Karina Portugal has spent more than ten years working in digital identity, fraud prevention, anti-money laundering and Know…

Read more →

FortiBleed, a credential compromise campaign targeting Fortinet firewalls and VPN gateways, is an ongoing threat that can lock users out of their Fortinet accounts and also lead to ransomware attacks, the FBI and Secret Service said in an alert published Tuesday. “Affected organizations may find themselves locked out of their systems if threat actors disable accounts…

Read more →

Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. […]

Read more →

Threat actors are now hiding payloads by using DNS TXT records and browser cache pre-fetching, making it tougher to spot early attack stages.

Read more →

A bipartisan update to a California wiretapping law will eliminate the right to sue over internet-based surveillance, ending a key provision of a 57-year-old wiretapping law. Advocates say it is an overdue correction meant to prevent frivolous lawsuits, while privacy advocates call it a blow to digital consumer privacy rights. The California Invasion of Privacy…

Read more →

TD SYNNEX is adding SignWell’s eSignature platform to its U.S. portfolio, giving reseller partners access to SaaS and API-based tools for electronic signatures, document automation, and embedded signing.  The agreement also gives partners access to annual subscriptions, usage-based API plans, partner pricing, and deal registration for qualifying opportunities. TD SYNNEX expands eSignature options for U.S.…

Read more →

On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days. […]

Read more →

In cloud-centered environments, establishing trust between workloads is fundamental to securing machine-to-machine communication. Traditional approaches such as API keys, shared secrets, and static service account credentials weren’t designed for the scale and ephemeral nature of cloud workloads. This drives an organizational need to shift from long-term, static credentials to short-lived cryptographic workload identities. Organizations are…

Read more →

AI networking depends on coordination across software, switches, silicon, and high-speed connections. Collaboration among those vendors could give channel partners more options for building AI networks, although compatibility, integration, and support still require evaluation. The Software for Open Networking in the Cloud (SONiC) Foundation has announced the addition of Lenovo, NADDOD and Zhanwang (NEXAI) as…

Read more →

Cybersecurity researchers have disclosed details of a “human-operated phishing platform” that impersonates advertising products for artificial intelligence (AI) chatbots like Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus. The products, which claim to offer campaign optimization, spend audits, and business-account connections, are designed with one goal in

Read more →

Microsoft and Meta are reportedly putting their own AI tools ahead of Anthropic’s Claude for more internal work, but neither company appears to be walking away from Claude altogether. The changes center on employee use, where AI costs and competing in-house tools are pushing both companies to rethink how much they rely on third-party models.…

Read more →

The US Federal Bureau of Investigation has removed an Accenture contractor working on its PeopleSoft installation over their role in a data breach that exposed personal details of FBI employees, Reuters reported Monday. This is the first time that anyone other than the hacker group Shinyhunters that claimed responsibility for the breach has linked it…

Read more →

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection. Threat actors are known to name their malicious software after a legitimate operating system component or a process as a defense evasion measure. By borrowing…

Read more →

Google is cutting off free users from the Flash and Pro models. AI Plus subscribers are losing out too

Read more →

The situation illustrates a trend toward using AI and deterministic validation to identify flaws and exploitability, and provide a risk assessment.

Read more →

Former National Security Agency Director Paul Nakasone said a reported broad reorganization of the agency is “probably necessary” as it confronts faster-moving cyberthreats, artificial intelligence and competition with China, but he cautioned that the outcome will depend on how the changes are carried out. Speaking Tuesday at VulnCheck’s ThreatCon1 conference, Nakasone addressed a recent report…

Read more →

Tanium has announced new security operations capabilities that give IT and security operators greater detection depth, response options, and AI-native hunting to investigate, contain, and resolve threats faster within live endpoint intelligence. The Tanium Security Operations capabilities are powered by Tanium Atlas, the company’s autonomous operating system that allows customers to build a self-driving SOC…

Read more →

Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. […]

Read more →

Not quite an EDR-killer, but the proof-of-concept cyber technique creates a silent virus detection gap while service runs normally, no exploit required.

Read more →

The Nvidia-backed company is targeting an IPO in 2027.

Read more →

The FBI removed a contractor over a ShinyHunters-linked breach. Reuters sources identified Accenture and an unpatched Oracle PeopleSoft system.

Read more →

Microsoft is ending support and updates for Office 2021 on October 13. What does that mean, and what are your alternatives?

