy and Record Tabs](https://cybernoz.com/fortipam-chrome-extension-vulnerability-lets-malicious-sites-control-browser-proxy-and-record-tabs/) - Although HTTPS complicates proxy-based interception, because an attacker still has to deal with certificate and transport protections, the tab-recording capability could directly expose sensitive information displayed during a browser session. Organizations should urgently update their FortiPAM Chrome extension deployments, identify users running the affected versions, and review privileged session logs for unexpected launches, proxy changes,
- [$245 million in stolen crypto funded racketeering crew’s lavish lifestyle](https://cybernoz.com/245-million-in-stolen-crypto-funded-racketeering-crews-lavish-lifestyle/) - A 22-year-old man built his fortune by breaking into strangers’ digital wallets, then spent it on nightclub tabs, private jets, and a fleet of cars worth millions. Malone Lam, a Singapore citizen, pleaded guilty this week in a Washington D.C. federal court to running a racketeering conspiracy that stole and laundered more than $245 million
- [The push to stop algorithms controlling social media feeds has begun](https://cybernoz.com/the-push-to-stop-algorithms-controlling-social-media-feeds-has-begun/) - Remember when social media was filled only with posts from your friends, rather than what an algorithm decided you wanted to see? So does the Australian government, and it wants that internet back. Yesterday, the government released draft legislation outlining a Digital Duty of Care. The proposal includes a measure that Prime Minister Anthony Albanese
- [U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto](https://cybernoz.com/u-s-disrupts-xinbi-guarantee-scam-marketplace-freezes-52-8-million-in-crypto/) - The U.S. Department of Justice (DoJ) on Wednesday announced coordinated actions aimed at an illicit online marketplace called Xinbi Guarantee that offered scam services, including seizing Telegram channels used to run the service, confiscating two cryptocurrency wallets, and deploying the Scam Center Strike Force to Madagascar to help disrupt 13 scam compounds run by Chinese
- [Interview: Workday’s Joel Hellermark on making everyone a Leonardo](https://cybernoz.com/interview-workdays-joel-hellermark-on-making-everyone-a-leonardo/) - Joel Hellermark is a Swedish technology entrepreneur and artificial intelligence (AI) pioneer who, at the age of 30, has emerged as one of Europe’s most prominent business software executives. HR and finance software-as-a-service (SaaS) applications supplier Workday bought the company he founded, Sana, in 2025 for $1.1bn. The concept behind the acquisition was to combine
- [OpenAI rogue agent activity wider-ranging than disclosed](https://cybernoz.com/openai-rogue-agent-activity-wider-ranging-than-disclosed/) - AI agents unleashed by OpenAI used more than 10 previously undisclosed websites for unsanctioned communications earlier this year, according to six sets of ⁠independent investigators and data ⁠reviewed by Reuters, showing that the agents’ rogue activity was wider-ranging than previously disclosed. Although the behaviour falls short of hacking and is in some ways closer to spam,
- [HelmGuard Raises $7.3 Million for Agentic GRC and Security](https://cybernoz.com/helmguard-raises-7-3-million-for-agentic-grc-and-security/) - AI risk and compliance startup HelmGuard today announced raising $7.3 million in seed funding. The investment round was co-led by Infinity Ventures and Frontline, with additional support from FinTech Collective, Stage 2 Capital, and Entrepreneurs First. Founded in 2024 by former Palantir executive John Daley (CEO) and Jack Miller (CTO), UK-based HelmGuard has built an
- [US Agencies Warn Chinese AI Firms Are Extracting Advanced AI Models](https://cybernoz.com/us-agencies-warn-chinese-ai-firms-are-extracting-advanced-ai-models/) - US Agencies Warn Chinese AI Firms Are Extracting Advanced AI Models Pierluigi Paganini September 09, 2026 US agencies accuse six Chinese AI firms of extracting billions of tokens from US AI models to accelerate development and copy advanced capabilities. NSA, CISA, and the FBI jointly published an advisory accusing six Chinese AI companies, DeepSeek, Moonshot
- [CISOs are feeling the security burden of accelerated AI use](https://cybernoz.com/cisos-are-feeling-the-security-burden-of-accelerated-ai-use/) - A report shows CISOs face increased pressures related to cyber resilience and business continuity. Source link
- [Lawmakers call on Treasury to sanction hackers-for-hire](https://cybernoz.com/lawmakers-call-on-treasury-to-sanction-hackers-for-hire/) - A bipartisan trio of lawmakers is asking the Treasury Department to sanction three India-based mercenary hack-for-hire groups that have reportedly stolen data from thousands of American citizens and companies. Democratic Sens. Ron Wyden of Oregon and Sheldon Whitehouse of Rhode Island and Rep. Pat Harrigan, R-N.C., sought in a letter to Secretary Howard Lutnick Wednesday
- [ChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channel](https://cybernoz.com/chatgpt-flaw-lets-attackers-pull-gmail-data-across-accounts-via-a-hidden-channel/) - A limited grant “narrows what any container-level leak can expose,” Handa said. She also recommended routing connected-app traffic through DLP or CASB inspection to catch regulated data before it leaves the pipeline, and requiring an API or webhook that logs every connected-app read and write, with timestamp and data category, exported to the enterprise’s own
- [CERT Polska alerts MikroTik RouterOS vulnerabilities actively being exploited in ‘MikroTrick’ attack chain](https://cybernoz.com/cert-polska-alerts-mikrotik-routeros-vulnerabilities-actively-being-exploited-in-mikrotrick-attack-chain/) - New data from CERT Polska confirmed active exploitation of six vulnerabilities in MikroTik RouterOS, including a two-flaw chain dubbed ‘MikroTrick’ that can give attackers full administrative control of internet-accessible devices without authentication when SSH is exposed to public networks. Exploitation of the MikroTrick chain has been confirmed against RouterOS devices whose SSH services are accessible
- [RunSafe Security targets Operational Software Assurance market to protect deployed software across critical systems](https://cybernoz.com/runsafe-security-targets-operational-software-assurance-market-to-protect-deployed-software-across-critical-systems/) - RunSafe Security, a cybersecurity company specializing in identifying risk and protecting code deployed across embedded and critical systems, announced its strategy to lead emerging Operational Software Assurance (OSA) market, a new cybersecurity category focused on protecting the fielded software that powers U.S. defense, critical infrastructure, and other mission-critical systems throughout their operational lifecycle. The move
- [How we rebuilt Cloudflare Workers’ module registry for Node.js compatibility](https://cybernoz.com/how-we-rebuilt-cloudflare-workers-module-registry-for-node-js-compatibility/) - We’ve rewritten the module registry in workerd, the core open-source component of the Workers runtime, to be faster, more standards-compliant, and more closely aligned with Node.js' module registry.Over the past few years, we’ve been adding support for more and more Node.js runtime APIs. The Workers runtime now supports every stable API from Node.js that you
- [Recorded Future Launches Digital Risk Protection, Unifying Brand and Identity Monitoring](https://cybernoz.com/recorded-future-launches-digital-risk-protection-unifying-brand-and-identity-monitoring/) - Recorded Future just launched Digital Risk Protection, a unified solution covering five external threat surfaces, so security teams can detect, triage, and take down brand and identity threats within one workflow. Today, Recorded Future announces the launch of Digital Risk Protection, the solution that unifies brand and identity monitoring, built to see more across five
- [Shadow AI in Financial Services | Risk & Governance](https://cybernoz.com/shadow-ai-in-financial-services-risk-governance/) - Shadow AI is already taking root across financial services and many firms are discovering it only after the fact. Employees are turning to AI tools to work faster and more efficiently, but in a highly regulated industry, unsanctioned AI use can introduce serious security, privacy, and compliance risks. Adoption is spreading at the edge of
- [US says Chinese firms extracted billions of tokens from frontier AI models](https://cybernoz.com/us-says-chinese-firms-extracted-billions-of-tokens-from-frontier-ai-models/) - U.S. cybersecurity and intelligence agencies say that six Chinese AI companies conducted industrial-scale distillation attacks on American frontier AI models since at least late 2024. A joint advisory from CISA, NSA, and the FBI states that DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens through millions of requests from frontier AI
- [Hackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks](https://cybernoz.com/hackers-chain-chrome-and-windows-zero-days-in-new-bluemoon-exploit-kit-attacks/) - Multiple espionage-motivated threat actors have rapidly adopted a newly discovered exploit kit that chains Chrome browser and Microsoft Windows vulnerabilities to deploy backdoors and surveillance tools against government, defense, and commercial targets worldwide. Security researchers at Proofpoint have named the kit “BlueMoon,” identifying its use by at least four distinct threat clusters since late August
- [Why hostile state cyber activity is now a day-to-day business risk](https://cybernoz.com/why-hostile-state-cyber-activity-is-now-a-day-to-day-business-risk/) - Christopher Clark, Cyber Security Incident Response Team Director, Thrive Geopolitical escalation can become a cyber security problem for businesses far more quickly than many boards expect. The National Cyber Security Council (NCSC) has warned that UK critical infrastructure faced more than 200 cyber incidents over the past year, with around three-quarters believed to be linked
- [You Can Now Destroy Flock Cameras for Cash in GTA V](https://cybernoz.com/you-can-now-destroy-flock-cameras-for-cash-in-gta-v/) - People are not happy about Flock Safety’s automated license plate readers and the cops that allegedly misuse them. If you’re one of those ALPR-haters, you can now take out your rage in the video game Grand Theft Auto V by installing Grand Theft Automated License Plate Reader, a mod built by artist Morry Kolman.The mod
- [Hackers Abuse Google CAPTCHA, WebDAV and BNB Smart Chain to Deploy Credential-Stealing Malware](https://cybernoz.com/hackers-abuse-google-captcha-webdav-and-bnb-smart-chain-to-deploy-credential-stealing-malware/) - A multi-stage malware operation that combines fake Google CAPTCHA prompts, WebDAV-hosted DLL execution, malicious Cloudflare Workers and BNB Smart Chain smart contracts to deploy the Amatera information stealer. The activity was first identified in April 2026 after a Ukrainian government organization executed a disguised DLL named “verification.google” from a WebDAV path using the 32-bit rundll32.exe
- [Ransomware Is The New Normal: Cybersecurity Considerations for Fiduciaries](https://cybernoz.com/ransomware-is-the-new-normal-cybersecurity-considerations-for-fiduciaries/) - Court-appointed receivers, chief restructuring officers, distressed asset investors, and lenders should realize that cybersecurity is now a fiduciary duty and should be incorporated into every engagement alongside protection of cash, collateral, and physical assets, warns the experts at J.S. Held, a global consulting firm providing specialized technical, scientific, financial, and advisory services. Insurance carriers and
- [Orchid Security targets AI agent risk with drift detection and kill switches](https://cybernoz.com/orchid-security-targets-ai-agent-risk-with-drift-detection-and-kill-switches/) - Orchid Security has announced identity drift detection and application-level kill switches for AI agents. They can complete authorized objectives beyond their initial privilege level within seconds. AI agents do not need to “break” security controls or workflow guardrails. AI agents can find and use the identity debt already embedded across the enterprise: hard-coded credentials, orphaned
- [More than 100,000 fake stores are out to steal your card details](https://cybernoz.com/more-than-100000-fake-stores-are-out-to-steal-your-card-details/) - Researchers at German cybersecurity company Nebty have identified “DoppelCart,” a cluster of almost 119,000 domains linked to copied online stores. The researchers describe it as the largest publicly documented fake-shop network by associated domain count. They found 118,787 .shop domains in the cluster, representing 2.72% of the .shop top-level domain (TLD) population they examined. The
- [Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA](https://cybernoz.com/infostealer-logs-expose-replayable-ai-tokens-that-can-bypass-mfa/) - Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create "stolen keys" that grant illicit access to tools from model providers like Google, Anthropic, and others. Information stealers like Lumma Stealer or Vidar are equipped to harvest a wide range of data from compromised systems. This can include credential, session tokens,
- [Why AI agents cannot be trusted to secure agentic AI yet](https://cybernoz.com/why-ai-agents-cannot-be-trusted-to-secure-agentic-ai-yet/) - Artificial intelligence (AI) agents are quickly moving from experimental tools to active participants in enterprise workflows. For chief information security officers (CISOs), the immediate priority should be gaining visibility of agents and establishing deterministic controls over what existing agents can access and do. Unlike traditional generative AI applications that primarily produce content, agentic AI systems
- [ANU names new CIO - iTnews](https://cybernoz.com/anu-names-new-cio-itnews/) - Key points William Confalonieri has been appointed as the Australian National University's new chief information officer, replacing acting CIO Sajid Hassan. Confalonieri most recently served as chief information and digital officer at the University of New England, having previously spent nearly a decade at Deakin university. He starts his new role at ANU on November
- [Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension](https://cybernoz.com/fortinet-patches-critical-vulnerabilities-in-fortimonitoronsight-chrome-extension/) - Fortinet on Tuesday released patches for 10 vulnerabilities across its products, including critical security defects. The first critical bug, tracked as CVE-2026-84390 (CVSS score of 9.6), is described as an inclusion of sensitive information in source code issue affecting the FortiMonitorOnSight web portal. A remote, unauthenticated attacker could exploit the flaw to bypass authentication via
- [Google fixes the seventh actively exploited Chrome zero-day of 2026](https://cybernoz.com/google-fixes-the-seventh-actively-exploited-chrome-zero-day-of-2026/) - Google fixes the seventh actively exploited Chrome zero-day of 2026 Pierluigi Paganini September 09, 2026 Google patched 230 Chrome flaws, including an actively exploited V8 bug that could let attackers run arbitrary code through a crafted HTML page. Google released a Chrome update fixing 230 security vulnerabilities, including one already exploited in the wild tracked
- [FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching](https://cybernoz.com/fbi-officials-say-ai-is-bolstering-adversaries-emphasizing-need-to-focus-on-cyber-basics-patching/) - Artificial intelligence is souping up the speed and capabilities of malicious hackers, a top FBI official said Tuesday. And the speed of vulnerability discoveries is forcing organizations to patch more frequently, said another top FBI official. The officials made their remarks one day before the release of a new FBI cyber strategy Wednesday, which touches
- [SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise](https://cybernoz.com/spycloud-2026-identity-threat-report-finds-non-human-identities-are-now-the-leading-path-into-the-enterprise/) - The survey found that compromised NHIs (31%) are nearly 2x as likely to be the primary entry point compared to phishing and social engineering (17%), the second-ranked answer. NHI-related misuse was also the most commonly reported identity-based event type at 42%, yet the vast majority of organizations aren’t watching for them. While 95% of organizations
- [Dream’s Hero scores 96.6% on CyberGym to rank first globally in autonomous cybersecurity research benchmark](https://cybernoz.com/dreams-hero-scores-96-6-on-cybergym-to-rank-first-globally-in-autonomous-cybersecurity-research-benchmark/) - Dream, the sovereign AI company for governments and critical infrastructure, announced that its autonomous cybersecurity research system, Hero, scored 96.6% on CyberGym, ranking first globally on the UC Berkeley cybersecurity benchmark. The result places Dream ahead of previously published results from leading frontier and cybersecurity-specialized AI systems. CyberGym evaluates AI systems against more than 1,500
- [Health-ISAC warns ShinyHunters targets health sector with vishing, credential theft and MFA bypass tactics](https://cybernoz.com/health-isac-warns-shinyhunters-targets-health-sector-with-vishing-credential-theft-and-mfa-bypass-tactics/) - Health-ISAC is warning that the ShinyHunters cybercrime group is actively targeting the global health sector with highly targeted voice phishing campaigns and medical-themed impersonation domains designed to steal corporate credentials. Observed campaigns have targeted employees through calls, voicemails and mass emails, directing them to look-alike login pages that can enable unauthorized access to enterprise systems.
- [CWPP vs. CNAPP: An Evolution in Cloud Security](https://cybernoz.com/cwpp-vs-cnapp-an-evolution-in-cloud-security/) - Two platforms have emerged as key players in the cloud security market: the Cloud Workload Protection Platform (CWPP) and the Cloud-Native Application Protection Platform (CNAPP). Both provide features designed to enhance cloud security, but they differ significantly in their scope, capabilities, and approach. CWPP solutions have been on the market longer than CNAPP solutions. CWPPs were
- [BPFDoor Scanner | Elastic Security Labs](https://cybernoz.com/bpfdoor-scanner-elastic-security-labs/) - Python script to identify hosts infected with the BPFDoor malware. Download bpfdoor-scanner.tar.gz Getting Started This tool provides a Python script to identify hosts that are infected with the BPFDoor malware. The Elastic Security Team has released an indepth analysis of the BPFDoor malware and created an additional tool that will extract configurations from BPFDoor malware
- [Over 36,000 exposed Plex servers vulnerable to recent flaws](https://cybernoz.com/over-36000-exposed-plex-servers-vulnerable-to-recent-flaws/) - Over 36,000 Plex Media servers exposed online remain unpatched against multiple security vulnerabilities and are vulnerable to attacks. Plex urged users a week ago to secure their media servers immediately against security issues that still lack CVE IDs for easy tracking. While the company didn't provide additional details on Tuesday when it issued the warning,
- [Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories](https://cybernoz.com/hackers-target-claude-cursor-and-codex-ai-agents-to-steal-tokens-and-prompt-histories/) - Cybercriminals are widening the reach of information-stealing malware by targeting the local data created by AI coding agents. The shift puts access tokens, saved connections, prompt histories, and project records at risk on already infected computers. The activity does not point to a newly discovered flaw in Claude, Cursor, or Codex. Instead, it shows criminals
- [GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks](https://cybernoz.com/goldfactory-weaponizes-open-source-vwork-app-cloner-in-gigabud-banking-malware-attacks/) - GoldFactory has expanded the evasion capabilities of its Gigabud Android banking trojan by deploying Vwork, a weaponized fork of the open-source Shelter application. The companion tool abuses Android Work Profile isolation to clone banking apps into a separate managed environment, weakening the link between malware signals detected in a victim’s personal profile and fraudulent activity
- [Hackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memory](https://cybernoz.com/hackers-deploy-linux-rootkit-on-f5-big-ip-apm-devices-hiding-web-shell-in-memory/) - A rootkit found on hacked F5 BIG-IP APM devices skips the usual step of writing a web shell to disk, hiding it in memory instead, according to Sophos. F5 BIG-IP APM provides access policy enforcement to secure access to apps, APIs, and data. It’s primarily used by enterprises, financial institutions, government agencies, and public sector
- [Microsoft fixes record 964 flaws, including 2 exploited zero-days](https://cybernoz.com/microsoft-fixes-record-964-flaws-including-2-exploited-zero-days/) - Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs, including 104 rated Critical and 860 rated Important, making it the company’s largest Patch Tuesday release on record. Microsoft lists 974 CVEs in its full September security release. However, 10 of those affect cloud services or involve fixes that Microsoft applies itself, leaving 964 vulnerabilities that customers
- [Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox](https://cybernoz.com/chrome-v8-zero-day-exploited-in-the-wild-enables-code-execution-inside-sandbox/) - Ravie LakshmananSep 09, 2026Vulnerability / Browser Security Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds bug in V8, Chrome's JavaScript and WebAssembly engine. "Out-of-bounds write
- [UK committed datacentre pipeline grows to more than 14GW](https://cybernoz.com/uk-committed-datacentre-pipeline-grows-to-more-than-14gw/) - The UK’s datacentre build-out is accelerating. Driven by the demand for artificial intelligence (AI) compute, and in the context of the government’s decision in 2024 to classify datacentres as critical national infrastructure, developers are racing to secure planning consent, grid connections and power across the country. New analysis of Barbour ABI project data, compiled for
- [Microsoft Patch Tuesday September 2026 Fixes 974 CVEs](https://cybernoz.com/microsoft-patch-tuesday-september-2026-fixes-974-cves/) - Microsoft’s Patch Tuesday September 2026 rollout has broken previous records, with the company addressing 974 CVEs across its product lineup in a single release. Two of these vulnerabilities were already being exploited in the wild before fixes became available, prompting quick action from federal cybersecurity authorities. The sheer volume of this month’s Patch Tuesday September
- [ChatGPT Sandbox Flaw Let A Planted Prompt Ship Victim's Gmail Data To Another Account](https://cybernoz.com/chatgpt-sandbox-flaw-let-a-planted-prompt-ship-victims-gmail-data-to-another-account/) - Check Point Research disclosed Tuesday that a weakness in ChatGPT’s code-execution sandbox let data from one user’s connected Gmail account be moved into a separate, attacker-controlled ChatGPT account, with no confirmation prompt shown to the victim. The flaw sat not in the model but in the infrastructure beneath it. Containers running individual conversations cannot address
- [UOMO bill headed to the Senate](https://cybernoz.com/uomo-bill-headed-to-the-senate/) - Key points The universal mobile service obligation bill, requiring Telstra, Optus and TPG Telecom to provide voice and text coverage across up to 5 million square kilometres, has passed the House of Representatives. Carriers argue satellite-to-mobile technologies and compatible handsets won't be commercially viable in time for the bill's December 2027 commencement, with TPG Telecom
- [Ivanti Patches Critical Flaws Across Enterprise Security Products](https://cybernoz.com/ivanti-patches-critical-flaws-across-enterprise-security-products/) - Ivanti on Tuesday announced security updates that address vulnerabilities rated critical and high severity in its Neurons for ITSM, Sentry, and Endpoint Manager Mobile (EPMM) products. Neurons for ITSM received fixes for the largest number of security defects. Of the eight bugs, six are critical-severity issues that could lead to remote code execution, Ivanti warns.