Read more →

UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to have stolen customer data from the company’s Snowflake environment. […]

Read more →

A number of studies reported a decline in tech jobs in September as the US continues to get squeezed by geopolitical and economic instability. Tech consortium CompTIA said 10,350 positions in the technology sector were lost in September, lower than the 14,700 positions cut in August. But economy-wide, tech jobs — which include IT roles…

Read more →

You’re building a data agent that lets business users ask questions about lakehouse data in natural language. You’ve already built governance policies that control who can access which datasets. The challenge is making the agent respect those rules without rebuilding them in your application code. When a user asks a question, the agent maps it…

Read more →

Plus, AI agents attack South Korean banks, and will we spend as much on AI as we do on food?

Read more →

RobCo has joined the robotics unicorn club as manufacturers look for more flexible ways to automate factory work. The Munich-based startup said Monday that it surpassed a $1 billion valuation through a transaction combining new investment with a secondary share sale, giving long-standing employees an opportunity to sell part of their holdings. The milestone comes…

Read more →

A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor authentication (MFA) codes through browser-in-browser attacks. […]

Read more →

AI tools let non-technical employees build workplace apps in minutes with natural language prompts. While these AI-generated apps boost productivity, they can create severe security and data risks. As Cybersecurity Awareness Month kicks off, we’re sharing how Tenable adopted a structured governance framework that allows our “citizen coders” to build secure and compliant apps with…

Read more →

ClickFix sites stage a VBScript payload in the browser cache to bypass the Run dialog’s length limit

Read more →

Microsoft has released an out-of-band security update addressing CVE-2026-96940, a high-severity vulnerability in Microsoft Exchange Server that could allow authenticated attackers to access other users’ mailboxes and read sensitive emails and attachments. The flaw carries a CVSS score of 8.8 and affects multiple on-premises Exchange Server versions. The vulnerability comes amid growing security concerns surrounding…

Read more →

Atlassian has disclosed CVE-2026-21589, a critical arbitrary file access vulnerability affecting eight widely used Data Center products, including Jira, Confluence, and Bitbucket. The flaw, assigned a CVSS 4.0 score of 9.3, could allow unauthenticated attackers to access sensitive files on vulnerable servers without requiring valid credentials or user interaction. The vulnerability highlights the growing risks…

Read more →

Cisco completed its acquisition of Astrix Security on June 29, 2026, after reportedly agreeing to pay approximately $400…

Read more →

When it comes to consumer protections, Europe is following its own path. That may be visible in its quixotic-seeming decisions that allegedly prevent Apple from introducing Siri AI in the European Union. It’s time to begin to grapple with what those decisions mean. I think the EU has got it wrong in how it has chosen to enforce…

Read more →

Thousands of global fashion retailer ASOS customers have received a push notification through the ASOS app this morning alleging that the company has been hacked. The notification, addressed to ASOS’s data protection officer and IT, says: “ASOS HACKED Dear Asos DPO and IT, we have fully compromised ​the Snowflake instance. Engage with us, or we…

Read more →

Deeper Network Promo

Microsoft released emergency updates for Exchange Server to fix CVE-2026-96940, a high-severity flaw that can let attackers gain higher privileges. Microsoft has released out-of-band security updates for Exchange Server to fix a high-severity vulnerability tracked as CVE-2026-96940 (CVSS score of 8.8). The flaw is caused by weak authorization and can allow an authenticated attacker to…

Read more →

RMM platforms give MSPs privileged access across customer environments, making their security controls critical to limiting risk. Acronis outlines eight controls MSPs should test when evaluating RMM software, from patching and privileged access to recovery and tenant isolation. […]

Read more →

Nikkei says two employee cloud accounts were accessed, with one used to send 9,000 phishing emails

Read more →

Anaconda has announced new capabilities across the Anaconda Platform that pair agentic development with autonomous security testing. The expansion brings agent swarms and autonomous red-team agents together with trusted packages, models, and environments to help builders ship faster and address security weaknesses before production. Builders gain greater choice in the tools and models they use,…

Read more →

Rogue OpenAI agents made unauthorized edits on Wikimedia wikis and sent millions of automated requests to Wikimedia’s public APIs, traffic that may have contributed to a partial outage of the Wikidata Query Service in May, the Wikimedia Foundation said on Monday. “The Wikimedia Foundation conducted its own investigation to see whether Wikimedia websites had been…

Read more →

AppViewX has expanded capabilities for Agent Identity Security, a solution enabling enterprises to discover every agent, whether sanctioned or shadow; govern their posture and maintain audit-ready activity logs; and monitor and control in real time every action that the agent performs. AppViewX now also issues quantum-resilient agent identities, so trust in every agent holds as…