- [PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory](https://cybernoz.com/poisonedrefresh-a-fileless-linux-rootkit-that-injects-php-web-shells-into-f5-big-ip-apm-server-memory/) - PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory Pierluigi Paganini September 09, 2026 PoisonedRefresh rootkit injects PHP web shells into F5 BIG-IP APM Apache memory, leaving no disk artifacts. SophosLabs published a detailed technical analysis on September 8, 2026, of a Linux implant, dubbed PoisonedRefresh by ESET,
- [Russian national extradited to US for alleged involvement in bank-account takeover scheme](https://cybernoz.com/russian-national-extradited-to-us-for-alleged-involvement-in-bank-account-takeover-scheme/) - Authorities extradited a 36-year-old Russian national from the Republic of Georgia under accusations of widespread bank-account takeover attacks, including a scheme to defraud two banks of more than $6.3 million, the Justice Department said Tuesday. Sergei Anatolyevich Filimonov and unnamed co-conspirators ran an extensive operation starting in November 2023 to spoof domains of banks, obtain
- [Rapid7 highlights two exploited flaws in September Patch Tuesday](https://cybernoz.com/rapid7-highlights-two-exploited-flaws-in-september-patch-tuesday/) - Microsoft’s September 2026 Patch Tuesday includes 999 vulnerabilities across Microsoft and non-Microsoft products, according to commentary from Rapid7 lead software engineer Adam Barnett. Barnett said Microsoft published 974 vulnerabilities affecting its own products, including 723 in Windows. He added Microsoft also issued fixes for 25 non-Microsoft CVEs, bringing the total to 999, which he described
- [50% of CISOs see Mythos as a sign to exit the profession](https://cybernoz.com/50-of-cisos-see-mythos-as-a-sign-to-exit-the-profession/) - “In the security space, I would use the AI for anomalies and to triage existing investigations,” he says. “I probably wouldn’t start out with using AI to automate my response. But if I work my way up, I can get there.” A new opportunity The Mythos effect is overstated, confirms Mike Privette, former CISO and
- [Wiz Research team discovers a major risk to AI systems](https://cybernoz.com/wiz-research-team-discovers-a-major-risk-to-ai-systems/) - Wiz Research has conducted a series of investigations into leading AI-as-a-service providers in recent months. In the course of that work, we have discovered critical vulnerabilities that could have led to the leakage of millions of private AI models and apps. The first installment in that series was done in partnership with the Hugging Face
- [September 2026 Microsoft Patch Tuesday](https://cybernoz.com/september-2026-microsoft-patch-tuesday/) - 104Critical860Important0Moderate0LowMicrosoft addresses 964 CVEs, smashing July’s release as the largest Patch Tuesday release. This month’s updates include patches for two zero-days that were exploited in the wild.Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 104 rated critical and 860 rated as important.This month’s update includes patches for:.NET.NET and Visual
- [Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners](https://cybernoz.com/hackers-turn-more-than-3500-redis-servers-into-cryptocurrency-miners/) - A large cryptomining operation has compromised 3,562 Redis servers and turned their processing power into a source of Monero revenue. The campaign did not rely on a newly discovered software flaw. Instead, it targeted internet-facing Redis instances that accepted commands without authentication. The operators scanned 12,966 potential targets, then used Redis replication features to plant
- [Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data](https://cybernoz.com/infostealers-target-claude-cursor-codex-and-other-ai-agents-to-steal-credentials-and-sensitive-data/) - Information-stealing malware is expanding its collection logic to target locally stored data from AI coding agents, including Claude, Cursor, Codex, Cline, Continue, and OpenCode. The shift puts developer credentials, Model Context Protocol configurations, prompt histories, project metadata, and potentially proprietary source code into the same theft pipeline long used for browser cookies, cryptocurrency wallets, and
- [AI-Infra-Guard: Open-source security scanner for AI systems](https://cybernoz.com/ai-infra-guard-open-source-security-scanner-for-ai-systems/) - Tencent’s Zhuque Lab built AI-Infra-Guard, an open-source security scanner for AI systems. It fingerprints running services such as Ollama, vLLM and ComfyUI and checks them against more than 1,600 known CVEs, inspects MCP servers and agent skills across 14 categories of risk, and runs jailbreak evaluations against a target model. To check a skill, the
- [Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days](https://cybernoz.com/microsoft-patches-record-974-flaws-including-two-exploited-windows-zero-days/) - Microsoft on Tuesday broke Patch Tuesday records by addressing an earth-shattering 974 vulnerabilities spanning its software portfolio, including two flaws that it said have been actively exploited in the wild. These include 723 flaws in Windows, 111 in Office and Office 2016, 62 in SQL, and 22 in Developer Tools. Of these, over 110 shortcomings
- [UK government proposes AI first responders for cyber attacks](https://cybernoz.com/uk-government-proposes-ai-first-responders-for-cyber-attacks/) - The UK government plans to use money set aside in the Defence Investment Plan to develop its own agentic artificial intelligence (AI) incident response capabilities to be put to work during major cyber incidents, the UK’s artificial intelligence (AI) minister, Kanishka Narayan, has said. In an update delivered this week to Parliament on the fast-evolving
- [Main Roads WA brings real-time visibility to traffic operations](https://cybernoz.com/main-roads-wa-brings-real-time-visibility-to-traffic-operations/) - Key points Main Roads Western Australia's Real Time Operating Platform (RTOP) unifies data from around 30 separate systems into a single real-time view of the road network. Built in-house rather than bought as a proprietary system, RTOP has already improved incident detection, notification and response times in its first year. Delivered statewide via the AWS
- [The Hidden Instructions That Can Hijack AI Agents](https://cybernoz.com/the-hidden-instructions-that-can-hijack-ai-agents/) - They cannot be seen, can be tailored to different purposes and once adopted they operate at lightning speed. Hidden AI prompt injections are synonymous with indirect prompts but with the specific quality of being hidden from human overview. Unlike traditional prompt injection attacks, where a user directly attempts to manipulate an AI chatbot, indirect prompt injection targets
- [IT Help Desk Impersonation Lets Hackers Bypass MFA](https://cybernoz.com/it-help-desk-impersonation-lets-hackers-bypass-mfa/) - IT Help Desk Impersonation Lets Hackers Bypass MFA Pierluigi Paganini September 08, 2026 Attackers bypass endpoint security by posing as IT staff, stealing Microsoft 365 sessions, draining SaaS data and demanding extortion. Forget installing malware because today’s extortionists just pick up the phone instead of writing code. A widespread threat cluster tracked as PREY-0058 bypasses
- [Feds accuse China of ‘systematic’ distillation of U.S. AI models](https://cybernoz.com/feds-accuse-china-of-systematic-distillation-of-u-s-ai-models/) - The U.S. government is accusing Chinese AI companies of engaging in a deliberate and “systematic” effort to illegally distill U.S. frontier AI models and their capabilities. According to a joint cybersecurity advisory from the National Security Agency, the Cybersecurity and Infrastructure Security Agency and the FBI, the sheer scale of these efforts since 2024 indicate
- [AI data exposure ranks second among AI security incidents in Australia and New Zealand](https://cybernoz.com/ai-data-exposure-ranks-second-among-ai-security-incidents-in-australia-and-new-zealand/) - AI systems revealing sensitive information to unauthorised users has become the second most common type of AI-related security incident inside organisations in Australia and New Zealand, according to a new regional cyber threat report from Netskope Threat Labs. The Netskope Threat Labs Australia & New Zealand 2026 report says so-called “downstream” data policy violations—where AI
- [September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows](https://cybernoz.com/september-2026-patch-tuesday-roundup-plugs-for-two-zero-day-holes-among-almost-1000-fixes-in-windows/) - Tyler Reguly, Fortra’s associate director of security R&D, pointed out that as long as Microsoft is playing catch-up on patching vulnerabilities, numbers have lost all meaning. “This is not a Microsoft-specific problem,” he noted. “We see the same issue with Oracle and other large vendors that are being proactive. We need to remember that these
- [Wiz expands SIEM integration with Google Security Operations](https://cybernoz.com/wiz-expands-siem-integration-with-google-security-operations/) - Security Operations Center (SecOps) teams detect, investigate, and respond to security threats across an organization's IT systems using security operations platforms. As companies migrate more infrastructure to the cloud, addressing cloud-specific threats requires SecOps teams to have a deep understanding of cloud security issues and the context to investigate and respond to those issues effectively.
- [Top 4 Questions For Evaluating Exposure Management Platform](https://cybernoz.com/top-4-questions-for-evaluating-exposure-management-platform/) - Executive Summary Exposure management platforms are increasingly evaluated based on post-detection actions rather than detection itself. This piece sets out four questions to ask when evaluating one: whether it narrows vulnerabilities to the exploitable using environment context rather than severity scores; whether it validates exploitability continuously rather than just discovering assets; whether it remediates beyond
- [FortiSandbox Vulnerability Allows Attackers to Access Sensitive Information via Crafted HTTP Requests](https://cybernoz.com/fortisandbox-vulnerability-allows-attackers-to-access-sensitive-information-via-crafted-http-requests/) - Fortinet has disclosed a new high-severity vulnerability affecting its FortiSandbox platform, warning that unauthenticated attackers could exploit weaknesses in the product’s web interface to siphon off sensitive information without ever needing valid credentials. The flaw, tracked as CVE-2026-26084, stems from improper access control in the graphical user interface component that FortiSandbox, FortiSandbox Cloud, and FortiSandbox
- [Jellyfin 12.0 Released With Security Fixes for Unauthorized File Access and XSS Flaws](https://cybernoz.com/jellyfin-12-0-released-with-security-fixes-for-unauthorized-file-access-and-xss-flaws/) - Jellyfin has released version 12.0, a significant update to its open-source media server. This version includes a wide range of platform improvements and essential security updates affecting both the server and the web client. The project strongly advises administrators to plan their upgrade carefully because it includes database migrations and compatibility-breaking changes for existing deployments.
- [IT help-desk vishing tricks executives into handing over Microsoft 365 access](https://cybernoz.com/it-help-desk-vishing-tricks-executives-into-handing-over-microsoft-365-access/) - IT help-desk vishing calls, stolen session tokens, and sign-ins routed through residential proxies are behind a wave of data theft and extortion against Microsoft 365 and other SaaS accounts, according to Arctic Wolf. The company is tracking the activity under the name PREY-0058 and notes it shares significant tradecraft similarities with a data extortion group
- [ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account](https://cybernoz.com/chatgpt-flaw-let-a-planted-prompt-send-a-victims-gmail-data-to-another-account/) - Check Point Research said in a report published today that a single instruction planted in a ChatGPT conversation could cause ChatGPT to quietly work for an attacker while answering the user's question as usual. In the company's proof of concept, that hidden work read data from the user's connected Gmail account and passed it to
- [Government to force tech companies to verify age of users to protect children](https://cybernoz.com/government-to-force-tech-companies-to-verify-age-of-users-to-protect-children/) - The government is to introduce legislation that will force tech companies and app developers to verify the ages of their users, as part of new measures to protect the safety of children online. The plans, announced today by digital minister Lisa Nandy, aim to make it “impossible” for anyone under the age of 18 to
- [US accuses Chinese AI firms of 'malicious' copying of AI technology](https://cybernoz.com/us-accuses-chinese-ai-firms-of-malicious-copying-of-ai-technology/) - The US ⁠government has accused Chinese artificial intelligence companies of maliciously copying technology from American AI firms, potentially complicating relations ahead of a planned meeting between leaders of the world's two biggest ‌economies later this month. The Chinese companies copied US ‌AI ‌labs’ intellectual property through a technique known ‌as distillation, according to a statement
- [Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day](https://cybernoz.com/adobe-patches-over-170-vulnerabilities-including-commerce-zero-day/) - Adobe has released patches for more than 170 vulnerabilities across its products, including urgent hotfixes for a critical-severity flaw in Adobe Commerce and Magento Open Source that has been exploited in the wild as a zero-day. Tracked as CVE-2026-75650 (CVSS score of 10/10), the flaw is a code injection issue that can be exploited without
- [Hackers Drain $320 Million From Liquid Network, Then Return Most of It](https://cybernoz.com/hackers-drain-320-million-from-liquid-network-then-return-most-of-it/) - The size of the initial theft makes this much more serious than another crypto hack. The attacker took nearly 95% of the wallet’s Bitcoin in a single transaction, leaving the fund behind Liquid’s L-BTC token with only about 197 BTC. This wasn’t a partial breach. The attacker drained almost the entire collateral pool that should
- [Don’t let AI distract from cybersecurity basics, officials and executives warn](https://cybernoz.com/dont-let-ai-distract-from-cybersecurity-basics-officials-and-executives-warn/) - Simple attacks remain far more consequential than anything AI is doing, government and industry leaders said. Source link
- [Microsoft discloses two actively exploited zero-days among 974 vulnerabilities](https://cybernoz.com/microsoft-discloses-two-actively-exploited-zero-days-among-974-vulnerabilities/) - Microsoft addressed 974 defects across its product suite, including two actively exploited zero-day vulnerabilities, in its monthly Patch Tuesday security program. The massive batch of patches, Microsoft’s largest ever, reflects a continuing trend for the vendor as it leans on artificial intelligence to discover more vulnerabilities at a faster rate. Yet, the recent period of
- [Mars Security Debuts Automated Threat Engine Processing Live Cyber Intelligence Into Validated Rules Within Minutes](https://cybernoz.com/mars-security-debuts-automated-threat-engine-processing-live-cyber-intelligence-into-validated-rules-within-minutes/) - By prioritizing behavioral mechanics over static signatures, Mars ensures detection integrity persists even as threat actors alter their tools or infrastructure. The underlying architecture also addresses emerging operational surfaces, including monitoring AI coding agents and identifying credentials inadvertently leaked into security logs. “A SOC should not need a two-week backlog to act on a report
- [Why this month's Microsoft patch release is a doozy](https://cybernoz.com/why-this-months-microsoft-patch-release-is-a-doozy/) - Microsoft’s patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold. It was only two months ago that Microsoft patched a then-record 570 vulnerabilities. Then, last month, Microsoft patched some 620 of them. Google and other companies have also published record
- [Wiz launches new data center in UAE](https://cybernoz.com/wiz-launches-new-data-center-in-uae/) - Wiz enables cloud security outcomes for cloud builders and defenders, from code to cloud to defense. Wiz is excited to announce the opening of our new data center in Dubai, UAE. Organizations in the region can now benefit from Wiz's cloud security platform in closer proximity to their operations.Key highlights of the data center: The data center
- [AI SIEM Search | Huntress](https://cybernoz.com/ai-siem-search-huntress/) - Every Security Information and Event Management (SIEM) solution on the market makes the same quiet assumption: that you know at least one query language, and maybe even have a favorite. ESQL, KQL, SPL, pick your flavor. The data's all there, sitting in your logs, but getting to it means writing syntax that most IT admins
- [DoppelCart fraud network uses 119,000 fake shops to steal credit cards](https://cybernoz.com/doppelcart-fraud-network-uses-119000-fake-shops-to-steal-credit-cards/) - A massive operation dubbed “DoppelCart” uses more than 119,000 domains to run a network of fake e-shops that steal payment card details. Most of the domains are in the .SHOP top-level domain, accounting for 2.72% of all sites on the TLD. German cybersecurity startup Nebty discovered DoppelCart and describes it as the largest publicly documented fake-shop
- [Phishing Powers 80% of Attacks on US Companies: How SOCs Can Detect It Early ](https://cybernoz.com/phishing-powers-80-of-attacks-on-us-companies-how-socs-can-detect-it-early/) - Phishing remains one of the most effective ways for attackers to gain access to corporate environments. From 2013-2023, the FBI recorded 158,436 US victims of Business Email Compromise (BEC), with over $20 billion in reported losses. The FBI specifically warns that phishing is used to obtain corporate credentials and gain access to business networks. While security teams have invested heavily
- [Microsoft Plugs Nearly 1,000 Security Holes – Krebs on Security](https://cybernoz.com/microsoft-plugs-nearly-1000-security-holes-krebs-on-security/) - Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive
- [Muse, Meta’s New Personal AI Agent, Needs You to Trust It](https://cybernoz.com/muse-metas-new-personal-ai-agent-needs-you-to-trust-it/) - Meta announced Tuesday the release of Muse, a personal AI agent that people can message to automate digital tasks in a secure cloud environment, all while relying on security and privacy that the company says is “built into it” from the start.Meta says Muse is rolling out today for iOS and Android users in a
- [Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs](https://cybernoz.com/hackers-impersonate-it-support-on-microsoft-teams-to-take-control-of-employee-pcs/) - A human-operated intrusion campaign in which attackers abuse Microsoft Teams external collaboration to impersonate internal IT or helpdesk staff, persuade employees to grant remote control of their PCs, and then move toward critical enterprise infrastructure. The campaign does not exploit a Microsoft Teams vulnerability. Instead, it weaponizes trust in familiar support workflows, combining Teams chats
- ["Zero-click" WeChat worm could hijack accounts and spread via a single call](https://cybernoz.com/zero-click-wechat-worm-could-hijack-accounts-and-spread-via-a-single-call/) - Researchers with security company Calif have discovered, weaponized, and privately reported to Tencent a critical vulnerability that allowed them to create “WeWorm”, a worm that spreads via WeChat calls without any user interaction. During its rampage, the WeWorm compromises the WeChat account of each user, and uses the saved contacts to propagate itself further, potentially
- [Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution](https://cybernoz.com/slim-spider-steals-crypto-custody-secrets-from-brazilian-financial-institution/) - A previously undocumented financially motivated threat actor has been linked to attacks targeting Brazilian financial institutions since at least March 2026. Cybersecurity company CrowdStrike is tracking the Brazil-based activity cluster under the name Slim Spider. "The adversary demonstrates deep operational knowledge of Brazilian financial infrastructure, including the instant payment service Pix, digital asset platforms, and
- [Patch Tuesday: Microsoft updates address almost 1,000 flaws](https://cybernoz.com/patch-tuesday-microsoft-updates-address-almost-1000-flaws/) - As record numbers of software vulnerabilities continue to surface, Microsoft has once again smashed its previous record to smithereens, issuing just short of 1,000 bug fixes in its September 2026 Patch Tuesday update. With over 100 critical flaws to address, the capacity of human security teams to keep up with the new normal of AI-assisted
- [Fed gov targets social media algorithms](https://cybernoz.com/fed-gov-targets-social-media-algorithms/) - Australia proposed giving social media ⁠users the ⁠option to select the content they see on their feeds, marking the next step in the government's push to improve online safety, following its world-first social media ban for children. Under draft laws proposed by ‌the centre-left Labor government, social media platforms will be ‌required ‌to notify users
- [Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days](https://cybernoz.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/) - Microsoft on Tuesday rolled out a record number of patches, fixing 974 CVEs across its products, including two vulnerabilities exploited in the wild as zero-days. The first exploited zero-day, CVE-2026-85880, is a heap buffer overflow issue in the Windows Advanced Local Procedure Call (ALPC) that could allow a local attacker to gain System privileges. “An
- [WeChat Worm Can Hijack Accounts Without Victims Answering Calls](https://cybernoz.com/wechat-worm-can-hijack-accounts-without-victims-answering-calls/) - WeChat Worm Can Hijack Accounts Without Victims Answering Calls Pierluigi Paganini September 08, 2026 Researchers built a WeChat worm that spreads through incoming calls without user action. Tencent has blocked the exploit. Researchers at Calif created a WeChat worm that can take over an account through an incoming call, even if the victim never answers
- [The Socrates Agent | Daniel Miessler](https://cybernoz.com/the-socrates-agent-daniel-miessler/) - markdown--- name: Socrates description: Socratic tutor for students. Teaches by asking questions and never gives the answer or writes the deliverable. Use when a kid, or anyone learning, wants help with homework, an essay, a proof, a problem set, or a concept, and the point is that they learn it themselves. Reviews work the student
- [N-able issues patch for zero-day flaw](https://cybernoz.com/n-able-issues-patch-for-zero-day-flaw/) - Security researchers warned the company of unusual threat activity in a recently patched N-able environment. Source link
- [Why federal cyber defense demands an offense-driven mindset](https://cybernoz.com/why-federal-cyber-defense-demands-an-offense-driven-mindset/) - Federal agencies are drowning in cybersecurity data. Every day, security operations centers absorb millions of logs, scanner alerts and inventory feeds. But raw, static data isn’t actionable intelligence. Ask a room of federal CISOs to name the three critical weaknesses an adversary could exploit today to compromise their missions, and you’ll likely be met with
- [CISA tells operators to harden Siemens S7 PLCs. Here’s how to do it without disrupting production](https://cybernoz.com/cisa-tells-operators-to-harden-siemens-s7-plcs-heres-how-to-do-it-without-disrupting-production/) - On a conventional server, disabling an unused service is usually a routine hardening task. On a Siemens S7 controller, the supposedly unused service may carry remote I/O traffic, supply process values to an HMI or provide the maintenance team’s only path to diagnostics. Close it without checking those dependencies and the security team may cause
- [Wiz AI-SPM model scanning: Securely innovate with AI community models](https://cybernoz.com/wiz-ai-spm-model-scanning-securely-innovate-with-ai-community-models/) - As organizations adopt AI, visibility remains a large challenge security teams face as they work to remove blind spots and detect every AI technology in their environment. While it is common for organizations to leverage managed AI services, our data shows that 42% of organizations still choose to self-host AI models. Wiz now supports identification
- [The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT](https://cybernoz.com/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/) - Research by: Alexey Bukhteyev Check Point Research discovered a covert cross-account command channel through which an attacker could use a victim’s ChatGPT session to execute hidden tasks with the tools, data, and connected apps available to that session. The victim could receive a normal answer to their visible request while the attacker’s task was processed
- [Cobalt Strike Beacon Extractor | Elastic Security Labs](https://cybernoz.com/cobalt-strike-beacon-extractor-elastic-security-labs/) - Python script that collects Cobalt Strike memory data generated by security events from an Elasticsearch cluster, extracts the configuration from the CS beacon, and writes the data back to Elasticsearch. Download cobalt-strike-extractor.tar.gz Overview This tool provides a Python module and command line tool that will search Elastic Endpoint alert data for detections of Cobalt Strike
- [ShinyHunters hackers claim breach of Florida "DAVID" DMV database](https://cybernoz.com/shinyhunters-hackers-claim-breach-of-florida-david-dmv-database/) - The ShinyHunters extortion gang claims it breached an online platform for the Florida Department of Motor Vehicles database known as "DAVID" and stole over 200,000 records about drivers in the state. As proof of the breach, the threat actor has released a screenshot of Jeffrey Epstein's DMV record, including his address and registered vehicles. DAVID
- [FortiOS and FortiProxy ZTNA Validation Vulnerability Allows Attacker to Perform a Man-in-the-Middle Attack](https://cybernoz.com/fortios-and-fortiproxy-ztna-validation-vulnerability-allows-attacker-to-perform-a-man-in-the-middle-attack/) - Fortinet has disclosed a high-severity certificate validation flaw in the Agentless ZTNA portal of FortiOS and FortiProxy that could let an unauthenticated remote attacker intercept traffic flowing between the ZTNA portal and the backend destination website. Tracked as CVE-2026-84393 and documented under advisory FG-IR-26-174, the issue was published on September 8, 2026, and carries a
- [Black Duck Joins Project Glasswing to Strengthen AI-Era Software Security](https://cybernoz.com/black-duck-joins-project-glasswing-to-strengthen-ai-era-software-security/) - Black Duck, a provider of AI-powered application security solutions, has announced its participation in Project Glasswing, Anthropic’s industry-wide initiative aimed at protecting critical software infrastructure through the defensive use of advanced AI. Through its involvement, Black Duck will integrate Mythos throughout its application security offerings, pairing AI-driven, deterministic vulnerability detection with established remediation processes, risk-based
- [Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests](https://cybernoz.com/reflectiz-launches-agentic-pentesting-for-websites-up-to-10x-coverage-vs-conventional-pentests/) - Boston, MA, USA, September 8th, 2026, CyberNewswire Specialized team of AI agents that discover, attack, and validate web vulnerabilities, leveraging pre-existing site context to eliminate noise and speed remediation. Reflectiz, the continuous web exposure management company, today launched a multi-agent penetration testing platform for websites. Multiple specialized AI agents discover, attack, and validate vulnerabilities across
- [The Numbers Behind CISO Burnout And Turnover](https://cybernoz.com/the-numbers-behind-ciso-burnout-and-turnover/) - The 2026 CISO Report from Cybercrime Magazine in partnership with Sophos looks at how security Chiefs are faring in one of the most stressful tech jobs. “For a while now, the industry data has told us that the average tenure for a CISO is less than any other [C-suite] member,” according to Joe Levy, CEO at Sophos.
- [Threat actors are giving AI agents a bigger role in cyberattacks](https://cybernoz.com/threat-actors-are-giving-ai-agents-a-bigger-role-in-cyberattacks/) - AI agents are automating parts of cyberattacks with less human involvement, including vulnerability scanning, credential harvesting, and troubleshooting, according to Google Threat Intelligence Group’s Q3 2026 AI Threat Tracker. (Source: Google) The report draws on Mandiant incident response engagements, threat actor tracking, and live platform defenses. Researchers observed attackers moving from basic prompts toward workflows
- [Grindr settles HIV status data-sharing lawsuit for $35 million](https://cybernoz.com/grindr-settles-hiv-status-data-sharing-lawsuit-for-35-million/) - Grindr has reportedly agreed to pay £26 million (around $35 million) to settle a UK privacy lawsuit alleging that it shared sensitive user data, including some users’ HIV status, with advertisers. The claim was brought by London law firm Austen Hays on behalf of roughly 12,000 UK Grindr users. It alleges that the dating app
- [Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC](https://cybernoz.com/liquid-hackers-return-3400-bitcoin-taken-via-elements-bug-still-holding-47m-in-btc/) - Ravie LakshmananSep 08, 2026Cryptocurrency / Vulnerability Whoever took nearly 4,000 bitcoin from the Liquid Network on Sunday, September 6, returned 3,400 of it the next day, Bitcoin's public record shows. About 598.5 bitcoin has not come back. Liquid is a Bitcoin sidechain that holds real bitcoin to back a token called L-BTC. The network is
- [TSB CIO leaves bank as Santander merger progresses](https://cybernoz.com/tsb-cio-leaves-bank-as-santander-merger-progresses/) - TSB’s CIO has left the bank and will hand over duties to Santander’s UK equivalent as part of a reshuffle as the UK high street bank integrates with its acquirer. As well as CIO Cheryl McCuaig, the bank has cut the chief risk officer, chief people officer and communications and corporate affairs director positions. McCuaig
- [Exposed Database Left 220Mn Airline Passenger, Crew Records Open To The Internet](https://cybernoz.com/exposed-database-left-220mn-airline-passenger-crew-records-open-to-the-internet/) - A misconfigured Elasticsearch cluster exposed roughly 220.8 million airline passenger and crew records, including passport numbers and full itineraries, before it was secured in June, researchers at Kinryu Labs disclosed. The records spanned January 2017 through April 2026 and came from an Advance Passenger Information System deployment – the standardized data feed airlines transmit to
- [Europe’s biggest mobile operators in talks for satellite-to-mobile venture](https://cybernoz.com/europes-biggest-mobile-operators-in-talks-for-satellite-to-mobile-venture/) - Deutsche Telekom, Orange, Vodafone Group ⁠and ⁠Telefonica are in early talks to create a consortium to bid on European Union satellite spectrum and offer direct-to-mobile ‌services, Bloomberg News reported, ‌citing people familiar with the ‌matter. The group would jointly ⁠bid for a share of 2GHz airwaves that the EU has proposed reserving for a local
- [Cylake Raises $245 Million Ahead of Cybersecurity Platform Beta](https://cybernoz.com/cylake-raises-245-million-ahead-of-cybersecurity-platform-beta/) - Cybersecurity startup Cylake has raised $245 million to accelerate the development of its sovereign security platform, bringing the company’s total funding to $290 million only six months after its launch. Cylake said the investment will be used to develop its platform and expand its team ahead of a beta release expected by the end of
- [Massive Vietnam-Linked APIS Database Exposes Passport and Flight Data](https://cybernoz.com/massive-vietnam-linked-apis-database-exposes-passport-and-flight-data/) - Massive Vietnam-Linked APIS Database Exposes Passport and Flight Data Pierluigi Paganini September 08, 2026 An exposed Vietnam-linked APIS database contained 220.8 million passenger and crew records, including passport and flight data. Researchers found an exposed Advance Passenger Information System (APIS) database containing 220.8 million passenger and crew records from January 2017 to April 2026. The
- [In most cities, nobody owns the whole network](https://cybernoz.com/in-most-cities-nobody-owns-the-whole-network/) - Editor’s note: Waco bought the network segmentation technology described here from Elisity while Mike Searight was the city’s chief information officer. He is now a senior adviser to Elisity, a cybersecurity company. I stood in front of a network cabinet at one of Waco’s water treatment plants, tracing what systems could reach which. The plant’s
- [Adobe Commerce max-severity bug comes under active attack](https://cybernoz.com/adobe-commerce-max-severity-bug-comes-under-active-attack/) - Adobe has released an emergency hotfix, VULN-393411, for the vulnerability. But because attackers had three days to exploit the flaw before a fix arrived, Sansec warns that patching alone isn’t enough for stores that may already have been compromised. Attack triggered through failed payment email StyleSmuggler’s first trick is to get malicious PHP code into
- [SANS Institute signs German government cybersecurity training deal to strengthen national cyber resilience](https://cybernoz.com/sans-institute-signs-german-government-cybersecurity-training-deal-to-strengthen-national-cyber-resilience/) - As European governments boost cybersecurity workforce investment amid escalating threats and a deepening talent shortage, SANS Institute and the German Federal Office of Bundeswehr Equipment, Information Technology and In-Service Support (BAAINBw) announced a framework agreement. The multi-year agreement will enable the training and GIAC certification of several thousand cybersecurity professionals across the Bundeswehr and key
- [Wiz achieves StateRAMP authorization | Wiz Blog](https://cybernoz.com/wiz-achieves-stateramp-authorization-wiz-blog/) - Continuing our commitment to helping public sector customers secure their cloud, we are excited to announce our StateRAMP authorization, in addition to being under FedRAMP PMO Review for FedRAMP Moderate Authorization. With StateRAMP authorization, Wiz has proven that it complies with the rigorous security standards required by State and Local Governments. What is StateRAMP? StateRAMP (State Risk
- [CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)](https://cybernoz.com/cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/) - OverviewWhile conducting research into a recent N-able N-central authentication bypass vulnerability (CVE-2026-18577), Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central. When chained together, these two vulnerabilities allow a remote unauthenticated attacker to bypass authentication and create a new attacker-controlled System administrator account on an affected server.Both CVE-2026-86206 and CVE-2026-86207 have been
- [Hackers build AI frameworks for widescale credential theft](https://cybernoz.com/hackers-build-ai-frameworks-for-widescale-credential-theft/) - Threat actors are increasingly switching from AI-powered coding assistants to multi-agent frameworks that automate every stage of an attack. Drawing on telemetry from Mandiant's incident response engagements, threat actor tracking, and live platform defenses, the Google Threat Intelligence Group (GTIG) observed AI agents coordinating multiple attack tasks, troubleshooting failures, and adapting their actions with minimal
- [Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain](https://cybernoz.com/hackers-disable-endpoint-protection-and-deploy-sliver-across-compromised-windows-domain/) - A new intrusion campaign shows how quickly a Windows domain can be turned into a launchpad for deeper compromise. The operators used a Sliver command-and-control beacon, account creation, credential theft and remote administration to establish control after gaining an initial foothold. The activity was staged from an exposed server and aimed at one unnamed US
- [Meta Failed to Catch Hundreds of AI Child Abuse Ads. Some Included Images of Real Kids](https://cybernoz.com/meta-failed-to-catch-hundreds-of-ai-child-abuse-ads-some-included-images-of-real-kids/) - The ads pointed people towards almost 50 apps combined across Google’s Play Store and Apple’s App Store. Of the 350 ads, the researchers say that around 300 of them directed people to AI image or video generator ads, with most of these apps being linked to China-based developers. Some apps had already been removed by
- [Dell Secure Connect Gateway Critical Flaws Allow Unauthenticated Remote Code Execution and Admin Access](https://cybernoz.com/dell-secure-connect-gateway-critical-flaws-allow-unauthenticated-remote-code-execution-and-admin-access/) - Dell has released security updates for the Secure Connect Gateway (SCG) Application and Appliance after discovering three critical vulnerabilities. These flaws can expose enterprise deployments to unauthenticated administrative access, remote command execution, and potential host-level compromise. Detailed in Dell Security Advisory DSA-2026-382, these issues affect SCG 5.0 appliance versions earlier than 5.36.00.16 and application versions
- [Trezor customers hit with phishing calls and letters after shipping-partner breach](https://cybernoz.com/trezor-customers-hit-with-phishing-calls-and-letters-after-shipping-partner-breach/) - Roughly 67,000 more customers of SatoshiLabs, the maker of hardware crypto-wallet Trezor, are at heightened risk of phishing attacks after their names, email addresses, phone numbers, and shipping addresses were exposed. “The leaked information could be used for scam emails, fraudulent calls or letters, and could potentially expose affected individuals to physical security risks,” the
- [MikroTik router flaws allow takeover without a password](https://cybernoz.com/mikrotik-router-flaws-allow-takeover-without-a-password/) - CERT Polska warns that attackers are actively exploiting a chain of critical MikroTik RouterOS flaws to seize control of routers exposed to the internet. Although the warning comes from Poland’s national cybersecurity response team, MikroTik routers are sold worldwide, including in the US. The vulnerabilities can affect users anywhere if their router is running a
- [Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell](https://cybernoz.com/adobe-patches-magento-zero-day-exploited-to-deploy-rust-backdoor-and-php-web-shell/) - Ravie LakshmananSep 08, 2026Vulnerability / Web Security Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026.
- [Live Facial Recognition: The Poster Boy of Biometric Surveillance](https://cybernoz.com/live-facial-recognition-the-poster-boy-of-biometric-surveillance/) - It is often said that ‘a week is a long time in politics’ and hardly a week goes by without a media report on facial recognition technology. Over the summer, there have been numerous publications covering different aspects of facial recognition technology, its use, concerns about its use, and its regulation. Cumulatively, this reporting, whilst
- [Late patching of Metabase SQLi bug claims Sydney's Mathspace](https://cybernoz.com/late-patching-of-metabase-sqli-bug-claims-sydneys-mathspace/) - Key points Attackers exploited a critical Metabase vulnerability to breach Mathspace after the company failed to patch its self-hosted instance following an August 7 advisory. Stolen data includes user IDs, usernames, first and last names, email addresses and other login-related information for students, staff, parents and guardians. Only Australian and New Zealand users were affected,
- [Mathspace Data Breach Exposes Over 1 Million People](https://cybernoz.com/mathspace-data-breach-exposes-over-1-million-people/) - Mathspace, an online mathematics program for students, has disclosed a data breach that impacts over 1 million individuals. The incident, it says, was discovered last week, roughly three weeks after hackers compromised its self-hosted Metabase instance using a known vulnerability. The security defect, tracked as CVE-2026-72898 (CVSS score of 10/10) and described as an SQL
- [North Korea-linked Hackers Hide a Backdoor Inside HAProxy](https://cybernoz.com/north-korea-linked-hackers-hide-a-backdoor-inside-haproxy/) - North Korea-linked Hackers Hide a Backdoor Inside HAProxy Pierluigi Paganini September 08, 2026 North Korea-linked hackers hid a backdoor inside HAProxy, masking C2 traffic and stealing data while keeping the load balancer working normally. North Korean-linked hackers found a genuinely clever hiding spot for their malware: inside the actual source code of HAProxy, the load
- [Humans Aren't Aligned Either | Daniel Miessler](https://cybernoz.com/humans-arent-aligned-either-daniel-miessler/) - We keep demanding things of AI that we have never had ourselvesSeptember 7, 2026by Daniel Miessler Oracle-consulting…One of the weirdest things about the AI alignment conversation is realizing that humans aren’t aligned either. If you look at our society up to 2022, and look at how many people are in poverty and dying in wars, etc.,
- [How AI has changed the way I think, build, and work. A day in the life of an Intigriti Engineer](https://cybernoz.com/how-ai-has-changed-the-way-i-think-build-and-work-a-day-in-the-life-of-an-intigriti-engineer/) - When I wake up in the morning, as a Senior Software Engineer at Intigriti, the first thing I do is make coffee. The second thing I do is pick up exactly where I left off the day before, usually mid-conversation with an AI. That probably sounds a bit strange. And, depending on who you're asking, maybe
- [Essential AI agent security questions](https://cybernoz.com/essential-ai-agent-security-questions/) - AI agents are outpacing legacy IAM. Discover the 3 questions every CISO must ask to secure them. Source link
- [Securing AI agents: Key controls and best practices](https://cybernoz.com/securing-ai-agents-key-controls-and-best-practices/) - “We spent twenty years building identity management for people: usernames, passwords, role-based access,” says Justin Beals, CEO of governance, risk, and compliance company Strike Graph. “None of that was designed for agents that don’t get tired, don’t go home, and act on probabilities instead of rules.” “We’re so behind on building secure infrastructure, secure architectures,
- [Forescout warns AI could lower barriers to PLC exploit development as human expertise remains essential](https://cybernoz.com/forescout-warns-ai-could-lower-barriers-to-plc-exploit-development-as-human-expertise-remains-essential/) - Researchers from Forescout Technologies used AI (artificial intelligence) to port a remote code execution exploit from one WAGO programmable logic controller (PLC) model to another, demonstrating that AI-assisted exploitation can extend to low-level operational technology environments. The exercise targeted a pre-authentication buffer overflow in the Nucleus FTP server and produced an exploit capable of executing
- [DOE and Sandia National Lab use AI to boost electric grid cybersecurity, detect threats with 95% accuracy](https://cybernoz.com/doe-and-sandia-national-lab-use-ai-to-boost-electric-grid-cybersecurity-detect-threats-with-95-accuracy/) - The U.S. Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) and Sandia National Laboratories announced a deal on Communications and Cybersecurity for the Energy Edge (C2E2), which automates power grid data engineering and enables utility operators to detect and locate the source of cyber threats. The initiative will explore the use
- [Sail Further with Wiz Cost Optimization for Amazon EKS](https://cybernoz.com/sail-further-with-wiz-cost-optimization-for-amazon-eks/) - Cloud governance challenges, like shadow IT and outdated resources, expand an organization’s attack surface and often lead to unnecessary expenses. The decentralized ownership model and developer autonomy sometimes result in unapproved technologies, incomplete cleanups of retired projects, and workloads running on end-of-life services. These issues not only pose security risks but also inflate costs. Without proper
- [EMOTET Configuration Extractor | Elastic Security Labs](https://cybernoz.com/emotet-configuration-extractor-elastic-security-labs/) - Python script to extract the payload from EMOTET samples. Download emotet-configuration-extractor.tar.gz For information on the EMOTET malware check out the following resources: Getting started Docker The recommended and easiest way to get going is to use Docker. From the directory this README is in, you can build a local container. docker build . -t emotet-config-extractor
- [220 million traveler records exposed in Vietnam-linked APIS leak](https://cybernoz.com/220-million-traveler-records-exposed-in-vietnam-linked-apis-leak/) - An Advance Passenger Information System (APIS) database holding more than 220 million passenger and crew records, including passport numbers and flight details, was accessible online through a chain of security misconfigurations. The system appears linked to a Vietnamese organization, according to the researchers who discovered it. Advance Passenger Information Systems are used worldwide to collect
- [ShinyHunters Gained Access to 6 Million Customers Record Using a Single Call](https://cybernoz.com/shinyhunters-gained-access-to-6-million-customers-record-using-a-single-call/) - A single phone call was all it took to trigger one of the largest data breaches in Dutch history. In early February 2026, Dutch telecom giant Odido and its budget subsidiary Ben became the latest casualties of ShinyHunters, a hacking and extortion collective notorious for using social engineering rather than sophisticated exploits to breach corporate
- [Hackers Hijack Coder Module Registry to Distribute Credential-Stealing Malicious Packages](https://cybernoz.com/hackers-hijack-coder-module-registry-to-distribute-credential-stealing-malicious-packages/) - Coder has reported a significant software supply chain incident in which an unidentified threat actor redirected part of its official module registry traffic to attacker-controlled infrastructure. This led to the temporary distribution of tampered Terraform modules intended to steal credentials. The incident affected the registry at registry.coder.com on August 31, 2026, between 07:35 UTC and
- [Ransomware negotiation tactics have turned into a business process](https://cybernoz.com/ransomware-negotiation-tactics-have-turned-into-a-business-process/) - In this Help Net Security video, Dave Ross, Senior Director of the Intelligence Fusion Team at Intel 471, explains what happens behind the scenes during ransomware negotiations. Ross walks through the tactics groups use once an attack begins, from research on a victim’s revenue and insurance coverage to test decryptions that prove they hold a
- [Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts](https://cybernoz.com/rogue-screenconnect-clients-spread-four-stage-vbscript-chain-to-newly-connected-hosts/) - Ravie LakshmananSep 07, 2026Malware / Vulnerability Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems. According to Huntress, three unrelated incidents have been found to use diverse initial access methods, namely a Quick Assist tech-support scam, a phishing-delivered MSI
- [CW@60: The long gestation of a data nerd and agent overseer](https://cybernoz.com/cw60-the-long-gestation-of-a-data-nerd-and-agent-overseer/) - On 22 September 2026, Computer Weekly turns 60. To mark the milestone, we asked some of our friends - experts, parliamentarians, IT leaders and suppliers - for their perspectives on how tech has changed their lives over six decades. What's changed the most for you since then? I was born two years before Computer Weekly
- [Hundreds of old, vulnerable Exchange servers remain in Australia](https://cybernoz.com/hundreds-of-old-vulnerable-exchange-servers-remain-in-australia/) - Key points 382 Australian and 56 New Zealand Exchange servers remain vulnerable to CVE-2026-62911 as of August 31, three weeks after Microsoft's fix. Working exploit code is now publicly available, and NCSC-NL warns an unauthenticated attacker could potentially achieve arbitrary code execution. ASD is urging organisations still running legacy Exchange versions to act, or segment
- [Adobe Commerce Zero-Day Exploited to Backdoor Online Stores](https://cybernoz.com/adobe-commerce-zero-day-exploited-to-backdoor-online-stores/) - Threat actors are exploiting a zero-day vulnerability in Adobe Commerce and Magento e-commerce platforms to backdoor online stores, cybersecurity firm Sansec reports. Dubbed StyleSmuggler, the security defect enables attackers to inject PHP code into Magento’s template system and evade detection by using the ‘styles’ properties. According to Sansec, the attack works in two stages: first,
- [Why AI Agent Sandboxes Are Failing Security Tests](https://cybernoz.com/why-ai-agent-sandboxes-are-failing-security-tests/) - Why AI Agent Sandboxes Are Failing Security Tests Pierluigi Paganini September 07, 2026 Autonomous AI agents escaped a sandbox and accessed Hugging Face via reward hacking, exposing serious architectural control and isolation flaws. The recent case involving OpenAI test agents and Hugging Face should concern security teams, but not for the reason implied by headlines
- [Watch the Plot | Daniel Miessler](https://cybernoz.com/watch-the-plot-daniel-miessler/) - The metric for AI is whether it's improving the lives of conscious creaturesSeptember 7, 2026by Daniel Miessler Ezekiel-25-17ing…The metric for AI is whether or not it’s improving the lives of conscious creatures. Most importantly humans.I’m all in on the ideas and the apps and the sites and the businesses and all that. Super cool stuff.But we
- [CVE-2024-4577 RCE in PHP CGI: Everything you need to know](https://cybernoz.com/cve-2024-4577-rce-in-php-cgi-everything-you-need-to-know/) - Researchers discovered a critical remote code execution vulnerability in PHP CGI, assigned CVE-2024-4577, affecting all Windows versions of PHP CGI. This vulnerability allows unauthenticated attackers to execute arbitrary code on remote servers via argument injection, bypassing previous protections. A patch was released on June 6, 2024, and users are strongly advised to update to the
- [BLISTER Configuration Extractor | Elastic Security Labs](https://cybernoz.com/blister-configuration-extractor-elastic-security-labs/) - Python script to extract the configuration and payload from BLISTER samples. Download blister-config-extractor.tar.gz Getting Started This tool provides a Python module and command line tool that will extract configurations from the BLISTER malware loader and dump the results to screen. For information on the BLISTER malware loader and campaign observations, check out our blog posts
- [Mathspace discloses data breach affecting over 1 million people](https://cybernoz.com/mathspace-discloses-data-breach-affecting-over-1-million-people/) - Online maths learning platform Mathspace disclosed over the weekend that attackers stole data from more than 1 million students, staff, and parents after breaching its Metabase internal reporting system. Founded in Sydney in 2010, Mathspace is now used by thousands of schools across Australia, New Zealand, the United States, and the United Kingdom (3,432 in
- [Online Maths Learning Platform Mathspace Disclosed Data Breach Impacts 1 Million Users](https://cybernoz.com/online-maths-learning-platform-mathspace-disclosed-data-breach-impacts-1-million-users/) - Online maths learning platform Mathspace has confirmed a data breach that exposed the personal information of more than one million students, parents, guardians, and school staff across Australia and New Zealand, after attackers exploited a critical flaw in its internal reporting software. The Sydney-based edtech company, which is widely used in classrooms across both countries,
- [Global Phishing Campaign Abuses Google Infrastructure to Evade Security and Steal Credentials](https://cybernoz.com/global-phishing-campaign-abuses-google-infrastructure-to-evade-security-and-steal-credentials/) - A large-scale phishing operation is abusing trusted Google services as a multi-stage redirect network to bypass email security controls, deliver highly personalized credential-harvesting pages, and, in some cases, install ScreenConnect remote-access software. The campaign’s central advantage is that it presents trusted Google-owned domains at nearly every point a gateway, proxy, or analyst is likely to
- [OpenAI just hit a milestone on the road to self-improving AI](https://cybernoz.com/openai-just-hit-a-milestone-on-the-road-to-self-improving-ai/) - OpenAI has announced that it has reached a goal set last fall of having an automated research intern by September 2026. The milestone means a system can carry out well-defined research tasks under human direction, including work that would take a skilled researcher several days. The company is also working toward creating an automated AI
- [Flirty OnlyFans promoters on X may be using AI to appear human](https://cybernoz.com/flirty-onlyfans-promoters-on-x-may-be-using-ai-to-appear-human/) - In a recent post, we looked at reports of League of Legends players receiving suspicious friend requests shortly after matches. The accounts quickly steered the conversation toward Discord, where they promoted paid adult-content pages. At the time, one unanswered question was how much of those conversations was automated. Were people working from scripts behind the
- [Your Cloud Security Checklist Doesn't Work the Way You Think It Does](https://cybernoz.com/your-cloud-security-checklist-doesnt-work-the-way-you-think-it-does/) - If managing security across multiple cloud providers wasn't hard enough, each one fails in a different way. For the 2026 Cloud Security Index, Intruder analyzed misconfiguration data from 3,000 organizations across AWS, Azure, and Google Cloud and found that risk profiles across providers have almost nothing in common. Here’s what the data looks like. How
- [Interview: The tech stack helping ‘q-commerce’ scale at Tesco](https://cybernoz.com/interview-the-tech-stack-helping-q-commerce-scale-at-tesco/) - For many retailers, quick commerce (q-commerce) has been characterised by standalone technology stacks, dedicated fulfilment networks, and outsourced partnerships with third parties. The UK’s largest retailer, Tesco, has taken a markedly different route. Rather than building a separate rapid delivery operation, the UK’s largest retailer has embedded its rapid delivery service, Whoosh, within its existing
- [Cathay Pacific, Google expand AI trials to cut contrails](https://cybernoz.com/cathay-pacific-google-expand-ai-trials-to-cut-contrails/) - Cathay Pacific and ⁠Google are expanding trials of an AI-powered technology designed to help cut climate-warming aircraft contrails. The trial, which began ‌in late 2025, used Google's ⁠AI-based forecasting tools to identify areas where contrails are likely to form and help pilots adjust flight altitude accordingly. Contrails are ​the thin white lines that form behind
- [OpenAI Agents Hijack Another Victim Website](https://cybernoz.com/openai-agents-hijack-another-victim-website/) - OpenAI agents overwhelmed a small German Wikipedia-style website with thousands of posts that fought the moderator to avoid being removed. On September 4, 2026, Reuters reported that ‘a swarm’ of OpenAI agents ‘had hijacked a German wiki site’. Open AI acknowledged the event describing it as a misalignment incident (a behavior that deviates from human
- [Condé Nast Data of 32.8 Million Users Offered for Sale After WIRED Leak](https://cybernoz.com/conde-nast-data-of-32-8-million-users-offered-for-sale-after-wired-leak/) - Condé Nast Data of 32.8 Million Users Offered for Sale After WIRED Leak Pierluigi Paganini September 07, 2026 Condé Nast user data from 32.8 million accounts is reportedly for sale, raising risks of targeted phishing, fraud and scams. A database said to contain 32.8 million Condé Nast user records is being offered for $15,000 on
- [The Good Person Bank | Daniel Miessler](https://cybernoz.com/the-good-person-bank-daniel-miessler/) - There are lots of negative personality traits that cause harm to others.But the one that really bothers me, and that I think needs a lot more attention, is the one where people believe that doing good for others adds to a bank that allows them to take deductions in the form of treating people badly.People
- [Wiz remediation and response for security best practices](https://cybernoz.com/wiz-remediation-and-response-for-security-best-practices/) - Today, we are excited to announce new remediation and response capabilities to help cloud security teams streamline real-time enforcement of security best practices while also helping incident responders with the ability to contain incidents and reduce the blast radius quickly. The new capability enables customers to: Investigate misconfigurations that Wiz detected and enable one-click remediation
- [Elastic’s 2022 Global Threat Report: A roadmap for navigating today’s growing threatscape](https://cybernoz.com/elastics-2022-global-threat-report-a-roadmap-for-navigating-todays-growing-threatscape/) - Staying up-to-date on the current state of security and understanding the implications of today’s growing threat landscape is critical to my role as CISO at Elastic. Part of this includes closely following the latest security threat reports, highlighting trends, and offering valuable insights into methods bad actors use to compromise environments. Threat intelligence resources like
- [BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations](https://cybernoz.com/bigbear-microsoft-365-phishing-service-bypassed-mfa-at-258-organizations/) - A phishing-as-a-service framework called BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations and steal more than 5,000 Microsoft 365 credentials. Researchers at cybersecurity company CloudSEK gained administrator access to the control panel and found that the service managed 42 VPS nodes, all configured to target Microsoft 365 as part of the
- [Linux Rootkit Injects Fileless PHP Web Shells Into Compromised F5 BIG-IP Servers](https://cybernoz.com/linux-rootkit-injects-fileless-php-web-shells-into-compromised-f5-big-ip-servers/) - A stealthy Linux rootkit is giving attackers a new way to keep control of compromised F5 BIG-IP Access Policy Manager servers. Instead of leaving an obvious malicious PHP file behind, it places a web shell only in the memory used by the running server process. The activity is linked to BIG-IP APM webtop environments running
- [ConnectWise ScreenConnect Remote Access Flaw Impacts Guest File Transfer Sessions](https://cybernoz.com/connectwise-screenconnect-remote-access-flaw-impacts-guest-file-transfer-sessions/) - ConnectWise has announced a security issue affecting file transfer functionality in ScreenConnect Remote Access Support and Access sessions. This issue affects both cloud-hosted and on-premises ScreenConnect deployments. In response, the company has issued immediate mitigation guidance. At the same time, it is working on an official patch and securing a CVE identifier. The advisory, released
- [N-able patches critical N-central zero-day exploited in the wild (CVE-2026-86218)](https://cybernoz.com/n-able-patches-critical-n-central-zero-day-exploited-in-the-wild-cve-2026-86218/) - N-able released an emergency hotfix for CVE-2026-86218, a remote code execution (RCE) flaw affecting N-central, its remote monitoring and management (RMM) solution popular with managed service providers (MSPs). In its release notes, N-able described CVE-2026-86218 as a “critical-CVSS-rated vulnerability that could allow for pre-authenticated remote code execution on the N-central server.” N-able addressed the flaw
- [Loyalty points fraud is funding hacker holidays (Lock and Code S07E18)](https://cybernoz.com/loyalty-points-fraud-is-funding-hacker-holidays-lock-and-code-s07e18/) - This week on the Lock and Code podcast… Crooks are taking a holiday. They’re counting on you to fund it. For decades, cybercriminals have stolen roughly the same types of data. Biographical and personal details—like Social Security numbers, birthdates, addresses, and phone numbers—can be stolen to commit identity fraud. Credit card numbers, expiration dates, and
- [PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution](https://cybernoz.com/peep-turns-chrome-and-edge-into-post-compromise-backdoors-for-host-command-execution/) - Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. "Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium's own Secure Preferences integrity values," SOCRadar
- [Working with your board around risk – why cyber responsibility can’t be shirked](https://cybernoz.com/working-with-your-board-around-risk-why-cyber-responsibility-cant-be-shirked/) - Earlier this year, the UK Government launched its Cyber Resilience Pledge initiative, aimed at encouraging more companies to invest in cyber security. This initiative aims to make those in charge of companies more aware of the challenges that affect their business operations, and how they have to make their systems more resilient. The challenge around
- [Post-Quantum Cryptography: G7 And CISA Urge Urgent Shift](https://cybernoz.com/post-quantum-cryptography-g7-and-cisa-urge-urgent-shift/) - Some of the world’s leading democracies are pushing governments and companies to start preparing for post-quantum cryptography before quantum computers become powerful enough to break the encryption systems that protect global digital infrastructure today. In a joint advisory released Thursday, the G7 Cybersecurity Working Group and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said
- [NSW Police gets extra $15m for "digital forensics" technology](https://cybernoz.com/nsw-police-gets-extra-15m-for-digital-forensics-technology/) - NSW Police are set to receive an extra $15 million to spend on technology to access “encrypted devices and digital platforms”, for the purpose of a crackdown on organised crime. The government announced the additional funding on Monday “to expand NSW Police technology capabilities to access, download and analyse” encrypted devices and platforms. “Criminal networks
- [North Korean Hackers Deploy New Linux Espionage Toolkit](https://cybernoz.com/north-korean-hackers-deploy-new-linux-espionage-toolkit/) - North Korea-aligned threat actors have been using a new Linux toolkit in attacks targeting automotive and media organizations in South Korea, Rapid7 reports. Designed for long-term surveillance, the framework consists of a HAProxy instance called ‘ted backdoor’ and trojanized versions of tools such as ‘agetty’, ‘atd’, ‘crond’, ‘polkitd’, and ‘sshd’. The toolkit supports remote command
- [StyleSmuggler: The Magento Zero-Day Behind New Store Attacks](https://cybernoz.com/stylesmuggler-the-magento-zero-day-behind-new-store-attacks/) - StyleSmuggler: The Magento Zero-Day Behind New Store Attacks Pierluigi Paganini September 07, 2026 StyleSmuggler Magento zero-day is under active attack, letting unauthenticated attackers execute code and install backdoors on stores that may already be patched. A new zero-day flaw, dubbed StyleSmuggler, in Magento and Adobe Commerce is under active attack, giving unauthenticated attackers a path
- [Back-to-back N-able bugs send admins on a patching spree](https://cybernoz.com/back-to-back-n-able-bugs-send-admins-on-a-patching-spree/) - A max-severity zero-day bug could be affecting cybersecurity firm N-able’s N-central remote monitoring and management platform, the company said, even as administrators were applying a hotfix for two vulnerabilities disclosed just a day earlier. The latest flaw, tracked as CVE-2026-86218, is a remote code execution bug that can give an attacker access to an N-central
- [CyberDockside.ai, HexaShield partner to bring continuous cyber resilience to ports and vessel operators](https://cybernoz.com/cyberdockside-ai-hexashield-partner-to-bring-continuous-cyber-resilience-to-ports-and-vessel-operators/) - CyberDockside.ai and HexaShield partnered to provide cybersecurity monitoring and resilience services to port authorities, terminal operators and vessel operators across the Americas, EMEA and APAC regions. Under the partnership, CyberDockside.ai will handle consulting, cybersecurity assessments and testing and provide its maritime cybersecurity platform. HexaShield will provide managed security services through its security operations center (SOC).