Read more →

New Relic has announced New Relic Ground Truth CLI augmented with New Relic Autopilot API, bringing headless observability straight to developers and AI agents in their natural workflows. The new command-line interface (CLI) allows teams to investigate production issues, assess recovery criteria, and embed live system evidence into their daily workflows without leaving the terminal.…

Read more →

NinjaOne RMM is a cloud-based remote monitoring and management platform designed for managed service providers (MSPs) and internal IT teams managing distributed endpoints. Formerly known as NinjaRMM, the platform combines endpoint monitoring, patch management, automation, scripting, alerting, and remote access in a centralized console.  Our assessment finds NinjaOne particularly well suited to MSPs and IT…

Read more →

NinjaOne RMM is a cloud-based remote monitoring and management platform designed for managed service providers (MSPs) and internal IT teams managing distributed endpoints. Formerly known as NinjaRMM, the platform combines endpoint monitoring, patch management, automation, scripting, alerting, and remote access in a centralized console.  Our assessment finds NinjaOne particularly well suited to MSPs and IT…

Read more →

SailPoint has announced significant new capabilities across SailPoint Agentic Fabric (SAF) and SailPoint Human Fabric (SHF), the two purpose-built products of its Identity Security solution, built on SailPoint Atlas. These innovations give enterprises visibility into every hidden AI tool, continuous compliance across human and machine workflows, the replacement of permanent access keys with temporary permissions,…

Read more →

September delivered another wave of consolidation across the IT channel, with GTIA acquiring The ASCII Group, Softcat striking a $1.05 billion deal for General Datatech, and MSP, cybersecurity and AI providers expanding through acquisitions. The deals spanned managed services, security, cloud infrastructure and AI, underscoring continued pressure on channel companies to add scale, geographic reach…

Read more →

Silver Springs, United States / Maryland, 6th October 2026, CyberNewswire

Read more →

Plus, NYC lawmakers weigh AI guardrails

Read more →

The IBM subsidiary has also announced its Lightwell Clearinghouse is now available to all customers

Read more →

Torrance, Californina, 6th October 2026, CyberNewswire

Read more →

New York, New York, 6th October 2026, CyberNewswire

Read more →

Open models are vying to become the everyman defense solution for a growing swarm of agent breaches.

Read more →

September brought a wave of leadership changes across the IT channel, with new CEOs, channel chiefs and senior executives taking roles across cybersecurity, AI, cloud and managed services. Among the month’s most notable moves, Apple named John Ternus CEO, KnowBe4 appointed Kurt Mills as channel chief, while Proofpoint, TensorWave and Lightning AI expanded their executive…

Read more →

Intellias has launched Agentic ServiceOps a managed IT service that applies governed agentic AI across IT service management (ITSM) and IT operations management (ITOM), from the service desk to the infrastructure behind it. It helps organizations resolve more IT work end to end, breaking the link between rising complexity and rising costs. Intellias’ Agentic ServiceOps…

Read more →

AXON Networks has announced AXON Datum, a data management and secure sovereign governance layer that helps service providers, enterprises, and institutions such as governments control how information is accessed, protected and moved in an AI world. Critical to the success of every telecom and government moving into agentic AI who want the data and AI…

Read more →

Attackers who know where to look can read files from Atlassian Data Center installations without logging in, the company has warned. About CVE-2026-21589 CVE-2026-21589, a critical arbitrary file access vulnerability with a 9.3 CVSS score, affects all versions of Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo…

Read more →

Forescout found that just 6% of Internet of Medical Things (IoMT) and 16% of medical OT are capable of supporting post quantum cryptography

Read more →

Facebook users are reporting receiving a message with a fake Facebook Marketplace listing that has their name as the seller. It works like this. You receive a message (in this case iMessage) asking “Is this still available for purchase?” Attached to the message is a fabricated Facebook Marketplace listing. Tapping on the picture, you might…

Read more →

A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker’s code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before it runs a macro. The attack works only when the program’s Java support is enabled. So far, it has…

Read more →

A new Linux backdoor is turning vulnerable internet-facing devices into remotely controlled proxy nodes, while using the public Session Traversal Utilities for NAT (STUN) infrastructure to blend into normal VoIP and WebRTC traffic. Fortinet’s FortiGuard Labs said it has been tracking the malware, dubbed ClingSTUN, across multiple attacks exploiting known vulnerabilities in routers, IoT devices,…

Read more →

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Read more →

ASOS customers have received a seemingly legitimate push notifications claiming the retailer’s IT systems have been breached through a Snowflake breach