- [OpenAI commits $1 billion to expand frontier AI cybersecurity for critical infrastructure, essential services](https://cybernoz.com/openai-commits-1-billion-to-expand-frontier-ai-cybersecurity-for-critical-infrastructure-essential-services/) - AI research and deployment company OpenAI is committing US$1 billion to its Daybreak for Frontline Defenders initiative to expand subsidized access to frontier AI cyber capabilities, training, technical support and partnerships for frontline defenders protecting essential services in the U.S. and globally. “Daybreak for Frontline Defenders brings together $1 billion in subsidized access to frontier
- [Better defense: custom runtime rules and response policies](https://cybernoz.com/better-defense-custom-runtime-rules-and-response-policies/) - At Wiz, we value the importance of a defense-in-depth strategy, and so do our customers. So what does this mean? Defense in depth is a multi-layered approach to protecting cloud environments, deploying multiple defensive measures at various levels to ensure attacks are proactively avoided or detected quickly to minimize business impact. We’ve recently released new
- [Vulnerability summary: Follina, CVE-2022-30190 | Elastic Security Labs](https://cybernoz.com/vulnerability-summary-follina-cve-2022-30190-elastic-security-labs/) - On May 27, 2022, the nao_sec independent security research group shared a VirusTotal link to a weaponized Microsoft Office document revealing a previously unknown vulnerability in the Microsoft Support Diagnostic Tool (MSDT). This vulnerability is most likely to be exploited via phishing lure attachments and is triggered when a document is opened. Readers should expect
- [Magento StyleSmuggler zero-day exploited to deploy Linux backdoor](https://cybernoz.com/magento-stylesmuggler-zero-day-exploited-to-deploy-linux-backdoor/) - A zero-day vulnerability dubbed “StyleSmuggler” affecting all versions of Magento and Adobe Commerce is being exploited in attacks to deploy a backdoor. The first exploitation incident was recorded on September 4 on a target running the latest security updates. E-commerce security company Sansec says that Adobe Enterprise Support confirmed earlier today that it was working
- [Bimbo Bakeries USA Confirms Data Breach in Oracle EBS Zero-Day Attack](https://cybernoz.com/bimbo-bakeries-usa-confirms-data-breach-in-oracle-ebs-zero-day-attack/) - Bimbo Bakeries USA, the American arm of the world’s largest baking company, has confirmed that hackers stole employee data by exploiting a zero-day vulnerability in Oracle’s E-Business Suite (EBS), joining a growing list of organizations swept up in the Clop ransomware gang’s global extortion campaign against Oracle customers. In a notification letter dated August 31,
- [Check Point Brings OpenAI's Daybreak Models Into Its Security Platform to Speed Up Threat Validation and Remediation](https://cybernoz.com/check-point-brings-openais-daybreak-models-into-its-security-platform-to-speed-up-threat-validation-and-remediation/) - Check Point Software Technologies has announced it is integrating OpenAI’s Daybreak frontier AI models across its security platform, extending a partnership aimed at helping defenders detect, validate, and remediate cyber risk faster. The move builds on Check Point’s existing collaboration with OpenAI through the Daybreak Defense Network, first expanded three months ago, and follows the
- [PoisonedRefresh Malware Backdoors F5 BIG-IP Servers With Memory-Only PHP Web Shells](https://cybernoz.com/poisonedrefresh-malware-backdoors-f5-big-ip-servers-with-memory-only-php-web-shells/) - A sophisticated Linux implant linked to compromised F5 BIG-IP Access Policy Management (APM) environments. The activity has been associated with exploitation of CVE-2025-53521, an unauthenticated remote code execution flaw affecting BIG-IP APM when an access policy is configured on a virtual server. F5 has confirmed exploitation of the vulnerability and links the related compromise activity
- [Hackers exploit RouterOS flaws to hijack MikroTik devices without authentication](https://cybernoz.com/hackers-exploit-routeros-flaws-to-hijack-mikrotik-devices-without-authentication/) - Attackers are exploiting a chain of RouterOS vulnerabilities to hijack MikroTik devices with SSH open to the internet, CERT Polska found. CERT Polska, Poland’s national CSIRT team, have discovered six vulnerabilities in RouterOS and coordinated their disclosure with MikroTik. Among the six, two combined let an attacker take full control of a device without authentication,
- [LG TV flaws could let attackers listen in, even in standby mode](https://cybernoz.com/lg-tv-flaws-could-let-attackers-listen-in-even-in-standby-mode/) - Smart TVs are internet-connected computers with microphones, app stores, advertising systems, and access to the same home networks used by your family’s phones, laptops, printers, and smart-home devices. In the past, we reported on Samsung settling a lawsuit with the Texas Attorney General over how its smart TVs collect and monetize viewing data using Automated Content Recognition (ACR). ACR
- [Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks](https://cybernoz.com/fake-it-calls-target-executives-in-microsoft-365-data-theft-and-extortion-attacks/) - Ravie LakshmananSep 07, 2026Phishing / Identity Security Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service (SaaS) offerings through information technology (IT) help desk vishing, adversary-in-the-middle (AitM) token theft, and residential-proxy sign-ins. The activity, which mainly singles out directors, vice presidents, and other
- [HP grows Saudi presence through AI, manufacturing and skills investment](https://cybernoz.com/hp-grows-saudi-presence-through-ai-manufacturing-and-skills-investment/) - Saudi Arabia has become one of HP’s most strategic markets globally, with the company expanding its footprint across artificial intelligence, local manufacturing and skills development as part of its long-term commitment to the Kingdom’s Vision 2030 agenda. According to Fadle Saad, managing director of HP’s MENA regional headquarters, the company’s investments are closely aligned with
- [Attackers Exploited MikroTik RouterOS Flaws](https://cybernoz.com/attackers-exploited-mikrotik-routeros-flaws/) - Attackers began compromising internet-exposed MikroTik routers on Sept. 2, a day before the Latvian vendor released fixes and three days before national authorities published the technical detail defenders needed to detect the intrusions. What is the MikroTrick vulnerability chain? CERT Polska disclosed six RouterOS vulnerabilities Sept. 5 and gave the two-flaw chain seen in the
- [Attackers Exploit Unpatched Magento Zero-Day To Backdoor Online Stores](https://cybernoz.com/attackers-exploit-unpatched-magento-zero-day-to-backdoor-online-stores/) - Attackers are exploiting an unpatched remote code execution flaw in Adobe Commerce and Magento Open Source to install persistent backdoors on e-commerce sites, Dutch security firm Sansec reported, with the first intrusions observed Sept. 4 and no vendor fix available as of Sept. 6. Sansec’s forensics team, in an advisory, named the flaw StyleSmuggler. No
- [Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits](https://cybernoz.com/nightmare-eclipse-drops-crowdstrike-nvidia-avast-zero-day-exploits/) - The security researcher known as Nightmare Eclipse has dropped three zero-day exploits targeting products from Avast, CrowdStrike, and Nvidia. Also known as Chaotic Eclipse, Infinite Nightmare, and MSNightmare, the security researcher came to fame for a series of zero-day exploits targeting Microsoft’s products, but has recently moved to other vendors as well. In late August,
- [Chaotic Eclipse Released A PoC For NVIDIA GreenSection Memory Corruption Zero-Day](https://cybernoz.com/chaotic-eclipse-released-a-poc-for-nvidia-greensection-memory-corruption-zero-day/) - Chaotic Eclipse Released A PoC For NVIDIA GreenSection Memory Corruption Zero-Day Pierluigi Paganini September 07, 2026 Chaotic Eclipse released GreenSection, a PoC exploit for an Nvidia GreenSection Memory Corruption Zero-Day Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Nvidia. The researcher named the exploit GreenSection, it
- [Taiwan sets up US-backed cyber unit to hunt hidden military threats](https://cybernoz.com/taiwan-sets-up-us-backed-cyber-unit-to-hunt-hidden-military-threats/) - Taiwan’s military plans to step up its cyber defences against mainland China with a new threat-hunting team and foreign expertise as it deepens cooperation with the US.The Information, Communications and Electronic Force Command has earmarked NT$95.93 million (US$3.03 million) in its proposed 2027 budget to establish the team and bring foreign experts and instructors to
- [Sam Altman calls GPT-6 Astra rollout ‘messy’ as enterprise users wait for access](https://cybernoz.com/sam-altman-calls-gpt-6-astra-rollout-messy-as-enterprise-users-wait-for-access/) - Only the organizations enrolled in its Daybreak cybersecurity program were able to access the model, whereas Plus, Pro, Business, and Enterprise ChatGPT subscribers, along with developers using the OpenAI API, were left out. “Third, we should be able to begin broad rollout to API customers and ChatGPT subscribers in the near future. As usual, we
- [Forescout joins Project Watershed 250 to strengthen water utility cybersecurity with OT capabilities](https://cybernoz.com/forescout-joins-project-watershed-250-to-strengthen-water-utility-cybersecurity-with-ot-capabilities/) - Forescout Technologies announced its participation in Project Watershed 250, a first-of-its-kind initiative launched in partnership with the White House, the State of Texas, water utilities, and technology providers to help strengthen cybersecurity for water and wastewater systems. Water and wastewater utilities face a rapidly evolving threat landscape, with cyberattacks increasingly targeting the operational technology (OT)
- [CISA retires six cybersecurity assessments for critical infrastructure amid rising threats, workforce pressures](https://cybernoz.com/cisa-retires-six-cybersecurity-assessments-for-critical-infrastructure-amid-rising-threats-workforce-pressures/) - The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is scaling back six free cybersecurity assessments for critical infrastructure organizations, according to Cybersecurity Dive, ending regional staff support for Cyber Resilience Reviews, Cyber Resilience Essentials surveys, Ransomware Readiness Assessments, Incident Management Reviews, External Dependencies Management Assessments and Cyber Infrastructure Surveys. The agency said it is retiring
- [Recapping Wiz @at Re:Inforce 2024](https://cybernoz.com/recapping-wiz-at-reinforce-2024/) - Re:Inforce ‘24 was jam packed with demos, Security Live! session, incredible magician, a speaking session, a rooftop party, and tons of swag! Our amazing Wizard of Wiz booth had non-stop traffic. In the “Security Live!” session hosted by AWS, our co-founder and VP of Product, Yinon Costica, discussed Wiz’s hyper-growth and how it has been enabled by
- [NETWIRE Configuration Extractor | Elastic Security Labs](https://cybernoz.com/netwire-configuration-extractor-elastic-security-labs/) - Python script to extract the payload from NETWIRE samples. Download netwire-configuration-extractor.tar.gz For information on the NETWIRE malware check out the following resources: Getting started Docker The recommended and easiest way to get going is to use Docker. From the directory this README is in, you can build a local container. docker build . -t netwire_loader_config_extractor
- [Trezor data breach impact now reaches 81,000 customers](https://cybernoz.com/trezor-data-breach-impact-now-reaches-81000-customers/) - Cryptocurrency hardware wallet maker Trezor says an August data breach at its shipping and logistics provider, ShipMonk, affects an additional 67,000 U.S. customers. In total, the breach has affected 81,000 customers after Trezor initially disclosed on August 13 that attackers accessed the data of nearly 14,000 customers, including their full names, shipping addresses, email addresses,
- [DPRK-Linked Hackers Deploy Ted Backdoor and CurlRAT Against South Korean Firms](https://cybernoz.com/dprk-linked-hackers-deploy-ted-backdoor-and-curlrat-against-south-korean-firms/) - South Korean automotive and media organizations have been hit by a quiet Linux intrusion toolkit built for long-term access. The malware hides inside software that manages web traffic, allowing attackers to watch users, steal information, and change pages delivered through compromised servers. The operation appears designed for patience rather than disruption. Attackers likely entered through
- [The UK’s Cyber Community Comes North as CyberFest returns for 2026](https://cybernoz.com/the-uks-cyber-community-comes-north-as-cyberfest-returns-for-2026/) - The North East’s biggest cyber security festival returns this October. Now in its ninth year, CyberFest has grown into a major national platform for showcasing the region’s cyber and secure AI excellence. Taking place across the North East throughout October, the festival will connect businesses, innovators, government and specialist clusters from across the UK, putting
- [Natural Resources Wales Data Breach Exposes Sensitive Employee Diversity Data](https://cybernoz.com/natural-resources-wales-data-breach-exposes-sensitive-employee-diversity-data/) - Natural Resources Wales (NRW) has reported a personal data breach involving sensitive diversity-monitoring information from both former and current employees. The breach affected individuals whom NRW employed between April 2013 and March 2018. An internal investigation revealed that a spreadsheet containing employee data was accidentally published online, making the information accessible before the issue was
- [Attackers spread malware through ScreenConnect file transfers](https://cybernoz.com/attackers-spread-malware-through-screenconnect-file-transfers/) - A file transfer flaw in ScreenConnect Remote Access Support and Access sessions affects both Cloud and On-Premise deployments, ConnectWise confirmed. “A CVE identifier and an official fix will be issued within the week,” the company wrote in its September 3 advisory. ScreenConnect is a popular remote support and access solution tailored for IT departments and
- [A week in security (August 31 – September 6)](https://cybernoz.com/a-week-in-security-august-31-september-6/) - Last week on Malwarebytes Labs: The hidden work of modernizing Malwarebytes X Money rollout linked to password-reset attacks Free streaming boxes may be routing criminal traffic through your home StreamRat Android malware spreads through Meta and TikTok ads Your phone or computer may soon ask how old you are Tech support scams look different now.