Read more →

Companies continue to invest in AI, automation, developer tools, and other new technologies. But they may not get the results they expect if IT workers don’t have the time, resources, or freedom to learn how to use them. IT workers may be afraid to try new tools if they think a failed experiment could hurt…

Read more →

The Wikimedia Foundation says rogue OpenAI agents made unauthorized Wikipedia edits and may have been partially responsible for a May outage. […]

Read more →

A coalition of cyber firms and critical infrastructure operators on Tuesday spelled out its views on the tasks that the Cybersecurity and Infrastructure Security Agency should assign federal agencies to protect operational technology systems after this summer’s attacks on water utilities. The Operational Technology Cybersecurity Coalition said a CISA binding operational directive (BOD) for OT…

Read more →

Editor’s note: This research was conducted by Himanshu Anand, an independent cybersecurity researcher (follow Himanshu on X). During Cybersecurity Awareness Month, ransomware remains one of the clearest examples of how a cyber incident can become a business continuity issue. IronChain shows why. It puts business-critical data at risk of permanent loss and can bring operations…

Read more →

The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including unsuccessful efforts to compromise Etherpad, a public note-taking tool, and edit Wikipedia pages. “The unauthorized bot activities included edits to our wikis, some unsuccessful attempts to exploit a public note-taking tool we host, and…

Read more →

Domino’s Pizza customers tell us they have received emails saying they account has been accessed by a third party. Domino’s says its internal systems weren’t breached, but that individual accounts were logged into using a password and email combination stolen from another online account owned by the customer. This is known as credential stuffing. Here’s…

Read more →

In 2024, MCP (Model Context Protocol) set out to become the USB-C of AI: one standard for connecting models, agents, and IDEs to tools and data. The protocol delivered. Thousands of developers built servers, and enterprises plugged them into agent workflows. The ecosystem around it fell short. Earlier this year, our team at OX Security, …

Read more →

When Anthropic CEO Dario Amodei urged other leading AI labs to “pace the frontier” last week, his calls for caution were echoed by other prominent voices in tech. Both Sam Altman and Elon Musk agreed with Amodei’s assessment that pausing AI development was essential to prevent the extinction of the human race. Amodei listed several…

Read more →

Deeper Network Promo

Dell is urging customers to patch a vulnerability (CVE-2026-86360) in Dell System Update (DSU) that could allow an unauthenticated remote attacker to execute arbitrary code with root privileges. DSU is a tool used by enterprise IT administrators to apply driver, BIOS, and firmware updates to Dell PowerEdge servers. About CVE-2026-86360 CVE-2026-86360 is a path traversal…

Read more →

Learn how to use technology to fight distraction and improve focus with notification controls, site blockers, focus timers and task lists.

Read more →

Less than a week after Microsoft opened its new Frontier Partner specialization, eligible partners can now pursue a designation built around one of the company’s biggest channel priorities: AI agents. The specialization became available Sept. 30 and targets partners that can design, build, deploy, govern, and secure agents across Microsoft’s cloud, productivity, development, and security…

Read more →

Exclusive Networks launched a dedicated ServiceNow business on Oct. 1 to support partners across Europe and the Middle East, putting its July distribution agreement into operation. The cybersecurity distributor is targeting two groups with the rollout. Existing ServiceNow partners can use the business to expand into security, while Exclusive Networks partners can add ServiceNow-based workflows…

Read more →

Ontinue has announced the launch of ION for Dark Web Monitoring (DWM), a new managed add-on service that extends ION MXDR to continuously identify exposed credentials, detect brand impersonation attempts, and uncover emerging external threats before attackers can exploit them. Compromised credentials are traded across criminal forums, lookalike domains are created to impersonate trusted brands,…

Read more →

AI is accelerating the discovery of software vulnerabilities, but it is also creating a new bottleneck for defenders: deciding which machine-generated findings warrant investigation. Google has decided to temporarily stop accepting certain bug bounty submissions after a surge of largely invalid automated reports highlights a growing challenge for security teams as AI-driven vulnerability discovery begins…

Read more →

The fastest-growing category of enterprise software right now is also the least scrutinized from a security standpoint. AI application platforms — tools that let teams build, connect and automate AI-powered workflows without writing much code — are landing in production environments faster than security teams can assess them. They connect to your APIs, your databases,…

Read more →

Dutch haul comes despite European drugmakers and investors warning the region is losing ground.

Read more →

Transcend has launched Transcend Rails, a new category of agent management that goes beyond identity and access control to govern what an agent does. Every enterprise scaling AI agents hits the same wall: the board asks what agents did last quarter, and no one can reconstruct it. Or an agent deletes, exports, browses, or spends…

Read more →

The FBI confirmed multiple arrests in its ShinyHunters investigation after suspected member Saif al-Din Khader was reportedly detained in Jordan.

Read more →

Read more →

Hack The Box has introduced AI Range Enterprise Edition, making its platform for testing and measuring AI security agent effectiveness available to enterprise security teams. The offering enables organizations to evaluate whether their own AI agents can perform the cybersecurity roles assigned to them and make informed decisions about how to use agents across the…

Read more →

It seems that a trend started… I continue my journey discovering more RMM (“Remote Management & Monitoring”) tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today, I found another one. Same scenario, it started with a phishing email that delivers a fake PDF invoice to the victim:…

Read more →

Oura pitched itself as a tech platform, but investors saw through that.

Read more →

GitHub’s ReviewBench measures how well AI code review tools detect problems before software is released. Available in research preview through its website, the benchmark lets users compare review agents and evaluate their own tools. Code review involves checking proposed changes for mistakes. ReviewBench measures AI reviewers’ ability to identify issues and avoid false alarms. Users…

Read more →

Accenture lost an FBI contract after a missed security patch exposed sensitive employee data, raising serious concerns over operational security. The FBI pulled an Accenture contractor off its account on Monday, and the reason is almost mundane compared to the damage it caused. One update didn’t get installed on time. “The ‌Federal Bureau of Investigation…

Read more →

Over the weekend, Japanese publishing giant Nikkei disclosed that unknown attackers recently breached two employee email accounts and used one to send thousands of phishing emails. […]

Read more →

Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software. The change, in effect since October 1, means researchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers there for a reward. Reports about supply chain compromises are still accepted,…

Read more →

Report Fraud says cybercrime revenue stemming from account takeover increased 417% annually

Read more →

A data breach at Denmark’s Central Population Register (CPR) has exposed the personal information of 8.8 million people. These include people living in Denmark, deceased people and citizens who have moved abroad. The CPR is Denmark’s national register of residents, and the 10-digit CPR number it assigns to each person is used for everything from…

Read more →

Small businesses often have limited staff to handle marketing, customer service, and financial analysis. Meta’s latest Muse update aims to help automate some of that work, while giving MSPs and solution providers another tool to evaluate for customers. Meta announced Muse for Small Business on Sept. 29, adding business-focused skills and connectors to its existing…

Read more →

Gartner recently released a new category of security tools: the Integrated Security Operations Center (ISOC). This new category acknowledges the need to expand beyond traditional SIEM tools in the creation of a security portfolio, though, as they note in the introductory report, Security Information and Event Management (SIEM) isn’t going anywhere. Gartner’s evolution away from…

Read more →

Motorola is preparing to bring another premium Android option to the US, potentially giving channel partners a new device to consider for customers looking beyond Samsung and Google. Motorola has confirmed the Signature 27 will launch in the US, while Android Authority reports that the phone is coming in November. The company has not announced…

Read more →

An affiliate of The Gentlemen RaaS group ran a parallel leak site during extortion of two dozen victims

Read more →

Attackers are increasingly weaponizing already-disclosed flaws rather than new zero-days, and AI tools may be accelerating how quickly they do it. According to a report from Google’s Threat Intelligence Group (GTIG), attackers have exploited more vulnerabilities in the wild thus far this year than they did all of last year. With the number of flaws…

Read more →

A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands of devices on his employer’s network in a ransomware-style attack. […]

Read more →

Dell warns that a critical DSU flaw lets attackers run code as root. Customers should patch affected PowerEdge systems as soon as possible. Dell urged customers to patch a critical flaw, tracked as CVE-2026-86360 (CVSS score of 9.6), in its System Update (DSU) tool. The vulnerability is a path traversal issue that can let attackers…

Read more →

A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product’s web application root directory. The attacker must already know a file’s exact name and path and cannot list what the directory holds. Atlassian disclosed the flaw, CVE-2026-21589, on October…

Read more →

The U.S. Federal Bureau of Investigation (FBI) has removed an Accenture contractor for their alleged role in a ShinyHunters-breach that led to the theft of personal details of thousands of bureau employees. That’s according to a report from Reuters, citing two sources familiar with the matter. “To date, our review has determined that the incident…

Read more →

Fortinet details ClingSTUN, a Linux backdoor exploiting unpatched IoT devices and abusing public STUN servers to route traffic past NAT. FortiGuard Labs researchers spotted a Linux malware family they call ClingSTUN, and the name gives away its trick immediately. Instead of relying on a dedicated command server, the malicious code leans on STUN, the protocol…

Read more →