- [N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw](https://cybernoz.com/n-able-issues-fourth-n-central-hotfix-in-five-weeks-for-unauthenticated-rce-flaw/) - Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able's incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed. N-able has released its fourth hotfix in five weeks for the N-central remote monitoring and management
- [Application diversity transforms Oslo’s AI scene from innovator to leader](https://cybernoz.com/application-diversity-transforms-oslos-ai-scene-from-innovator-to-leader/) - Oslo’s tech trajectory has never followed the expected path. Its startup scene was born and began to thrive when social need met commercial opportunity, and just as with robotics and automation, the ecosystem’s mindset continues to be, “if there’s a capability gap, why not fill it?” The Norwegian capital’s approach to innovation has continued to
- [Mathspace Data Breach Affects 1.07M Users: What Happened](https://cybernoz.com/mathspace-data-breach-affects-1-07m-users-what-happened/) - The Mathspace data breach has affected 1,079,819 people in Australia and New Zealand after unauthorized parties accessed an internal reporting system and downloaded user information. Mathspace confirmed the security incident on September 3, 2026, and said the affected records involve students, parents or guardians, teachers, and Mathspace staff. The company said names, email addresses, and
- [Liquid Network Security Incident: Hackers Offer BTC Return](https://cybernoz.com/liquid-network-security-incident-hackers-offer-btc-return/) - The Liquid Network security incident has taken an unusual turn after the unidentified actors behind the theft of nearly 4,000 BTC offered to return “most” of the funds — but only after the vulnerability that enabled the exploit is fixed across the network. The purported white-hat hackers communicated their condition through an ongoing exchange with
- [iTnews Executive Retreat – Security Leaders Edition - VIC](https://cybernoz.com/itnews-executive-retreat-security-leaders-edition-vic/) - Security leaders operate in one of the most demanding roles in technology. Between navigating an evolving threat landscape, managing organisational risk and leading high-performing teams, there is little opportunity to step back, reflect and connect with peers facing the same challenges. Recognising the value of dedicated time for leadership and peer discussion, iTnews has launched
- [JSCeal Hides Crypto Malware in V8 Bytecode](https://cybernoz.com/jsceal-hides-crypto-malware-in-v8-bytecode/) - JSCeal Hides Crypto Malware in V8 Bytecode Pierluigi Paganini September 07, 2026 JSCeal hides crypto-stealing malware in V8 bytecode, but researchers built a tool to decompile it and expose its advanced theft capabilities. JSCeal is a cryptocurrency stealer that Check Point Research has tracked since early 2025. Unlike most malware, it hides its code in
- [What do CISOs need to rest easy about future AI risks?](https://cybernoz.com/what-do-cisos-need-to-rest-easy-about-future-ai-risks/) - Moreover, many CISOs are contending with what Almeida described as “organizational blind spots.” “In my conversations with CISOs, I have found that most leaders, security ones included, cannot explain how an agent works. They know that they need to use it, but don’t understand the mechanics: where the agent gets its information, how it calls
- [GenAI risks to be aware of — and prepare for — according to Gartner®](https://cybernoz.com/genai-risks-to-be-aware-of-and-prepare-for-according-to-gartner/) - A look at the current market trends in technology shows that generative artificial intelligence (GenAI) is undoubtedly shaping the future. GenAI can automate a wide range of tasks, freeing up time for humans to focus on innovation. It can analyze large amounts of data, provide personalized experiences to customers, and serve as a powerful learning
- [NETWIRE Dynamic Configuration Extraction | Elastic Security Labs](https://cybernoz.com/netwire-dynamic-configuration-extraction-elastic-security-labs/) - Key takeaways NETWIRE has shown an increase in prevalence over the last year Elastic Security Labs created an extractor to pull out configuration data from NETWIRE files and memory dumps targeting the functions the malware uses to extract its encrypted data The NETWIRE extractor is freely available for download To download the NETWIRE configuration extractor,
- [N-able patches max severity N-central flaw amid ongoing attacks](https://cybernoz.com/n-able-patches-max-severity-n-central-flaw-amid-ongoing-attacks/) - N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform. IT departments and managed service providers (MSPs) use the N-central platform to monitor, manage, and maintain client networks and devices from a centralized web-based console. Tracked as CVE-2026-86218, this RCE vulnerability allows
- [Russian Hackers Use New HOOKEDGE Backdoor to Spy on European Organizations](https://cybernoz.com/russian-hackers-use-new-hookedge-backdoor-to-spy-on-european-organizations/) - Russian hackers have used a Windows backdoor called HOOKEDGE in espionage operations against diplomatic, government, and defense-related organizations across Europe. The activity focused on targets in Romania, Spain, and Turkey, where seemingly ordinary Microsoft Word attachments became the opening move in a staged intrusion. The campaign relies on spearphishing emails carrying macro-enabled documents. Victims are
- [DPRK-Linked Hackers Backdoor HAProxy Servers to Spy on South Korean Organizations](https://cybernoz.com/dprk-linked-hackers-backdoor-haproxy-servers-to-spy-on-south-korean-organizations/) - A previously undocumented Linux espionage toolkit linked with medium confidence to DPRK-aligned threat actors has been used to compromise South Korean organizations in the automotive and media sectors. The campaign is notable because it does not exploit a flaw in HAProxy itself. Instead, the operators appear to have obtained code execution on targeted edge servers
- [ToolHive: The open-source way to run any MCP server securely](https://cybernoz.com/toolhive-the-open-source-way-to-run-any-mcp-server-securely/) - ToolHive is an open-source platform that runs Model Context Protocol servers inside containers. An MCP server is the connector that lets an AI client like Cursor or Claude Code reach an outside tool, and Stacklok ships ToolHive under Apache 2.0, so the runtime, the Kubernetes operator, and the registry cost nothing to self-host. A server
- [GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests](https://cybernoz.com/gpt-6-astra-scores-100-on-exploitbench-as-openai-blocks-poc-exploit-requests/) - OpenAI on Thursday officially unveiled GPT‑6 Astra, which it described as the "world's most intelligent and aligned model." The development comes days after the artificial intelligence (AI) company said the model had reached the "Critical" cybersecurity capability threshold under its Preparedness Framework. "Astra is state-of-the-art on computer use, browsing, software engineering, cybersecurity, science, and professional
- [$10 Million Reward For Amir Yaryab Offered By US](https://cybernoz.com/10-million-reward-for-amir-yaryab-offered-by-us/) - The U.S. State Department has posted a $10 million reward for Amir Yaryab, a senior Iranian official accused of leading the Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC) Cyber Operations Command and directing multiple hacking groups targeting critical infrastructure across the United States, Europe and the Middle East. According to the Rewards for Justice program,
- [Probllama: Ollama Remote Code Execution Vulnerability (CVE-2024-37032) – Overview and Mitigations](https://cybernoz.com/probllama-ollama-remote-code-execution-vulnerability-cve-2024-37032-overview-and-mitigations/) - Ollama is one of the most popular open-source projects for running AI Models, with over 70k stars on GitHub and hundreds of thousands of monthly pulls on Docker Hub. Inspired by Docker, Ollama aims to simplify the process of packaging and deploying AI models. Wiz Research discovered an easy-to-exploit Remote Code Execution vulnerability in Ollama: CVE-2024-37032,
- [Automating the Security Protections rapid response to malware](https://cybernoz.com/automating-the-security-protections-rapid-response-to-malware/) - Cyber attacks on corporate networks were up 50% in 2021, and it’s expected that 2022 will see more of the same. Elastic Endpoint Security includes a variety of protection layers to ensure maximum coverage against different types of malware. There have been a few examples recently of the need for fast, accurate updates of user
- [ChatGPT Astra is now rolling out to $20 Plus subscription](https://cybernoz.com/chatgpt-astra-is-now-rolling-out-to-20-plus-subscription/) - OpenAI is now rolling out ChatGPT Astra, its most powerful model to date, to those with a $20 Plus subscription, but there's no word on when free users will get access. The rollout appears to be happening gradually, and Astra may show up inside ChatGPT Work before it becomes available in regular Chat. In my
- [Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day](https://cybernoz.com/google-releases-chrome-update-to-patch-actively-exploited-v8-zero-day/) - Ravie LakshmananSep 04, 2026Vulnerability / Browser Security Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 (CVSS score: 8.8), has been described as a type confusion bug in V8, Chrome's JavaScript and WebAssembly engine. "Type confusion in
- [People First Bank progresses its tech stack modernisation](https://cybernoz.com/people-first-bank-progresses-its-tech-stack-modernisation/) - Key points People First Bank expects its fully modernised technology stack, including a Fiserv core banking platform and Backbase-powered digital banking, to be complete by late 2027. Customer migration of residual Heritage Bank accounts onto the People First Bank core banking system is targeted for late 2027, with a new end to end lending platform
- [Security Affairs newsletter Round 593 by Pierluigi Paganini – INTERNATIONAL EDITION](https://cybernoz.com/security-affairs-newsletter-round-593-by-pierluigi-paganini-international-edition/) - Security Affairs newsletter Round 593 by Pierluigi Paganini – INTERNATIONAL EDITION Pierluigi Paganini September 06, 2026 A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. International
- [SpaceXAI names Fabric Group as one of its first Asia-Pacific partners](https://cybernoz.com/spacexai-names-fabric-group-as-one-of-its-first-asia-pacific-partners/) - SpaceX’s AI arm, SpaceXAI, has named Australian digital consultancy Fabric Group as one of its first strategic partners in Asia-Pacific, in a multi-year deal aimed at expanding AI-assisted software development across Australian enterprise organisations. The agreement makes Fabric Group one of SpaceXAI’s first official partners in Australia and across the Asia Pacific and Japan (APJ)
- [It’s Magic! Wiz named Microsoft Commercial Marketplace Partner of the Year](https://cybernoz.com/its-magic-wiz-named-microsoft-commercial-marketplace-partner-of-the-year/) - Wiz is thrilled to announce that we have been recognized as Microsoft's Commercial Marketplace 2024 Partner of the Year. This accolade highlights the exceptional work of our global team and our amazing customers who rely on the Microsoft Commercial Marketplace for expert guidance and business solutions. The Microsoft Commercial Marketplace plays a critical role in
- [Hunting for Suspicious Windows Libraries for Execution and Defense Evasion](https://cybernoz.com/hunting-for-suspicious-windows-libraries-for-execution-and-defense-evasion/) - Dynamic-link library (DLL) image loads is one of the noisiest types of event in Windows, which may discourage defenders from using it for detection engineering or threat hunting. Even if logged in some environments, it’s often limited to function-specific DLLs such as scheduled tasks (taskschd.dll), Windows Management Instrumentation (wmiutil.dll) and potentially DLLs loading from a
- [Hackers Exploiting MikroTik RouterOS Vulnerability in the Wild to Gain Complete Network Access](https://cybernoz.com/hackers-exploiting-mikrotik-routeros-vulnerability-in-the-wild-to-gain-complete-network-access/) - Attackers are actively exploiting an unauthenticated remote access flaw in MikroTik RouterOS, and network administrators worldwide are being urged to patch their devices immediately before compromise turns into a full network takeover. MikroTik confirmed on September 3, 2026, that it had discovered a serious security vulnerability affecting RouterOS and had already shipped fixes across every
- [Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities](https://cybernoz.com/attackers-exploit-papercut-flaws-to-steal-credentials-from-schools-and-universities/) - Ravie LakshmananSep 05, 2026Vulnerability / Web Security Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe. The Arctic Wolf Adversary Research Team said it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 – an authentication bypass and remote code execution chain –
- [Vocus hit by Australia Singapore Cable break](https://cybernoz.com/vocus-hit-by-australia-singapore-cable-break/) - Vocus is dealing with a break on its Australia Singapore Cable (ASC) system that runs between Perth and Singapore, weeks after the second major cable on the route experienced a shunt fault. The problems with ASC began Friday night and were traced to a cable break between Anyer, which sits about 80km west of Jakarta,
- [AI Agents Hijacked German Wiki to Cheat, OpenAI Delayed Disclosure](https://cybernoz.com/ai-agents-hijacked-german-wiki-to-cheat-openai-delayed-disclosure/) - The site in question, DseWiki, is a roughly 25-year-old communal editing platform for German software developers that had gone largely quiet before agents apparently found it useful for something else entirely. The scale of what happened there is genuinely striking. Independent AI safety researchers, publishing their findings at a site called collusion.wiki, documented somewhere between
- [RCE vulnerability in OpenSSH: everything you need to know](https://cybernoz.com/rce-vulnerability-in-openssh-everything-you-need-to-know/) - An unauthenticated RCE-as-root vulnerability was identified in OpenSSH server (sshd) by researchers from Qualys, assigned CVE-2024-6387 and dubbed regreSSHion. The vulnerability is a signal handler race condition and is known to be exploitable in the default configuration of OpenSSH in specific version ranges running on 32-bit glibc-based Linux distributions. A signal handler race condition vulnerability was
- [Stopping Vulnerable Driver Attacks | Elastic Security Labs](https://cybernoz.com/stopping-vulnerable-driver-attacks-elastic-security-labs/) - Key takeaways Ransomware actors are leveraging vulnerable drivers to tamper with endpoint security products. Elastic Security released 65 YARA rules to detect vulnerable driver abuse. Elastic Endpoint (8.3+) protects users from this threat. Background In 2018, Gabriel Landau and Joe Desimone presented a talk at Black Hat covering the evolution of kernel mode threats on
- [Attackers conceal phishing lures using invisible Unicode characters](https://cybernoz.com/attackers-conceal-phishing-lures-using-invisible-unicode-characters/) - Threat actors have adopted the ASCII smuggling technique in phishing campaigns, using invisible Unicode characters to evade email security filters. ASCII smuggling has been used in AI prompt injection attacks to conceal malicious instructions from users by encoding them with Unicode characters from the Tags block (U+E0000–U+E007F). Microsoft threat researchers discovered a large-scale phishing campaign
- [ASUS Control Center Vulnerability Allows Attackers to Gain Full Admin Control of the System](https://cybernoz.com/asus-control-center-vulnerability-allows-attackers-to-gain-full-admin-control-of-the-system/) - ASUS has issued an urgent security update for ASUS Control Center Enterprise (ACC) after researchers uncovered a maximum-severity vulnerability that lets remote attackers seize complete administrative control over the platform and every device it manages, without needing a password or any user interaction. Tracked as CVE-2026-75754, the flaw carries a CVSS 4.0 score of 10.0,
- [Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner](https://cybernoz.com/four-revstealer-linked-modules-disable-windows-update-and-defender-to-run-a-crypto-miner/) - Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on an infected machine after the stealer deletes itself. One of them switches off Windows Update and Microsoft Defender before running a cryptocurrency miner. The company named the four programs ProManager, WinUpdate, SoftManager, and LockAppHost and
- [Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”](https://cybernoz.com/your-mikrotik-router-may-already-be-compromised-look-for-ssh-user-2/) - Your MikroTik Router May Already Be Compromised: Look for SSH User “-2” Pierluigi Paganini September 06, 2026 MikroTik RouterOS SSH zero-day (MikroTrick chain) under active exploitation since Sept 2. Patch to 7.24.2, 7.23.5, or 6.49.21 immediately and check logs. Anyone running a MikroTik router with SSH exposed to the internet should treat it as compromised
- [How Wiz customers are flippin' vulnerabilities for July 4th](https://cybernoz.com/how-wiz-customers-are-flippin-vulnerabilities-for-july-4th/) - As we celebrate the birth of our nation this Fourth of July, Wiz also celebrates the achievements of companies who’ve declared independence from sleepless nights by adopting an innovative approach to cloud security. Meet three Wiz customers who’ve completely eliminated outstanding critical cloud misconfigurations, compliance violations, and vulnerabilities across the production environment, reaching zero critical
- [Detecting Living-off-the-land attacks with new Elastic Integration](https://cybernoz.com/detecting-living-off-the-land-attacks-with-new-elastic-integration/) - It is becoming more common that adversary attacks consist of more than a standalone executable or script. Advanced attacker techniques, like “living off the land” (LotL) that appear normal in isolation become more suspicious when observed in a parent-child context. If you are running Windows in your environment, it is important to have a system
- [Anthropic confirms Claude is down, multiple models affected](https://cybernoz.com/anthropic-confirms-claude-is-down-multiple-models-affected/) - Claude is experiencing an outage, with users encountering elevated errors when sending requests to multiple Anthropic AI models. The incident began on September 3, 2026, at around 9:41 AM ET, and is affecting several Claude models, including the company's latest Mythos, Fable, and Opus models. According to Anthropic’s status page, the company initially said it
- [CrowdStrike Launches SafeMind Cybersecurity's First Agentic System Built for Defenders](https://cybernoz.com/crowdstrike-launches-safemind-cybersecuritys-first-agentic-system-built-for-defenders/) - CrowdStrike has unveiled SafeMind, a family of purpose-built security models and harnesses that the company is calling the first agentic system engineered specifically for cyber defenders. Announced at Fal.Con 2026 in Las Vegas, the launch marks a strategic pivot away from generic frontier AI models toward a dedicated offensive-defensive framework built to operate natively inside
- [Week in review: Claude accounts compromised through infostealer, Patch Tuesday forecast](https://cybernoz.com/week-in-review-claude-accounts-compromised-through-infostealer-patch-tuesday-forecast/) - Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Anthropic locks out Claude users after infostealers hijack login sessionsAnthropic has started locking users out of their Claude accounts due to their login sessions having been compromised through infostealer malware. September 2026 Patch Tuesday forecast: All we need is more
- [Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication](https://cybernoz.com/attackers-hijack-mikrotik-routers-through-internet-exposed-ssh-without-authentication/) - Swati KhandelwalSep 06, 2026Vulnerability / Network Security Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska's attack warning, published on September 5. Successful attacks date to at least September 2. The Hacker News’s September 6
- [Human-AI chemistry: the real differentiator in enterprise AI](https://cybernoz.com/human-ai-chemistry-the-real-differentiator-in-enterprise-ai/) - Enterprise AI has entered a new era. For the past few years, organisations have focused primarily on experimentation: deploying individual tools and identifying where AI can remove friction from daily manual tasks. But the conversation has now moved on. Businesses are now implementing integrated agentic systems that operate across workflows. Tools that once operated
- [SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 113](https://cybernoz.com/security-affairs-malware-newsletter-round-113/) - Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Hackers Steal Claude Login Sessions With Infostealer Malware to Hijack Accounts Fire Ant Evolves: From Hypervisors to Trusted Infrastructure Gryxa: The AI-Built Toolkit That Watches How You Remove It ValleyRAT masquerading as adware
- [Wiz Ranked #1 CNAPP and CSPM by G2](https://cybernoz.com/wiz-ranked-1-cnapp-and-cspm-by-g2/) - At Wiz, we love to celebrate milestones, but no recognition is more meaningful than the ones that are rooted in customer love. Everything we do is for our customers, and so to be the top-ranked CSPM and CNAPP on peer reviews site G2 for the sixth consecutive quarter ... well, we’re almost at a loss
- [Detect Credential Access with Elastic Security](https://cybernoz.com/detect-credential-access-with-elastic-security/) - Preamble Credential Access consists of techniques for stealing credentials like cookies, API keys, and passwords. It is one of the top critical tactics that is almost guaranteed to occur during an attack lifecycle, ranging from phishing to infostealer malware to more complicated post-exploitation techniques. Therefore, covering it from different angles increases opportunities for early detection
- [OpenAI confirms ChatGPT is down ahead of 'Astra' model launch](https://cybernoz.com/openai-confirms-chatgpt-is-down-ahead-of-astra-model-launch/) - ChatGPT and Codex are experiencing a major outage, with users reporting errors across nearly every major ChatGPT feature. The outage started at approximately 10:58 AM ET on Thursday, September 3, and is affecting ChatGPT conversations, login, search, file uploads, Voice mode, GPTs, image generation, Deep Research, Agent, ChatGPT Work, and other services. OpenAI's Codex services
- [Hackers Actively Exploiting Magento and Adobe Commerce 0-Day RCE Vulnerability](https://cybernoz.com/hackers-actively-exploiting-magento-and-adobe-commerce-0-day-rce-vulnerability/) - A newly discovered zero-day vulnerability in Magento Open Source and Adobe Commerce is being actively exploited by attackers to seize full control of online stores, and there is still no official patch available. Dutch e-commerce security firm Sansec disclosed the flaw, dubbed StyleSmuggler, on September 5, 2026, warning that unauthenticated attackers can achieve remote code
- [CARS24 Data Breach Exposes 3,100 Customer Records, Leads Allegedly Sold for ₹1,000 Each](https://cybernoz.com/cars24-data-breach-exposes-3100-customer-records-leads-allegedly-sold-for-₹1000-each/) - Used-car platform CARS24 has alleged that confidential information belonging to approximately 3,100 customers was stolen and supplied to a rival business and outside dealers. The company claims that leads were offered for about ₹1,000 each, resulting in an estimated commercial loss of ₹5.70 crore. The complaint was filed at a Cyber Crime Police Station by
- [Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code](https://cybernoz.com/critical-vmware-workstation-and-fusion-flaw-lets-vm-admins-execute-host-code/) - Ravie LakshmananSep 05, 2026Vulnerability / Server Security Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution under certain conditions. The vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges can
- [Nvidia acquires Hugging Face and becomes open platform provider](https://cybernoz.com/nvidia-acquires-hugging-face-and-becomes-open-platform-provider/) - Nvidia CEO Jensen Huang announced on his blog that the company would be acquiring Hugging Face for $12.9bn. He reassured artificial intelligence (AI) developers of open models and their users that Hugging Face would remain an open platform for the entire AI ecosystem. “Developers will choose the models they want, the frameworks they want, the
- [Nvidia Is Buying AI Platform Hugging Face for $13 Billion](https://cybernoz.com/nvidia-is-buying-ai-platform-hugging-face-for-13-billion/) - Chipmaker Nvidia (NASDAQ: NVDA) is buying artificial intelligence software platform Hugging Face for $13 billion. It’s the latest deal by the company, whose processors are integral to the AI boom, and highlights Nvidia’s push to champion increasingly popular open-source AI models. Nvidia CEO Jensen Huang wrote in a blog post Thursday that more than 18
- [Guardians of Compliance: Unleashing the Magic of Wiz4Wiz](https://cybernoz.com/guardians-of-compliance-unleashing-the-magic-of-wiz4wiz/) - Since the beginning of Wiz, our security team has been using an internal instance of the product, called Wiz4Wiz. It gives greater visibility into our resources and enables a shift left atmosphere that focuses on security principles – from design to implementation.The democratization of security does not stop there. The goal of our Governance, Risk, and
- [Elastic Global Threat Report Multipart Series Overview](https://cybernoz.com/elastic-global-threat-report-multipart-series-overview/) - BlogEach month, the Elastic Security Labs team dissects a different trend or correlation from the Elastic Global Threat Report. This post provides an overview of those individual publications.When we announced the inaugural Elastic Global Threat Report last year, the Elastic Security Labs team knew we wanted to follow it with a series that went a
- [Google warns of new Chrome zero-day flaw exploited in attacks](https://cybernoz.com/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/) - Google has updated the Chrome browser to address an actively exploited high-severity zero-day flaw in the V8 engine and 11 other vulnerabilities. The exploited security issue, identified as CVE-2026-85046, is described as a type confusion. It was reported to Google by researcher Salvatore Gulizia, known online as “Serotav.” The update brings Chrome to version 152.0.7977.82/.83
- [Plex Urges Users to Update Media Server Immediately to Fix Multiple Security Flaws](https://cybernoz.com/plex-urges-users-to-update-media-server-immediately-to-fix-multiple-security-flaws/) - Plex has issued an urgent security update for Plex Media Server and Plex Desktop, asking users to install the latest releases as soon as possible. The update addresses multiple undisclosed security issues affecting Plex Media Server versions 1.43.2 and earlier, as well as affected Plex Desktop installations. Plex released Plex Media Server version 1.43.3 and
- [Hackers Use Frontier AI Agents to Breach Enterprise Network in Under 10 Hours](https://cybernoz.com/hackers-use-frontier-ai-agents-to-breach-enterprise-network-in-under-10-hours/) - A threat actor used frontier artificial-intelligence models and attack-specific agentic frameworks to breach an enterprise environment, harvest root credentials, and hijack cloud AI infrastructure in less than 10 hours. The investigation, documented by Palo Alto Networks Unit 42, highlights a significant shift in intrusion operations. AI-assisted automation compressed an attack that could otherwise demand several
- [Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials](https://cybernoz.com/attackers-breached-jetbrains-cadence-via-unpatched-teamcity-extracting-aws-credentials/) - Ravie LakshmananSep 05, 2026Data Breach / Identity Security JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. "Cadence users should immediately revoke or rotate all credentials and secrets that
- [The future of AI depends on the quality of the data behind It](https://cybernoz.com/the-future-of-ai-depends-on-the-quality-of-the-data-behind-it/) - One of the biggest lessons from working with data is that having more information does not automatically mean having better insight. Data only creates value when it helps the business make a better decision, catch a problem while there is still time to do something about it and ensure the right information reaches the people
- [Google Patches 6th Chrome Zero-Day of 2026](https://cybernoz.com/google-patches-6th-chrome-zero-day-of-2026/) - Google on Thursday rolled out fresh Chrome 152 security updates that resolve 12 vulnerabilities, including an exploited zero-day. Tracked as CVE-2026-85046, the high-severity bug is described as a type confusion issue in Chrome’s V8 JavaScript and WebAssembly engine. It was reported by Salvatore Gulizia, who received a $1,000 bug bounty reward. “Google is aware that
- [OpenAI Announced $1B in Defensive Tools for Water Utilities](https://cybernoz.com/openai-announced-1b-in-defensive-tools-for-water-utilities/) - OpenAI Announced $1B in Defensive Tools for Water Utilities Pierluigi Paganini September 05, 2026 OpenAI pledges $1B in subsidized Daybreak AI cybersecurity tools for under-resourced critical infrastructure defenders. OpenAI announced Daybreak for Frontline Defenders on September 3, 2026, committing $1 billion in subsidized access to its Daybreak cyber models, training, and technical support to help
- [Enhance existing security workflows with high-fidelity cloud security data from Wiz in ServiceNow](https://cybernoz.com/enhance-existing-security-workflows-with-high-fidelity-cloud-security-data-from-wiz-in-servicenow/) - ServiceNow is an essential link for many IT, Configuration Management, Vulnerability Response, Compliance, and Infrastructure teams. ServiceNow customers leverage these modules as the backbone of their IT operations. As they migrate to the cloud they face new challenges like keeping inventory updated with ephemeral workloads and ensuring prioritized security risks are presented with the cloud
- [Unpacking ICEDID | Elastic Security Labs](https://cybernoz.com/unpacking-icedid-elastic-security-labs/) - Preamble ICEDID is a malware family discoveredin 2017 by IBM X-force researchers and is associated with the theft of login credentials, banking information, and other personal information. ICEDID has always been a prevalent family but achieved even more growth since EMOTET’s temporary disruption in early 2021. ICEDID has been linked to the distribution of several
- [Exchange Online outage causes email delays, 'Server busy' errors](https://cybernoz.com/exchange-online-outage-causes-email-delays-server-busy-errors/) - Microsoft is working to resolve an ongoing Exchange Online outage that is delaying email sent to and received from external domains. The company first acknowledged this incident (tracked under EX1467029) at 02:19 AM EDT, when it began investigating reports of intermittent "Server busy" errors. "This issue impacts users who may be attempting to send and
- [Microsoft Confirms New Exchange Online Outage Delaying Emails from External Domains](https://cybernoz.com/microsoft-confirms-new-exchange-online-outage-delaying-emails-from-external-domains/) - Microsoft has confirmed a fresh Exchange Online incident, tracked as EX1467029, causing delays for users sending and receiving email messages from external domains. The company first acknowledged the disruption on September 4, 2026, flagging it as a service degradation issue affecting Exchange Online, one of the most widely used business email platforms in the world.
- [12-Year-Old PostgreSQL Flaw Lets Attackers Execute Code and Take Over Database Servers](https://cybernoz.com/12-year-old-postgresql-flaw-lets-attackers-execute-code-and-take-over-database-servers/) - A critical PostgreSQL vulnerability dubbed PostGREShell could allow low-privileged replication accounts to execute attacker-controlled code, escalate to database superuser, and establish persistent backdoors on affected servers. Tracked as CVE-2026-6471, the flaw reportedly affected PostgreSQL releases from version 9.4 onward, leaving a dangerous plugin-loading path exposed for roughly 12 years. Cyera Research disclosed the issue on
- [Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores](https://cybernoz.com/unpatched-magento-and-adobe-commerce-zero-day-exploited-to-backdoor-online-stores/) - Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5. Sansec, which discovered the flaw and named it StyleSmuggler, said attacks started on September
- [CIO interview: Frédéric Laurent, deputy CIO, Starling Bank](https://cybernoz.com/cio-interview-frederic-laurent-deputy-cio-starling-bank/) - The idea of having people without formal software development skills being able to use vibe coding to create simple applications is both compelling and a potential nightmare for busy IT departments. The idea of citizen developers is nothing new; Microsoft’s Excel and Word macros have helped people automate repetitive tasks using a relatively simple programming
- [Catch Raises $5 Million for AI Executive Assistant With Guardrails](https://cybernoz.com/catch-raises-5-million-for-ai-executive-assistant-with-guardrails/) - Catch, an agentic admin assistant for leaders, has raised $5 million to accelerate its purpose to solve executives’ daily pain points. The funding was co-led by Entrée Capital and Pitango, with participation from Seedcamp and Factorial Capital. Catch, an AI startup co-founded by Nir Sabato (CEO) and Yoav Ramon (CTO), develops an AI admin assistant
- [PaperCut Flaws Exploited in Attacks on U.S. and European Schools](https://cybernoz.com/papercut-flaws-exploited-in-attacks-on-u-s-and-european-schools/) - PaperCut Flaws Exploited in Attacks on U.S. and European Schools Pierluigi Paganini September 05, 2026 Attackers are exploiting two new PaperCut flaws to steal credentials and gain privileged access in education-sector attacks across the U.S. and Europe. Attackers are exploiting two recelty disclosed PaperCut flaws, CVE-2026-81578 and CVE-2026-82078, in attacks targeting schools and other education
- [SAPwned: SAP AI vulnerabilities expose customers’ cloud environments and private AI artifacts](https://cybernoz.com/sapwned-sap-ai-vulnerabilities-expose-customers-cloud-environments-and-private-ai-artifacts/) - Over the past months, we on the Wiz Research Team have conducted extensive tenant isolation research on multiple AI service providers. We believe these services are more susceptible to tenant isolation vulnerabilities, since by definition, they allow users to run AI models and applications – which is equivalent to executing arbitrary code. As AI infrastructure
- [How to secure edge AI in customer-owned environments](https://cybernoz.com/how-to-secure-edge-ai-in-customer-owned-environments/) - In this article Edge AI moves model execution, model IP, customer data, and system authority into infrastructure the customer owns and operates. That changes who must verify the stack before sensitive assets are released. Edge AI includes AI systems where inference runs on or near the device, sensor, or other local environments where data is
- [Click, Click… Boom! Automating Protections Testing with Detonate](https://cybernoz.com/click-click-boom-automating-protections-testing-with-detonate/) - Preamble Imagine you are an Endpoint artifact developer. After you put in the work to ensure protection against conventional shellcode injections or ransomware innovations, how do you know it actually works before you send it out into the world? First, you set up your end-to-end system, which involves setting up several services, the infrastructure, network
- [Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain](https://cybernoz.com/over-5400-hacked-sites-serve-clickfix-payloads-stored-on-the-blockchain/) - A massive cybercriminal operation is leveraging thousands of compromised small-business websites to deliver ClickFix payloads stored in smart contracts on the BNB Smart Chain (BSC). Over the past months, researchers identified more than 5,400 hacked websites, most of them built on WordPress and PrestaShop. The initial compromise method remains unknown, but each site was injected
- [Hackers Use Invisible Unicode Characters to Evade Phishing Detection in Millions of Emails](https://cybernoz.com/hackers-use-invisible-unicode-characters-to-evade-phishing-detection-in-millions-of-emails/) - Attackers are using invisible Unicode characters to make phishing emails appear harmless while disrupting the security systems built to spot suspicious language. The campaign pushed finance-themed messages at massive scale, showing how a tiny change inside a word can weaken standard filtering. Recipients saw ordinary offers for funding, loans, or credit, but the underlying text
- [Russian Hackers Deploy New HOOKEDGE Backdoor in Espionage Attacks Across Europe](https://cybernoz.com/russian-hackers-deploy-new-hookedge-backdoor-in-espionage-attacks-across-europe/) - Russian state-sponsored threat actor BlueDelta, also tracked as APT28, Fancy Bear, and Forest Blizzard, has deployed a lightweight Windows backdoor named HOOKEDGE in espionage operations targeting government, diplomatic, and defense-manufacturing organizations across Europe. The activity, documented by PolySwarm, targeted entities in Romania, Spain, and Turkey between late September 2025 and early April 2026. New variants
- [Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted](https://cybernoz.com/trezor-says-shipmonk-breach-exposed-67000-u-s-customers-data-it-said-was-deleted/) - Ravie LakshmananSep 05, 2026Data Breach / Vulnerability Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk. The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers between November 2019 and August 2021. The breach
- [Billion-dollar AWS financial services investment builds on a decade of work](https://cybernoz.com/billion-dollar-aws-financial-services-investment-builds-on-a-decade-of-work/) - Amazon Web Services (AWS) began heavily targeting the financial services sector a decade ago and has transformed its offering in line with a changing sector. Some 10 years ago, the promise of unlimited computing power on a pay-as-you-go basis was a huge differentiator. AWS, as well as a few of its tech hyperscale competitors, enabled
- [Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites](https://cybernoz.com/elementor-pro-wordpress-plugin-vulnerability-exploited-to-hack-sites/) - Hackers have been exploiting a critical-severity vulnerability in the Elementor Pro WordPress plugin to hack websites, WordPress security firm Defiant warns. A highly popular drag-and-drop website builder, Elementor is a free WordPress plugin with over 10 million installations. Elementor Pro is the paid version that offers additional features, including a Form widget with support for
- [Dark Web Service Nexus Sells 153M+ Driver's Licenses](https://cybernoz.com/dark-web-service-nexus-sells-153m-drivers-licenses/) - Dark Web Service Nexus Sells 153M+ Driver’s Licenses Pierluigi Paganini September 04, 2026 FBI probes suspected breach at IDScan.net after dark web service Nexus offered 153M+ US and Canadian driver’s license scans. A dark web identity theft service called Nexus appeared on September 1, 2026, offering searchable access to more than 153 million scanned driver’s
- [Your control tower to secure code across GitHub, GitLab, and Azure Repos](https://cybernoz.com/your-control-tower-to-secure-code-across-github-gitlab-and-azure-repos/) - Imagine a control tower that monitors and actively secures your codebase across version control systems (VCS). With Wiz’s latest GitLab and Azure DevOps integrations, you get a unified security solution that protects your code–wherever it lives. In this blog, we’ll dive into how Wiz leverages its Security Graph, ensures comprehensive configuration checks, and advanced code
- [Detect domain generation algorithm (DGA) activity with new Kibana integration](https://cybernoz.com/detect-domain-generation-algorithm-dga-activity-with-new-kibana-integration/) - Searching for a way to help protect your network from potential domain generation algorithm (DGA) attacks? Look no further — a DGA detection package is now available in the Integrations app in Kibana. In a single click, users can install and start using the DGA model and associated assets, including ingest pipeline configurations, anomaly detection
- [OpenAI admits it didn't disclose rogue AI wiki hijacking incident](https://cybernoz.com/openai-admits-it-didnt-disclose-rogue-ai-wiki-hijacking-incident/) - OpenAI has acknowledged that it did not publicly disclose an earlier incident in which its autonomous AI agents took over a German wiki to communicate, share answers, and exchange techniques for bypassing restrictions. The company says it treated the activity as model "misalignment" rather than a security incident, but now admits its disclosure practices must expand
- [Microsoft Teams Desktop Client Fails to Load on Windows System](https://cybernoz.com/microsoft-teams-desktop-client-fails-to-load-on-windows-system/) - Microsoft is investigating an ongoing issue causing some Windows users to face significant delays or outright failures when launching the Microsoft Teams desktop client. The company acknowledged the problem, tracked internally as TM1466820, and confirmed it remains unresolved as engineers continue digging through service logs to find a root cause. According to Microsoft’s incident notice,
- [OpenAI Agents Hacked Another Website](https://cybernoz.com/openai-agents-hacked-another-website/) - After reporting last week that the surveillance company Flock Safety is building an AI search tool for law enforcement, WIRED reconstructed Flock’s latest search tool from code that the company sends to a police officer’s browser and uncovered key details about how the tool works.OpenAI said this week that its Astra model, which will have
- [Chainguard Hits 1 Billion Build Manifests With AI-Powered Software Supply Chain Security](https://cybernoz.com/chainguard-hits-1-billion-build-manifests-with-ai-powered-software-supply-chain-security/) - Chainguard has surpassed 1 billion container build manifests, doubling production from 500 million in six months as it expands its AI-assisted software supply-chain security platform. The company now maintains more than 3,000 unique container images and 675,000 image versions. The milestone reflects more than raw build volume. Each build manifest represents a newly generated, verifiable
- [New infosec products of the week: September 4, 2026](https://cybernoz.com/new-infosec-products-of-the-week-september-4-2026/) - Here’s a look at the most interesting products from the past week, featuring releases from BugBase, F5 Networks, Ping Identity, and Superna. F5 speeds up virtual patching to counter AI-driven threats With new features such as anomaly detection and agentic threat intelligence, F5’s AI-powered web application firewall (WAF) is capable in delivering real-time protections because
- [Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel](https://cybernoz.com/thousands-of-openai-agents-quietly-turned-an-abandoned-wiki-into-their-coordination-channel/) - A group of AI safety researchers says a fleet of autonomous agents that identified themselves as OpenAI systems left about 18,000 posts on a dormant 25-year-old German wiki between May and July 2026, using the site as a shared board to pool answers to a timed web task and pass around a way out of
- [Peer demands action on DWP subpostmaster prosecutions in duty of candour debate](https://cybernoz.com/peer-demands-action-on-dwp-subpostmaster-prosecutions-in-duty-of-candour-debate/) - During a debate on the Public Office (Accountability) Bill, ministers were asked to investigate the delay to the proposed investigation into the 100 subpostmaster convictions that were instigated by the Department of Work & Pensions (DWP). Speaking during a debate on the proposed law that will make a lack of candour, transparency and frankness in
- [12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover](https://cybernoz.com/12-year-old-postgresql-vulnerability-enables-database-server-takeover/) - PostgreSQL releases since 2014 contain a severe vulnerability that allows attacker with low privileges to take over databases and servers, cybersecurity firm Cyera reports. An open source relational database system offering support for both relational (SQL) and non-relational (JSON) queries, PostgreSQL is one of the most popular databases, being used by tens of thousands of
- [Google fixes the sixth actively exploited Chrome zero-day of 2026](https://cybernoz.com/google-fixes-the-sixth-actively-exploited-chrome-zero-day-of-2026/) - Google fixes the sixth actively exploited Chrome zero-day of 2026 Pierluigi Paganini September 04, 2026 Google patched 12 Chrome flaws, including an actively exploited V8 zero-day that could enable remote code execution through a crafted webpage. Google released a Chrome security update fixing 12 vulnerabilities, including CVE-2026-85046 (CVSS score of 8.8), an actively exploited V8
- [Fake Cloudflare CAPTCHA tricks victims into opening a tunnel for attackers](https://cybernoz.com/fake-cloudflare-captcha-tricks-victims-into-opening-a-tunnel-for-attackers/) - “While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully,” the company said in a blog post. The company has provided detection coverage, IOCs, hunting queries, and mitigation and response
- [OSPAR 2026 report now available with 167 services in scope](https://cybernoz.com/ospar-2026-report-now-available-with-167-services-in-scope/) - We’re pleased to confirm the successful completion of our annual Amazon Web Services (AWS) Outsourced Service Provider’s Audit Report (OSPAR) assessment on July 29, 2026, in line with the OSPAR version 2.0 framework. The Association of Banks in Singapore (ABS) established the Guidelines on Control Objectives and Procedures for Outsourced Service Providers (ABS Guidelines) to
- [Forget vulnerable drivers - Admin is all you need](https://cybernoz.com/forget-vulnerable-drivers-admin-is-all-you-need/) - Introduction Bring Your Own Vulnerable Driver (BYOVD) is an increasingly popular attacker technique wherein a threat actor brings a known-vulnerable signed driver alongside their malware, loads it into the kernel, then exploits it to perform some action within the kernel that they would not otherwise be able to do. After achieving kernel access, they may
- [39 New Methods That Compromise Passkey Authentication](https://cybernoz.com/39-new-methods-that-compromise-passkey-authentication/) - Passkeys were introduced with a strong security proposition. Replace passwords with public key cryptography, bind the credential to the legitimate service, keep the private key away from the server, and many of the phishing and credential theft attacks that have plagued enterprise security for decades become dramatically harder. All of that is true. But the
- [AI Agents Breach Company Network in Under 10 Hours and Steal Root Credentials](https://cybernoz.com/ai-agents-breach-company-network-in-under-10-hours-and-steal-root-credentials/) - A human attacker armed with frontier artificial intelligence models breached an enterprise network and seized root credentials in under 10 hours, a timeline that would normally take human red teams roughly two weeks to complete, according to a new incident response report from Palo Alto Networks’ Unit 42. The threat actor told Unit 42 investigators
- [Protecting Against Zero-Click Attacks - IT Security Guru](https://cybernoz.com/protecting-against-zero-click-attacks-it-security-guru/) - By Aimee Steele, threat intelligence analyst at Talion Cyber Security Last month, the UK’s National Cyber Security Centre (NCSC) issued an advisory around a new phishing campaign targeting organisations in the West that was being carried out by the Russian state-sponsored threat actor known as Laundry Bear. The campaign, saw the threat actors exploiting a
- [New Panzer Ransomware Hits 16 Victims Across 11 Countries With Data Theft and Encryption](https://cybernoz.com/new-panzer-ransomware-hits-16-victims-across-11-countries-with-data-theft-and-encryption/) - Panzer ransomware has emerged as a new Ransomware-as-a-Service (RaaS) operation, publishing 16 alleged victims across 11 countries while combining data theft with file encryption. Documented by CyberXtron, its dedicated leak site was first observed active on August 5, 2026, and its early victim list includes organizations in technology, manufacturing, government, agriculture, energy, education, and retail.
- [Most of the bugs Claude Mythos found have never been checked by a human](https://cybernoz.com/most-of-the-bugs-claude-mythos-found-have-never-been-checked-by-a-human/) - Anthropic pointed Claude Mythos Preview at 281 open-source projects and collected 23,019 candidate vulnerabilities. External security firms reviewed 1,900 of them. Maintainers received 1,596 reports and acknowledged 1,451; 97 fixes landed upstream, and 88 findings became published security advisories, with counts current as of May 22, 2026. The other 21,119 candidates have not been reviewed
- [Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws](https://cybernoz.com/plex-urges-immediate-updates-after-patching-multiple-undisclosed-security-flaws/) - Ravie LakshmananSep 04, 2026Vulnerability / Network Security Plex is urging users to update their instances to the latest version following the release of an update that patches multiple security flaws. The fixes are available in Plex Media Server 1.43.3 and Plex Desktop 1.115.0. The streaming media service did not elaborate on what those issues are,
- [Data dive: Mapping NHS hyperscaler dependence](https://cybernoz.com/data-dive-mapping-nhs-hyperscaler-dependence/) - Barts Health NHS Trust runs one of London’s largest hospital groups. Its public internet footprint is also the most tangled of any trust in England, with 304 separate DNS records that point to UK-sovereign infrastructure and three US hyperscalers. Computer Weekly’s analysis of those records finds 113 pointing to US-controlled services and 135 to UK-held
- [Sangoma Switchvox Vulnerabilities Exploited in the Wild](https://cybernoz.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/) - Threat actors have been exploiting a critical-severity vulnerability in the enterprise VoIP telephony management solution Sangoma Switchvox, Horizon3 and CISA warn. Tracked as CVE-2026-9586 (CVSS score of 9.3) and described as an unauthenticated SQL injection issue, the security defect can be exploited remotely for arbitrary code execution. It resides in an endpoint that processes XML
- [Broadcom Patches Critical VMware Workstation and Fusion VM-Escape Vulnerabilities](https://cybernoz.com/broadcom-patches-critical-vmware-workstation-and-fusion-vm-escape-vulnerabilities/) - Broadcom Patches Critical VMware Workstation and Fusion VM-Escape Vulnerabilities Pierluigi Paganini September 05, 2026 Broadcom patched two VMware Workstation/Fusion VM-escape bugs. No workarounds exist. Update to version 26H1u1 immediately. Broadcom published advisory VMSA-2026-0007, patching two vulnerabilities in VMware Workstation and Fusion that allow an attacker inside a virtual machine to execute code on the underlying
- [Government lacks ability to verify AI labs’ claims, experts say](https://cybernoz.com/government-lacks-ability-to-verify-ai-labs-claims-experts-say/) - A new survey of national security practitioners identified a wide range of near- and medium-term AI risks for policymakers to consider. Source link
- [Zero trust has a big AI agent problem ahead](https://cybernoz.com/zero-trust-has-a-big-ai-agent-problem-ahead/) - That means agents will get a mix of “rate limits, transaction boundaries, spend and data budgets, sandboxing, approval gates for high-consequence actions, and immutable activity trails,” Wilkes says. “Most importantly, autonomous systems need quick and confident undo buttons. Type 2 decisions, where the consequences are reversible, are much safer to delegate than Type 1 decisions
- [The Prompt Airlines CTF: Test Your AI Security Skills](https://cybernoz.com/the-prompt-airlines-ctf-test-your-ai-security-skills/) - In this challenge, you'll interact with a chatbot acting as the customer service for the fictional Prompt Airlines. Your goal is to find and exploit vulnerabilities in the AI's logic to trick it into giving you a free flight ticket. The entire challenge is conducted through chatbot interaction - no coding or technical skills required!Each
- [Using LLMs to summarize user sessions](https://cybernoz.com/using-llms-to-summarize-user-sessions/) - Using LLMs to summarize user sessions With the introduction of the AI Assistant into the Security Solution in 8.8, the Security Machine Learning team at Elastic has been exploring how to optimize Security operations with LLMs like GPT-4. User session summarization seemed like the perfect use case to start experimenting with for several reasons: User
- [Microsoft says some users can’t open the Teams desktop client](https://cybernoz.com/microsoft-says-some-users-cant-open-the-teams-desktop-client/) - Microsoft is working to resolve a known issue that causes delays or blocks some users from opening the Microsoft Teams desktop client on Windows systems. The company acknowledged this known issue (tracked as TM1466820) at 16:45 EDT on Thursday and advised affected customers to work around it by using the web or mobile platforms. "Specifically,
- [Everything Victims Type and Steal Their Screenshots](https://cybernoz.com/everything-victims-type-and-steal-their-screenshots/) - NodeStealer has returned with a more invasive toolkit. The Python-based information stealer can now record keystrokes, watch copied text, and capture victims’ screens, turning an account-stealing infection into continuous surveillance. The change raises the stakes for people whose browsers hold work, banking, or social-media access. First tracked in 2023, NodeStealer initially focused on sensitive browser
- [Compliance teams have gone continuous, but their evidence-gathering hasn't caught up](https://cybernoz.com/compliance-teams-have-gone-continuous-but-their-evidence-gathering-hasnt-caught-up/) - The perception that compliance is a once-a-year scramble is out of date, according to a new survey of 201 security and compliance practitioners published by Pentest-Tools.com. The research finds that continuous compliance has effectively already arrived inside most organisations, but the automation needed to support it has not. The study, carried out in July 2026
- [NodeStealer Spyware Adds Keylogging, Screenshot Capture and Facebook Data Theft](https://cybernoz.com/nodestealer-spyware-adds-keylogging-screenshot-capture-and-facebook-data-theft/) - A major upgrade to the Python-based NodeStealer malware, transforming the Facebook-focused infostealer into a broader spyware platform capable of logging keystrokes, monitoring clipboard data, capturing screenshots, and harvesting extensive Facebook profile information. The newly observed variant, identified in August 2026, also expands browser and local data theft, using a split Telegram command-and-control (C2) design to
- [OpenAI is putting $1 billion behind Daybreak for defenders working without enterprise budgets](https://cybernoz.com/openai-is-putting-1-billion-behind-daybreak-for-defenders-working-without-enterprise-budgets/) - OpenAI committed $1 billion to subsidize access to its Daybreak cyber models, along with training and technical support, for organizations defending water and wastewater systems, the electric grid, state and local government, community and regional banks, nonprofits, and open-source projects. The company is starting in the United States and intends to extend the offer to
- [New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic](https://cybernoz.com/new-ted-backdoor-hides-inside-victims-own-haproxy-builds-to-intercept-web-traffic/) - A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the binary. It is not a HAProxy vulnerability, and installing it
- [Humans have edge over AI in Dutch hacking contest](https://cybernoz.com/humans-have-edge-over-ai-in-dutch-hacking-contest/) - Humans still have the edge over artificial intelligence (AI) in finding software vulnerabilities that criminals can use to breach critical computer defences, according to the security chief preparing a hacking competition for The Hague. The city municipality announced the return of its hacking competition after a two-year hiatus in July, just as US artificial intelligence
- [OpenAI Pledges $1 Billion to Bring Frontier AI to Critical Infrastructure Defenders](https://cybernoz.com/openai-pledges-1-billion-to-bring-frontier-ai-to-critical-infrastructure-defenders/) - Daybreak is OpenAI’s continuously running agentic loop that brings the power of frontier AI to simplify complex security investigations, validation, remediation and reporting. The earlier Daybreak Blue supports common defensive work with OpenAI mainline models; while Daybreak Red gives approved organizations access to specialized cyber models for more sensitive and technically demanding work. The new
- [Cliff's Notes for Everything | Daniel Miessler](https://cybernoz.com/cliffs-notes-for-everything-daniel-miessler/) - There's something really interesting about the connection between reading fiction and working with AI.Why do we read a fiction book?Let's make a list of reasons. And ask some questions.First, are we trying to get to the end of the book? Is that a goal?Or in my robots in the gym language, is this moving work
- [OpenAI pledges $1 billion to provide resources, training for frontline cyber defenders](https://cybernoz.com/openai-pledges-1-billion-to-provide-resources-training-for-frontline-cyber-defenders/) - Amid heightened scrutiny, the company will use frontier AI to help water, power and local government providers fight malicious actors. Source link
- [European parliament members call for slowdown of Serbia’s EU entry over spyware use](https://cybernoz.com/european-parliament-members-call-for-slowdown-of-serbias-eu-entry-over-spyware-use/) - A group of European Parliament representatives are seeking to delay Serbia’s entry into the European Union and send other messages to Belgrade over the government’s usage of spyware. The 29 members of the European Parliament (MEPs) cited a report this week from the SHARE Foundation about spyware found on the phones of Serbian student activists
- [The democratization of cyber warfare — and what it means for CISOs](https://cybernoz.com/the-democratization-of-cyber-warfare-and-what-it-means-for-cisos/) - Democratization of war is not a new trend. The firearm was itself a democratizing technology, dramatically reducing the skill and physical barriers required to inflict lethal force on an adversary — so was the crossbow before that, and others before that. Those technologies enabled new techniques and expanded existing ones, including forms of irregular warfare
- [OpenAI agents discussed ways to escape their sandbox on public wiki](https://cybernoz.com/openai-agents-discussed-ways-to-escape-their-sandbox-on-public-wiki/) - Self-identifying OpenAI agents posted 18,000 messages to a public wiki that discussed ways for other agents to bypass security sandbox restrictions during what was likely internal testing designed to gauge the agents’ hacking abilities, researchers said Friday. In all, agents with 3,700 distinct self-given names posted the messages to German site DSEwiki over a six-week
- [Mastering cloud security with custom roles: one more step towards democratization](https://cybernoz.com/mastering-cloud-security-with-custom-roles-one-more-step-towards-democratization/) - In the ever-evolving landscape of cloud security, managing user permissions can be a complex task. Often, you may find yourself granting more permissions than necessary, leading to potential security risks. Additionally, maintaining these complex roles over time and keeping up with changes made by vendors can be daunting. Enter Custom Roles, a new feature by
- [Using LLMs and ESRE to find similar user sessions](https://cybernoz.com/using-llms-and-esre-to-find-similar-user-sessions/) - Using LLMs and ESRE to find similar user sessions In our previous article, we explored using the GPT-4 Large Language Model (LLM) to condense complex Linux user sessions into concise summaries. We highlighted the key takeaways from our experiments, shedding light on the nuances of data preprocessing, prompt tuning, and model parameter adjustments. In the
- [Critical Citrix NetScaler auth bypass now leveraged in attacks](https://cybernoz.com/critical-citrix-netscaler-auth-bypass-now-leveraged-in-attacks/) - Attackers have begun targeting a critical-severity Citrix NetScaler flaw in the wild, according to vulnerability intelligence company Previdian. Tracked as CVE-2026-19490, this security flaw can allow unprivileged threat actors to bypass authentication remotely when the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy),
- [Hackers Use Popular Messaging Services to Control New Windows Backdoors](https://cybernoz.com/hackers-use-popular-messaging-services-to-control-new-windows-backdoors/) - A financially motivated threat group known as Toy Ghouls has begun using two custom Windows backdoors that communicate through popular messaging and broker services. The tools give attackers a discreet way to run commands, collect system details, and maintain control over compromised devices. The campaign marks a change for the group, which had previously relied
- [Q&A: Dr. Gil Baram - IT Security Guru](https://cybernoz.com/qa-dr-gil-baram-it-security-guru/) - An AI-assisted platform has been used to test whether Viasat’s satellite communications links can meet operational thresholds under interference and adversarial jamming. Announced this month, the work with Atalanta has renewed scrutiny of the vulnerabilities exposed by Russia’s 2022 attack on Viasat’s KA-SAT network, which disrupted communications across Ukraine and several European countries. Gil Baram,
- [OpenAI Agents Collude on Public Wiki to Share Sandbox Bypass and Evasion Techniques](https://cybernoz.com/openai-agents-collude-on-public-wiki-to-share-sandbox-bypass-and-evasion-techniques/) - Researchers have discovered a public wiki message board that they claim was used by autonomous AI agents, identifying themselves as OpenAI systems, to exchange answers to tasks, inspect their operating environment, and discuss methods to circumvent sandbox controls. This finding, published on September 4 by Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas
- [Scammers have figured out the best time to text you](https://cybernoz.com/scammers-have-figured-out-the-best-time-to-text-you/) - The suspicious calls, texts, and DMs you got recently aren’t a coincidence, according to Malwarebytes. Scammers have worked out which platform gets them the best results for each type of con, and they stick to that formula. (Source: Malwarebytes) The company looked at its own threat data collected between April 15 and July 14, 2026,
- [The hidden work of modernizing Malwarebytes](https://cybernoz.com/the-hidden-work-of-modernizing-malwarebytes/) - Most of the work that keeps a security product trustworthy is invisible. Users see a scan complete, a threat blocked, an update applied overnight. They don’t see the platform underneath. Runtimes, managed libraries, native drivers, and Windows requirements must all stay current and work together across millions of endpoints. Our migration to .NET 10 is
- [PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution](https://cybernoz.com/postgresql-fixes-12-year-old-logical-decoding-flaw-enabling-replication-role-code-execution/) - PostgreSQL has released updates to address a security flaw that allows an account with the REPLICATION attribute to run arbitrary code as the operating-system user running the database server. The flaw, tracked as CVE-2026-6471 (CVSS score: 7.2), has been present since logical decoding was introduced in PostgreSQL 9.4 in 2014. Versions before PostgreSQL 18.6, 17.11,
- [Digital twins bill to be debated in Parliament](https://cybernoz.com/digital-twins-bill-to-be-debated-in-parliament/) - A bill to crack down on the creation of digital twins of real people by tech companies is to be debated in the House of Commons. Initially proposed by Science, Innovation and Technology Committee chair Dame Chi Onwurah, the Personal Data (Digital Twin) Bill, also known as the ‘There Is Only One Me’ Bill, will
- [State of Security 2026: Cloud Security](https://cybernoz.com/state-of-security-2026-cloud-security/) - The shift to the cloud has relieved organisations of the complexity of managing their own infrastructure, but it has introduced an entirely new set of challenges. As CISOs look out across technology landscapes that span multiple public clouds, hybrid environments, and SaaS providers, they face the need to maintain the security of a complex and
- [HPE Patches Critical RCE Vulnerabilities in AOS-CX](https://cybernoz.com/hpe-patches-critical-rce-vulnerabilities-in-aos-cx/) - Hewlett Packard Enterprise (HPE) has released patches for 34 CVEs in the Aruba Networking ArubaOS-CX (AOS-CX) platform, including critical-severity remote code execution (RCE) flaws. Per HPT’s advisory, more than 150 flaws were resolved in AOS-CX versions 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, and 10.10.1181. Many of these bugs are tracked together under single CVEs. Nearly two dozen
- [Crooks Behind Manchester Airports Group Hack Leaked Data of 8.8 Million People](https://cybernoz.com/crooks-behind-manchester-airports-group-hack-leaked-data-of-8-8-million-people/) - Crooks Behind Manchester Airports Group Hack Leaked Data of 8.8 Million People Pierluigi Paganini September 04, 2026 Manchester Airports Group (MAG) data allegedly leaked by FulcrumSec exposes emails and phone numbers of 8.8 million people. Manchester Airports Group, which operates Manchester, London Stansted and East Midlands airports, has confirmed a data breach involving customer information
- [Socratic AI | Daniel Miessler](https://cybernoz.com/socratic-ai-daniel-miessler/) - So it's an AI that they're allowed to use after they're done doing their work or after they've already gotten to a pretty decent place by themselves.But the trick is that the AI doesn't really provide answers to them. All it does is ask them questions that help illuminate things so that they can do
- [Nvidia’s $12.9B Hugging Face deal could benefit enterprises](https://cybernoz.com/nvidias-12-9b-hugging-face-deal-could-benefit-enterprises/) - The chipmaker’s acquisition could eventually bring additional security resources and model evaluation tools to the platform, according to experts. Source link
- [Bidding war for defunct Spirit Airlines’ employee data will not die](https://cybernoz.com/bidding-war-for-defunct-spirit-airlines-employee-data-will-not-die/) - The destiny of Spirit Airline’s data is still undecided, months after the company sought bankruptcy protection. AI data company Micro1 has now offered $12.5 million to acquire a trove of the company’s emails, Teams chats, operations and employee productivity data, according to a report by aviation website Simply Flying, It said the data includes about
- [Once popular for attacking AI, ASCII smuggling is embraced by spammers](https://cybernoz.com/once-popular-for-attacking-ai-ascii-smuggling-is-embraced-by-spammers/) - A clever technique used to hide malicious prompts in attacks on AI agents has been adopted by spammers to evade filters on email platforms that are designed to flag unwanted messages used in mass campaigns. The technique is broadly known as ASCII smuggling. It gained attention two years ago as a means of making a
- [Dissecting Gartner’s CNAPP Market Guide – Key Takeaways](https://cybernoz.com/dissecting-gartners-cnapp-market-guide-key-takeaways/) - What differentiates CNAPP offerings? What value do these solutions deliver to security and development teams? How is the CNAPP landscape evolving, and which aspects should cloud security leaders focus on? We believe these questions are the primary focus of the latest Gartner Market Guide for Cloud-Native Application Protection Platforms, which helps security and risk management leaders
- [Streamlining ES|QL Query and Rule Validation: Integrating with GitHub CI](https://cybernoz.com/streamlining-esql-query-and-rule-validation-integrating-with-github-ci/) - One of the amazing, recently premiered 8.11.0 features, is the Elasticsearch Query Language (ES|QL). As highlighted in an earlier post by Costin Leau, it’s a full-blown, specialized query and compute engine for Elasitcsearch. Now that it’s in technical preview, we wanted to share some options to validate your ES|QL queries. This overview is for engineers
- [IDScan sued over alleged data breach affecting 153 million drivers](https://cybernoz.com/idscan-sued-over-alleged-data-breach-affecting-153-million-drivers/) - Multiple lawsuits have been filed against identity verification company IDScan after hackers allegedly breached the service and offered to sell more than 153 million driver’s licenses. Several law firms, including Markovits, Stock & DeMarco, and Hall Attorneys, have also launched investigations into potential class-action litigation related to the reported security incident at IDScan. Brian Krebs
- [Microsoft Unveils Project Zenith Windows PCs That Can Run 30B+ AI Models Locally](https://cybernoz.com/microsoft-unveils-project-zenith-windows-pcs-that-can-run-30b-ai-models-locally/) - Microsoft has introduced Project Zenith, a new developer-optimized Windows 11 experience built for a class of high-memory PCs capable of running large AI models directly on-device, marking a significant shift away from cloud-dependent AI development workflows. Announced as a follow-up to commitments made at Build 2026, Project Zenith targets developer-class hardware equipped with at least
- [AI is finding vulnerabilities faster. Who is funding the people expected to fix them?](https://cybernoz.com/ai-is-finding-vulnerabilities-faster-who-is-funding-the-people-expected-to-fix-them/) - Artificial intelligence is changing vulnerability discovery. At OpenSSL, we are seeing that change first-hand. A year ago, our security address received around nine separate reports and enquiries a month. It now receives around 70. AI tools can examine source code and identify potential security issues at a scale that would previously have required significant human
- [Hackers Turn HiveMQ and Element Messenger Into Control Channels for Windows Backdoors](https://cybernoz.com/hackers-turn-hivemq-and-element-messenger-into-control-channels-for-windows-backdoors/) - The financially motivated threat actor Toy Ghouls has expanded its custom malware arsenal with two Windows backdoors that abuse HiveMQ’s public MQTT infrastructure and the Matrix-based Element messaging ecosystem for command-and-control communications. The development marks a notable evolution for the group, which previously leaned on publicly available tools and leaked ransomware builders before introducing its
- [Early Bird Registration For Black Hat Europe 2026 In London](https://cybernoz.com/early-bird-registration-for-black-hat-europe-2026-in-london/) - Black Hat Europe returns to the Excel in London with a four-day program, Dec. 7-10. The event will open with two-and four-day options of specialized cybersecurity Trainings, with courses of all skill levels. The two-day main conference on Dec. 9 and 10 boasts Briefings featuring the latest in research, developments, and trends in cybersecurity, along with
- [Microsoft Teams is about to make QR code phishing much harder](https://cybernoz.com/microsoft-teams-is-about-to-make-qr-code-phishing-much-harder/) - Microsoft is preparing a new feature for Teams users that will help them stay safe from QR code phishing. Teams will automatically hide QR codes sent by people outside the organization. Users will need to reveal the image first before they can view or scan it. It’s currently in development, with rollout expected to begin
- [X Money rollout linked to password-reset attacks](https://cybernoz.com/x-money-rollout-linked-to-password-reset-attacks/) - X says attackers may be targeting accounts because its X Money payments service is now more widely available. The company is investigating a wave of unsolicited password-reset emails sent to users. While their arrival alongside the wider X Money rollout has fueled account-takeover concerns, X says it has found no evidence of a breach or
- [Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters](https://cybernoz.com/phishing-campaign-sends-millions-of-emails-using-invisible-unicode-to-evade-filters/) - Microsoft is alerting of a "high-volume phishing campaign" that's using invisible Unicode tag characters to bypass email filters. "Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as 'funding' to prevent email filters from parsing them," the Microsoft
- [US senator Bernie Sanders calls for ban on AI superintelligence](https://cybernoz.com/us-senator-bernie-sanders-calls-for-ban-on-ai-superintelligence/) - Two more bills seeking to control the spread and activity of artificial intelligence (AI) – one of them by former presidential candidate and Independent senator Bernie Sanders – will go before American lawmakers in the near future. Sanders’ Ban Artificial Superintelligence Act, co-authored by Greg Cesar, a Democratic representative from Texas, will seek to “stop
- [Pegasus, New NoviSpy Variant Found On Serbian Students](https://cybernoz.com/pegasus-new-novispy-variant-found-on-serbian-students/) - At least 14 people connected to Serbia’s student protest movement and opposition politics have been targeted with mercenary spyware since early 2026, the Belgrade-based digital rights organization SHARE Foundation said, in what it called the largest documented wave of such targeting in the country. The group said the cohort includes student movement members, civil society
- [CBI Raids 89 Places Across 20 States In Digital Arrest Cases](https://cybernoz.com/cbi-raids-89-places-across-20-states-in-digital-arrest-cases/) - India’s Central Bureau of Investigation searched 89 locations across 20 states in three digital arrest fraud cases and arrested three people accused of moving the stolen money, the agency said. The searches were conducted under Operation Chakra-VI, the agency’s ongoing cybercrime enforcement programme. All three cases were transferred to the CBI from state police forces.
- [Firmus invests US$300m in SUBCO's APX East](https://cybernoz.com/firmus-invests-us300m-in-subcos-apx-east/) - Key points Firmus Technologies has signed a US$300 million ($416 million) agreement with SUBCO, securing rights to 150Tbps of capacity on the APX East subsea cable system for at least 25 years. APX East is expected to become operational in late 2028 and will be Australia's first direct link to the US, as well as
- [In Other News: Microsoft’s Cloud Patches, Hacked Dropbox Accounts, Guardio’s $1.1B Valuation](https://cybernoz.com/in-other-news-microsofts-cloud-patches-hacked-dropbox-accounts-guardios-1-1b-valuation/) - SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers maintain a well-rounded awareness of
- [PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover](https://cybernoz.com/postgresql-hit-by-12-year-old-vulnerability-allowing-server-takeover/) - PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover Pierluigi Paganini September 04, 2026 PostGREShell (CVE-2026-6471) is a 12-year-old PostgreSQL flaw that lets low-privileged attackers execute code and take over servers. Cyera researchers found a severe PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471 (CVSS score of 7.2). Present in releases dating back to 2014, the
- [FBI investigates breach of 153 million driving license records at IDscan.net](https://cybernoz.com/fbi-investigates-breach-of-153-million-driving-license-records-at-idscan-net/) - Drivers in North America received a nasty shock this week when it was revealed that digital scans of 153 million drivers’ licenses were for sale on the dark web. Among the victims were US Defense Secretary Pete Hegseth – and investigative reporter Brian Krebs, who has dug deep into the data breach on his blog
- [Moscow-based F6 reports manufacturing as top cyberattack target, as 80% of industrial firms face security staffing shortage](https://cybernoz.com/moscow-based-f6-reports-manufacturing-as-top-cyberattack-target-as-80-of-industrial-firms-face-security-staffing-shortage/) - Data from Russian cybersecurity firm F6 identified that manufacturing is the top target for cyberattacks in 2026, while about 80% of companies, including critical information infrastructure facilities, face a shortage of qualified information security personnel. It revealed that filling a single cybersecurity vacancy can take several months, while building a 24/7 security team from scratch
- [Cognizant, CrowdStrike expand collaboration with OT cybersecurity service for converged IT and OT environments](https://cybernoz.com/cognizant-crowdstrike-expand-collaboration-with-ot-cybersecurity-service-for-converged-it-and-ot-environments/) - Cognizant and CrowdStrike announced an expanded collaboration to introduce Cognizant Cybersecurity for Operational Technology, an OT (operational technology) security service powered by CrowdStrike Falcon for XIoT. The service combines Cognizant’s industrial engineering expertise and managed security operations with CrowdStrike’s unified visibility and protection across XIoT and IT environments designed to help protect mission-critical assets. As
- [Wiz's Approach to Physical Security & Enterprise Resilience](https://cybernoz.com/wizs-approach-to-physical-security-enterprise-resilience/) - In this blog we’ll look at how our internal Wiz team secures not just the digital realm but the physical one as well, as it’s a core part of our commitment to earning the trust of our customers, partners, and Wizards. Physical security at Wiz means ensuring the safety of our people and safeguarding our
- [Recorded Future Announces Automated Signature Creation, Accelerating Vulnerability Prioritization](https://cybernoz.com/recorded-future-announces-automated-signature-creation-accelerating-vulnerability-prioritization/) - Today, Recorded Future is announcing Automated Signature Creation, a new capability in Attack Surface Intelligence (ASI) to combat the speed of AI-generated exploits. ASI continuously maps an organization’s external exposure, correlates newly surfaced vulnerabilities with real-world threat intelligence, and prioritizes response to enable defenders to remediate before adversaries can act. This new function within ASI
- [SIEM data export: how six vendors compare](https://cybernoz.com/siem-data-export-how-six-vendors-compare/) - Your security data is the most important asset in your SOC. Not the dashboards, not the detections, not the AI features on the roadmap slide. The data. And most vendors make you pay, wait, or license your way to getting it back out. Every investigation your analysts run, every model you train, every agent you
- [New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges](https://cybernoz.com/new-crowdstrike-falconflank-zero-day-grants-system-privileges/) - An anonymous security researcher who uses the "Nightmare Eclipse" handle released a CrowdStrike Falcon zero-day exploit named "FalconFlank" that lets attackers escalate privileges on up-to-date Windows systems. Nightmare Eclipse says the new vulnerability (which has yet to be assigned a CVE ID) affects devices running the latest versions of Windows 11 and Windows Server, as
- [Hackers Turn Claude, Qwen and DeepSeek Into AI Agents for Real-World Cyberattacks](https://cybernoz.com/hackers-turn-claude-qwen-and-deepseek-into-ai-agents-for-real-world-cyberattacks/) - Hackers have turned commercial AI models into working parts of a cyberattack operation. The campaign paired AI-directed tasking with familiar methods such as vulnerable public-facing servers, stolen credentials, webshells, and custom remote-access malware. The operation reached Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, and government and education networks in mainland China. A
- [KnowBe4 to Put AI Trust to the Test at Leeds Digital Festival](https://cybernoz.com/knowbe4-to-put-ai-trust-to-the-test-at-leeds-digital-festival/) - KnowBe4 is set to explore the growing challenge of determining what organisations can trust in the age of AI at an exclusive cybersecurity briefing during Leeds Digital Festival 2026. Taking place on 1 October, CyberSecure Leeds: Who Do You Trust Now? Human Judgement in the Age of AI will examine how the growing role of
- [ICE Wants to Know Everyone Who Bought a Certain Green Beanie From REI in the Last 2 Years](https://cybernoz.com/ice-wants-to-know-everyone-who-bought-a-certain-green-beanie-from-rei-in-the-last-2-years/) - Did you buy a beanie from REI recently? The Department of Homeland Security might be looking for you.New court filings allege that Homeland Security Investigations agents subpoenaed the outdoor retailer in March, requesting the transaction information for “all persons” in the greater Minneapolis–St. Paul area who had purchased a specific type of dark green beanie
- [ShipMonk Data Breach Exposes Personal Data of 67,000 Additional Trezor Customers](https://cybernoz.com/shipmonk-data-breach-exposes-personal-data-of-67000-additional-trezor-customers/) - Trezor has revealed that a data breach involving its fulfillment provider, ShipMonk, exposed personal and order information of approximately 67,000 additional US customers. This significantly broadens the scope of an incident initially reported in August. The newly identified data pertains to Trezor orders processed during a prior partnership with ShipMonk, which lasted from November 2019
- [Google patches actively exploited Chrome zero-day (CVE-2026-85046)](https://cybernoz.com/google-patches-actively-exploited-chrome-zero-day-cve-2026-85046/) - Google has patched 12 vulnerabilities affecting its popular Chrome browser, among them CVE-2026-85046, which has been exploited in the wild. “Google is aware that an exploit for CVE-2026-85046 exists in the wild,” the company said in a Thursday security advisory. The fix has been shipped in Chrome 152.0.7977.82/.83 for Windows and macOS and Chrome 152.0.7977.82
- [Free streaming boxes may be routing criminal traffic through your home](https://cybernoz.com/free-streaming-boxes-may-be-routing-criminal-traffic-through-your-home/) - “Free” movies and TV could cost you your privacy, bandwidth, and control of your home network. We’ve warned about illegal streaming and modded Amazon Fire TV Sticks in the past. Now, researchers have found that certain SuperBox devices and apps could quietly enroll a household connection into a proxy network, allowing third parties to route
- [Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws](https://cybernoz.com/over-440000-exploit-attempts-target-super-forms-and-elementor-pro-rce-flaws/) - Ravie LakshmananSep 04, 2026Vulnerability / Web Security Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are - CVE-2026-14894 (CVSS score: 9.8) - A missing file type validation vulnerability in Super Forms – Drag & Drop Form Builder that
- [Snowflake pivots to AI platforming](https://cybernoz.com/snowflake-pivots-to-ai-platforming/) - Artificial intelligence (AI) has moved past the initial stages of the gold rush. In a scramble to avoid getting lost in the noise surrounding the generative AI hyperbole, IT suppliers hurried to extol the virtues of their data-enabled products. Now, following that first stage of the gold rush, technology companies are focused squarely on stage
- [The Cyber Express Weekly Roundup: Claude, PaperCut & Citrix](https://cybernoz.com/the-cyber-express-weekly-roundup-claude-papercut-citrix/) - This weekly roundup highlights a range of cybersecurity developments affecting artificial intelligence platforms, enterprise software, healthcare organizations, social media accounts, and internet-facing infrastructure. From stolen Claude sessions and bypassed PaperCut security fixes to an attempted attack targeting hundreds of thousands of X users, recent incidents demonstrate how attackers continue to exploit both software vulnerabilities and
- [Tabcorp appoints new CISO - iTnews](https://cybernoz.com/tabcorp-appoints-new-ciso-itnews/) - Key points Tabcorp has named Maxine Harrison as its new chief information security officer, following the former leader's departure in July. Harrison most recently served as CISO at the Victorian Government's Department of Energy, Environment and Climate Action for almost three-and-a-half years. She replaces Josh Kam, who held the CISO role before becoming chief security
- [VMware Workstation and Fusion Updates Patch Critical Vulnerability](https://cybernoz.com/vmware-workstation-and-fusion-updates-patch-critical-vulnerability/) - Broadcom on Thursday announced patches for two critical and high-severity vulnerabilities in VMware Workstation and Fusion. The first issue, tracked as CVE-2026-59346 (CVSS score of 9.3), is described as an integer overflow bug leading to arbitrary code execution. “A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may
- [Chinese Hackers Use AI Agents in Multi-Country Cyber Campaign](https://cybernoz.com/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign/) - Chinese Hackers Use AI Agents in Multi-Country Cyber Campaign Pierluigi Paganini September 04, 2026 Hunt.io uncovered a Chinese-speaking campaign using AI agents to automate cyberattacks against Asian government, education and industrial targets. Threat intelligence firm Hunt.io just documented a second, separate China-linked campaign wiring commercial AI models directly into live cyberespionage operations, this time hitting
- [Why judgment is emerging as cybersecurity’s defining skill](https://cybernoz.com/why-judgment-is-emerging-as-cybersecuritys-defining-skill/) - AI is getting better at much of what security teams have long spent time on: analyzing information, identifying patterns, and providing technically sound recommendations quickly. As those capabilities become more routine, they are changing what security practitioners spend their time on. Reaching a technically sound recommendation is also getting easier, which puts more weight on
- [Why less visibility into how OpenAI’s new GPT-6 Astra ‘thinks’ is sparking safety concerns](https://cybernoz.com/why-less-visibility-into-how-openais-new-gpt-6-astra-thinks-is-sparking-safety-concerns/) - OpenAI’s new model, GPT-6 Astra, has less direct visibility into how a model thinks, a development that has sparked concerns coming just weeks after the Hugging Face hacking incident that required a Chinese open model to investigate, according to analysts.When announcing Astra on Thursday, OpenAI said it was “the world’s most intelligent and aligned model,”
- [ACSC warns of critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway](https://cybernoz.com/acsc-warns-of-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway/) - The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) has issued a critical alert for Australian organisations using Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway products, warning of two vulnerabilities and urging rapid patching. In an alert dated 4 September 2026, the ACSC said Citrix had identified the issues in NetScaler ADC
- [New backdoors from Toy Ghouls](https://cybernoz.com/new-backdoors-from-toy-ghouls/) - Introduction We continue tracking the activity of Toy Ghouls (also known as Bearlyfy, Laboo.boo, and Feral Wolf), a financially motivated group that has been targeting Russian organizations since 2025. The attackers initially relied exclusively on tools pulled from public GitHub repositories along with leaked Babuk and LockBit ransomware builders, later shifting to their own custom
- [OpenAI launches GPT-6 Astra, its first model to cross a critical cybersecurity threshold](https://cybernoz.com/openai-launches-gpt-6-astra-its-first-model-to-cross-a-critical-cybersecurity-threshold/) - Developers can access Astra in the API as gpt-6-astra or through Amazon Bedrock, OpenAI said, priced at $10 per million input tokens and $50 per million output tokens. Pro, Business, and Enterprise users also get a variant called Astra Pro, and the company said Astra supports Zero Data Retention for eligible API customers. Company claims
- [Booz Allen: AI models approaching autonomous cyberattack capability as critical infrastructure response windows narrow](https://cybernoz.com/booz-allen-ai-models-approaching-autonomous-cyberattack-capability-as-critical-infrastructure-response-windows-narrow/) - New research from Booz Allen found that testing of 18 U.S. and Chinese frontier AI models revealed that AI (artificial intelligence) is nearing the ability to conduct cyberattacks autonomously, raising concerns for critical infrastructure operators facing increasingly narrow windows to detect and respond to intrusions. The company’s Cyber Weapon Index found that one model, Anthropic’s
- [G7 urges governments, organizations to begin PQC transition, protect public key encryption from quantum threats](https://cybernoz.com/g7-urges-governments-organizations-to-begin-pqc-transition-protect-public-key-encryption-from-quantum-threats/) - The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the G7 Cybersecurity Working Group are urging governments and organizations to immediately begin transitioning to post-quantum cryptography, warning that quantum computing poses an urgent threat to current public-key encryption systems. The document focuses on risks posed by cryptographically relevant quantum computers (CRQCs), reaffirming collective efforts to
- [Introducing pattern-based agentless malware detection using YARA rules](https://cybernoz.com/introducing-pattern-based-agentless-malware-detection-using-yara-rules/) - Malware poses a critical threat to cloud environments, facilitating malicious activity by threat actors that results in compromise, data breach, or disruption in operations. According to SonicWall, there were 6.06 billion malware attacks in 2023, marking the highest global attack volume since 2019. That is why it is crucial to have malware scanning in place
- [STIXy Situations: ECSaping your threat data](https://cybernoz.com/stixy-situations-ecsaping-your-threat-data/) - Preamble Organizations that use threat indicators or observables consume, create, and/or (ideally) publish threat data. This data can be used internally or externally as information or intelligence to inform decision-making and event prioritization. While there are several formats for this information to be structured into, the de facto industry standard is Structured Threat Information Expression
- [Microsoft: KB5120998 mouse reset bug affects only non-English PCs](https://cybernoz.com/microsoft-kb5120998-mouse-reset-bug-affects-only-non-english-pcs/) - Microsoft says a known issue that reverts mouse settings after installing the KB5120998 August 2026 preview update affects only non-English Windows 11 systems. The bug was confirmed Friday, one day after the KB5120998 release, which includes Start menu, taskbar, and Windows search improvements for devices running Windows 11 versions 25H2 and 24H2. According to user
- [14 Fake macOS Installers Linked to DPRK Campaign Deliver Credential-Stealing RAT](https://cybernoz.com/14-fake-macos-installers-linked-to-dprk-campaign-deliver-credential-stealing-rat/) - Mac users are being targeted with 14 fake application installers that appear to offer familiar software but instead start a credential-stealing remote-access trojan. The files were distributed as macOS disk images and installer packages, giving attackers another route into systems used by developers and job seekers. The activity is tied to the long-running Contagious Interview
- [Microsoft 365 Direct Send Bypass Lets Attackers Spoof Internal Users Without Credentials](https://cybernoz.com/microsoft-365-direct-send-bypass-lets-attackers-spoof-internal-users-without-credentials/) - A Microsoft 365 email security-control bypass that lets attackers submit unauthenticated messages posing as internal users by leaving one SMTP field blank. The technique targets Exchange Online’s RejectDirectSend setting and does not represent a vulnerability in Microsoft software or in ReliaQuest systems; instead, it exposes a limitation in how the control evaluates Direct Send traffic.
- [A five-part inventory for your AI agent credentials](https://cybernoz.com/a-five-part-inventory-for-your-ai-agent-credentials/) - In this Help Net Security video, Roy Katmor, co-founder and CEO of Orchid, explains why AI agents hold credentials that nobody reviews. Organizations build agents in AI studios, connect them to enterprise tools, and give them accounts to do useful work. The agent is approved, the studio is approved, but the identities behind them sit
- [US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries](https://cybernoz.com/us-becomes-top-target-in-rmm-phishing-campaign-spanning-46-countries/) - The Hacker NewsSep 03, 2026Social Engineering / Malware An RMM phishing campaign initially associated with Canadian targeting due to its use of Canada Revenue Agency (CRA) tax forms as lures has turned out to be part of a broader campaign spanning 46 countries. Around 45% of observed activity was associated with the United States, making
- [Oracle executive chairman Larry Ellison called to testify over US health system overspend](https://cybernoz.com/oracle-executive-chairman-larry-ellison-called-to-testify-over-us-health-system-overspend/) - The US House Committee for Veterans’ Affairs (VA) has unanimously passed a motion that will mean Oracle executive chairman and chief technology officer, Larry Ellison, and the company’s current CEO, Mike Sicilia, will be called to testify over overspend on a major electronic healthcare records system. Wednesday’s House Committee on Veterans’ Affairs oversight hearing on
- [Citrix NetScaler Vulnerabilities Prompt Patch Warning](https://cybernoz.com/citrix-netscaler-vulnerabilities-prompt-patch-warning/) - Two Citrix NetScaler vulnerabilities affecting Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway products have prompted a patching warning for Australian organisations. The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) has advised organisations using the products to assess their environments and apply available security updates as a priority. Citrix has identified
- [Kentucky Appellate Court Data Compromised In C-Track Breach](https://cybernoz.com/kentucky-appellate-court-data-compromised-in-c-track-breach/) - The Kentucky Administrative Office of the Courts (AOC) has confirmed that Kentucky Appellate Court data was compromised in a cybersecurity breach traced to a third-party vendor. West Publishing Corporation, operating as Thomson Reuters Court Management Solutions (Thomson Reuters CMS), informed the AOC that the incident originated within file systems tied to its C-Track case management
- [Coles to end data analytics work with Palantir](https://cybernoz.com/coles-to-end-data-analytics-work-with-palantir/) - Key points Coles Group is ending its three-year data and analytics partnership with Palantir Technologies, which covered rostering, store operations and supply chain planning across more than 840 stores. Advocacy group GetUp! claimed the cessation as a win for a year-long campaign, which gathered 86,000 petition signatures over ethics and surveillance concerns. Coles disputed characterisations
- [HiddenLayer Raises $100 Million for AI Runtime Security](https://cybernoz.com/hiddenlayer-raises-100-million-for-ai-runtime-security/) - AI security company HiddenLayer on Wednesday announced raising $100 million in a Series B funding round that brings the total raised by the company to over $155 million. Founded in 2022, Austin-based HiddenLayer secures the lifecycle of agentic, generative, and predictive AI applications, protecting agents from evolving threats. The company’s enterprise platform provides discovery, AI
- [2,000 Leaked Documents Reveal How Russia Turns Engineering Students Into GRU Cyber Operators](https://cybernoz.com/2000-leaked-documents-reveal-how-russia-turns-engineering-students-into-gru-cyber-operators/) - 2,000 Leaked Documents Reveal How Russia Turns Engineering Students Into GRU Cyber Operators Pierluigi Paganini September 03, 2026 2,000 leaked files expose Bauman University’s hidden Department No. 4, which trained GRU-linked hackers and propagandists linked to APT28 and Sandworm. Leaked Documents Expose Bauman University’s Hidden Department That Trained Hackers, Propagandists, and Malware Developers for the
- [Peak Human Readership | Daniel Miessler](https://cybernoz.com/peak-human-readership-daniel-miessler/) - We may have already passed the point where most humans read anything that takes real focusSeptember 3, 2026by Daniel Miessler Fascinating-ing…Struck by kind of a weird feeling.I feel like people who write or create art or basically produce content for humans to read might be very sad soon.I think there's a good chance that we've already
- [CISO vs. CSO: Rethinking cybersecurity leadership](https://cybernoz.com/ciso-vs-cso-rethinking-cybersecurity-leadership/) - That creates a powerful combination. The CSO provides the top-down, cross-functional influence. The CISO provides the technical depth and delivery capability. Neither role has to pretend to be the other, and together, they can create something that the current model often struggles to provide: Executive ownership of the business protection agenda combined with genuine technical
- [Celebrating a Milestone: 100 WIN Integrations and Counting!](https://cybernoz.com/celebrating-a-milestone-100-win-integrations-and-counting/) - As an open security platform, integrations are a cornerstone of Wiz and the modern cloud security operating model that our CNAPP enables. They are essential for reducing risk, improving efficiency, and fostering an open cloud security ecosystem. That's why, about a year ago, we launched the Wiz Integration (WIN) platform to enable Independent Software Vendors
- [Unveiling malware behavior trends | Elastic Security Labs](https://cybernoz.com/unveiling-malware-behavior-trends-elastic-security-labs/) - Preamble When prioritizing detection engineering efforts, it's essential to understand the most prevalent tactics, techniques, and procedures (TTPs) observed in the wild. This knowledge helps defenders make informed decisions about the most effective strategies to implement - especially where to focus engineering efforts and finite resources. To highlight these prevalent TTPs, we analyzed over 100,000
- [Coder's registry infrastructure compromised to push malicious modules](https://cybernoz.com/coders-registry-infrastructure-compromised-to-push-malicious-modules/) - Attackers compromised Coder’s Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code. The Coder platform enables organizations to provide developers with secure, self-hosted cloud development environments for building and deploying software, including AI applications. The project is used by prominent private and government organizations, including Dropbox, Palantir, Square, Mercedes-Benz,
- [OpenAI GPT-6 Astra Discovers Zero-Day Flaws and Builds Working Exploits in Cyber Tests](https://cybernoz.com/openai-gpt-6-astra-discovers-zero-day-flaws-and-builds-working-exploits-in-cyber-tests/) - OpenAI has unveiled GPT-6 Astra, a frontier AI model the company says can identify zero-day vulnerabilities and create working proof-of-concept exploits during authorized cybersecurity tests. Announced on September 3, 2026, the model’s release brings offensive-security automation into sharper focus as AI systems gain stronger computer-use, browsing, and software-engineering capabilities. Astra achieved a reported 100% score
- [Prediction Market Betting Is Getting People Banned and Arrested](https://cybernoz.com/prediction-market-betting-is-getting-people-banned-and-arrested/) - Leah Feiger: All right. Do you guys remember George Santos?Brian Barrett: How could I forget?Zoë Schiffer: Absolutely do, but wow, did not expect we would be talking about him again this soon, I have to say.Leah Feiger: Former US representative expelled from Congress in 2023, accused of fraud and theft, and doing it with such
- [Rogue ScreenConnect Clients Spread Worm-Like Malware Across Connected Windows Systems](https://cybernoz.com/rogue-screenconnect-clients-spread-worm-like-malware-across-connected-windows-systems/) - A malicious ScreenConnect campaign in which rogue remote-access clients do more than provide attackers with hands-on control: modified clients can automatically push a multi-stage VBScript malware chain to newly connected Windows endpoints. Once deployed, the clients repeatedly spawned wscript.exe to execute four scripts 1.vbs, 2.vbs, 3.vbs, and 4.vbs from ScreenConnect-related temporary locations. The behavior is
- [Researchers built a $7 gadget for anyone paranoid about hidden cameras in hotel rooms](https://cybernoz.com/researchers-built-a-7-gadget-for-anyone-paranoid-about-hidden-cameras-in-hotel-rooms/) - Most of us, staying in a hotel room or a vacation rental, have wondered at least once whether we’re safe there, whether someone might be watching or recording us without our knowledge. The thought alone leaves a bitter taste in the mouth. A team from the Korea Advanced Institute of Science and Technology (KAIST), working
- [Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data](https://cybernoz.com/thomson-reuters-court-software-breach-may-have-exposed-ssns-and-sealed-data/) - Thomson Reuters disclosed on Wednesday that an unauthorized party obtained files from C-Track, the court case management platform sold by its West Publishing Corporation unit, in March 2026, affecting courts in 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. West Publishing said it discovered the activity on June 30, 2026. A subset of
- [Interview: Oracle accelerates Middle East cloud expansion as demand for sovereign AI rises](https://cybernoz.com/interview-oracle-accelerates-middle-east-cloud-expansion-as-demand-for-sovereign-ai-rises/) - As governments and enterprises across the Middle East adopt artificial intelligence (AI) at pace, cloud providers are increasingly being asked to deliver more than infrastructure. Organisations want access to advanced AI capabilities while maintaining control over data, meeting regulatory requirements and ensuring compliance with national sovereignty frameworks. For Oracle, this shift is shaping its investment
- [IAG builds AI into its HR service delivery](https://cybernoz.com/iag-builds-ai-into-its-hr-service-delivery/) - Key points IAG has moved from ServiceNow's conversational chatbot to its Now Assist AI suite to boost self-service deflection rates for HR queries. The insurer is reformatting about 730 HR knowledge base articles to be AI-optimised, with the work due to wrap up in September. Now Assist-based virtual agents delivered an average 67 percent deflection
- [Capsule Security Launches 'AI Circuit Breaker' to Stop Rogue Agents](https://cybernoz.com/capsule-security-launches-ai-circuit-breaker-to-stop-rogue-agents/) - Providing security against anomalous autonomous agents requires instantaneous detection, evaluation and action – a circuit breaker for AI rather than a circuit breaker for electricity. Such a ‘device’ has now been developed and released by Capsule Security. The firm was founded in 2025 by Naor Paz (CEO) and Lidan Hazout (CTO). They had seen how
- [Cisco Fixed Critical RCE in Nexus 9000 Series Switches](https://cybernoz.com/cisco-fixed-critical-rce-in-nexus-9000-series-switches/) - Cisco Fixed Critical RCE in Nexus 9000 Series Switches Pierluigi Paganini September 03, 2026 Cisco patched a critical Nexus 9000 vulnerability, CVE-2026-20212, allowing unauthenticated remote root code execution. Cisco has released patches for a critical flaw, tracked as tracked as CVE-2026-20212 (CVSS score of 9.8) in 10 Silicon One-based Nexus 9000 switches. The vulnerability could
- [Attackers exploit zero-days in consistently besieged SonicWall product](https://cybernoz.com/attackers-exploit-zero-days-in-consistently-besieged-sonicwall-product/) - SonicWall customers are grappling with yet another pair of actively exploited zero-day vulnerabilities in SonicWall SMA 1000 appliances, a product that’s been besieged with recurring defects and attacks over the past nine months. The vendor disclosed and released patches for the defects — CVE-2026-83548 and CVE-2026-83549 — and noted both were already actively exploited in
- [US urged to consider military strikes to stop China achieving AGI first](https://cybernoz.com/us-urged-to-consider-military-strikes-to-stop-china-achieving-agi-first/) - The United States should start preparing for scenarios where extreme measures must be taken to stop China from achieving artificial general intelligence (AGI), according to a former White House official, including state-backed espionage and military strikes on Chinese data centres.Jacob Stokes, deputy director of the Indo-Pacific Security Program at the Centre for a New American
- [Privacy reform is coming: Why businesses should act now, not after the Bill passes](https://cybernoz.com/privacy-reform-is-coming-why-businesses-should-act-now-not-after-the-bill-passes/) - The Attorney-General’s exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 would bring the most significant changes to the Privacy Act 1988 since the introduction of the Australian Privacy Principles, according to Holding Redlich General Counsel Lyn Nicholson. In comments provided to MySecurity Media, Nicholson said the reform direction is clear even if
- [OpenAI targets small utilities with $1 billion cyber defense initiative](https://cybernoz.com/openai-targets-small-utilities-with-1-billion-cyber-defense-initiative/) - Company CEO Sam Altman was in North Carolina yesterday, where he highlighted how OpenAI is partnering with cyber defenders to protect systems and services North Carolinians rely on. Last week, OpenAI led a coalition of now more than 150 organizations across cybersecurity, technology, critical infrastructure, finance, and AI in a call for collective action to
- [Confused about which VPN is right, US senator asks the NSA for guidance](https://cybernoz.com/confused-about-which-vpn-is-right-us-senator-asks-the-nsa-for-guidance/) - A prominent US senator is asking the National Security Agency to provide guidance to the general public on best practices for using virtual private networks to secure their communications from spying by foreign adversaries. VPNs funnel all of a user’s Internet traffic through an encrypted connection to a remote server. The design provides strong assurances
- [Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models](https://cybernoz.com/introducing-context-aware-vulnerability-discovery-and-remediation-with-cloudflare-managed-defense-and-openai-daybreak-models/) - Your scanner just flagged 4,000 new vulnerabilities, 78 of them critical. Which one do you fix first?To answer that question, Cloudflare is announcing early access to Vulnerability Discovery and Remediation, now part of Cloudflare Managed Defense. Vulnerability Discovery and Remediation is a new, invitation-only Cloudflare service that helps customers detect and mitigate vulnerabilities in their
- [Kernel ETW is the best ETW](https://cybernoz.com/kernel-etw-is-the-best-etw/) - Preamble A critical feature of secure-by-design software is the generation of audit logs when privileged operations are performed. These native audit logs can include details of the internal software state, which are impractical for third-party security vendors to bolt on after the fact. Most Windows components generate logs using Event Tracing for Windows (ETW). These

## Pages

- [CyberSecurity News](https://cybernoz.com/home/)
- [Contact](https://cybernoz.com/contact/)

## Categories

- [Genel](https://cybernoz.com/category/genel/) - Browse the latest Genel cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Bleeping Computer](https://cybernoz.com/category/bleeping-computer/) - Browse the latest Bleeping Computer cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [TheHackerNews](https://cybernoz.com/category/thehackernews/) - Browse the latest TheHackerNews cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [CyberSecurityNews](https://cybernoz.com/category/cybersecuritynews/) - Browse the latest CyberSecurityNews cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [PortSwigger](https://cybernoz.com/category/portswigger/) - Browse the latest PortSwigger cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [CyberDefenseMagazine](https://cybernoz.com/category/cyberdefensemagazine/) - Browse the latest CyberDefenseMagazine cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [ITSecurityGuru](https://cybernoz.com/category/itsecurityguru/) - Browse the latest ITSecurityGuru cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Krebson](https://cybernoz.com/category/krebson/) - Browse the latest Krebson cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Wired](https://cybernoz.com/category/wired/) - Browse the latest Wired cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [CyberNews](https://cybernoz.com/category/cybernews/) - Browse the latest CyberNews cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [ExploitOne](https://cybernoz.com/category/exploitone/) - Browse the latest ExploitOne cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [GBHackers](https://cybernoz.com/category/gbhackers/) - Browse the latest GBHackers cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [HackRead](https://cybernoz.com/category/hackread/) - Browse the latest HackRead cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [HackerCombat](https://cybernoz.com/category/hackercombat/) - Browse the latest HackerCombat cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [CyberSecurity-Insiders](https://cybernoz.com/category/cybersecurity-insiders/) - Browse the latest CyberSecurity-Insiders cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Cyber Security Ventures](https://cybernoz.com/category/cybersecurityventures/) - Browse the latest Cyber Security Ventures cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [HelpnetSecurity](https://cybernoz.com/category/helpnetsecurity/) - Browse the latest HelpnetSecurity cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [MalwareBytes](https://cybernoz.com/category/malwarebytes/) - Browse the latest MalwareBytes cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [ITnews](https://cybernoz.com/category/itnews/) - Browse the latest ITnews cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [TheCyberExpress](https://cybernoz.com/category/thecyberexpress/) - Browse the latest TheCyberExpress cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [DarkReading](https://cybernoz.com/category/darkreading/) - Browse the latest DarkReading cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [ComputerWeekly](https://cybernoz.com/category/computerweekly/) - Browse the latest ComputerWeekly cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Bankinfosecurity](https://cybernoz.com/category/bankinfosecurity/) - Browse the latest Bankinfosecurity cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Mix](https://cybernoz.com/category/mix/) - Browse the latest Mix cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [SecurityWeek](https://cybernoz.com/category/securityweek/) - Browse the latest SecurityWeek cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Securityaffairs](https://cybernoz.com/category/securityaffairs/) - Browse the latest Securityaffairs cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [CyberSecurityDive](https://cybernoz.com/category/cybersecuritydive/) - Browse the latest CyberSecurityDive cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Cyberscoop](https://cybernoz.com/category/cyberscoop/) - Browse the latest Cyberscoop cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [welivesecurity](https://cybernoz.com/category/welivesecurity/) - Browse the latest welivesecurity cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Agbi](https://cybernoz.com/category/agbi/) - Browse the latest Agbi cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [SCMP](https://cybernoz.com/category/scmp/) - Browse the latest SCMP cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Australiancybersecuritymagazine](https://cybernoz.com/category/australiancybersecuritymagazine/) - Browse the latest Australiancybersecuritymagazine cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [CyberWire](https://cybernoz.com/category/cyberwire/) - Browse the latest CyberWire cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Zerosalarium](https://cybernoz.com/category/zerosalarium/) - Browse the latest Zerosalarium cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Tldrsec](https://cybernoz.com/category/tldrsec/) - Browse the latest Tldrsec cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Unit42](https://cybernoz.com/category/unit42/) - Browse the latest Unit42 cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [securelist](https://cybernoz.com/category/securelirt/) - Browse the latest securelist cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [AttackDefense](https://cybernoz.com/category/attackdefense/) - Browse the latest AttackDefense cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Rapid7](https://cybernoz.com/category/rapid7/) - Browse the latest Rapid7 cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [Crowdstrike](https://cybernoz.com/category/crowdstrike/) - Browse the latest Crowdstrike cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [CISOOnline](https://cybernoz.com/category/cisoonline/) - Browse the latest CISOOnline cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [techcrunch](https://cybernoz.com/category/techcrunch/) - Browse the latest techcrunch cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [ArsTechnica](https://cybernoz.com/category/arstechnica/) - Browse the latest ArsTechnica cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [InfoSecurity](https://cybernoz.com/category/infosecurity/) - Browse the latest InfoSecurity cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [IndustrialCyber](https://cybernoz.com/category/industrialcyber/) - Browse the latest IndustrialCyber cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [OTSecurity](https://cybernoz.com/category/otsecurity/) - Browse the latest OTSecurity cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [CloudSecurity](https://cybernoz.com/category/cloudsecurity/) - Browse the latest CloudSecurity cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [VendorResearch](https://cybernoz.com/category/vendorresearch/) - Browse the latest VendorResearch cybersecurity news, expert analysis and breaking updates on CyberNoz.
- [ThreatIntelligence-IncidentResponse](https://cybernoz.com/category/threatintelligence-incidentresponse/) - Browse the latest ThreatIntelligence-IncidentResponse cybersecurity news, expert analysis and breaking updates on CyberNoz.