Black Kite has found that manufacturing remained the most targeted sector for ransomware attacks, and saw a big jump in incidents in H1 2026

Read more →

Parcel delivery phishing campaigns appear around the world under different courier names. In the United States, the messages commonly impersonate USPS and claim that a package has an invalid address or could not be delivered. Similar messages impersonate Colissimo and Chronopost in France, Correos in Spain, Poste Italiane in Italy, and PostNL in the Netherlands.…

Read more →

Microsoft has fixed a known issue that causes copy-and-paste failures for some Excel users after installing the September 2026 KB5002914 security update. […]

Read more →

This post will show you the best parental control software for 2026. As a child safety advocate and parent of two myself, I understand the ever-present concern of keeping our children safe in the vast and sometimes perilous digital landscape. The internet holds a treasure trove of information and opportunities for learning and connection, but…

Read more →

AI-driven cyberattacks used to be exotic. Soon, it’ll be odd if threat actors aren’t using agents to do all of their bidding.

Read more →

Cybersecurity researchers have flagged a new Android malware called RatHat that’s assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices. “Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses

Read more →

Artificial intelligence AI is moving from experiments and chatbots into the physical world. Australia can lead this next phase, but only if investment in AI is matched by…

Read more →

In June 2026 the IETF published RFC 10008[1], defining a new HTTP method: “QUERY”. The HTTP protocol faced already by changes (HTTP/2, HTTP/2) but it’s the first new standard HTTP verb since “PATCH” in 2010! This new method sits between “GET” and “POST” and can be resumed like this: “QUERY is a GET with a body”. It’s…

Read more →

Millions of people still run smart home and IoT companion apps, the apps used to control devices like smart plugs, cameras, and thermostats, that stopped receiving updates years ago. Researchers at the University of Massachusetts Amherst analyzed 61,500 abandoned Android IoT apps and found that nearly three in four contained software dependencies associated with documented…

Read more →

The Dreame X60 Ultra vacuums, mops, climbs thresholds and cleans much of itself. In our renovation-stressed home, it also achieved something remarkable: it trained the humans.

Read more →

Hardcoded API keys, access tokens and other credentials used by AI coding tools have been found in publicly accessible MCP configuration files on GitHub, according to research from Hush Security’s The State of MCP Configuration: The Identity Security Gaps report. The company analyzed around 82,000 configuration files and found that 12% of credential slots contained…

Read more →

A 90-day period between hiring and onboarding is creating a blind spot in enterprise identity security, according to HYPR’s State of HR Identity Fraud Detection report. “Adversaries no longer need to breach a network when they can pass a remote interview and receive authentic credentials directly from IT,” said Bojan Simic, CEO of HYPR. “Human…

Read more →

Melapress, a maker of WordPress security plugins, surveyed 319 WordPress professionals and found that most had dealt with at least one known security incident. The respondents build and run WordPress sites for a living: agency staff, developers, designers, site owners and administrators. Across the whole group, fewer than three in ten have a breach recovery…

Read more →

Here’s a look at the most interesting products from the past week, featuring releases from Akuity, Bitsight, Cohesity, Dataminr, Nozomi Networks, and Tuskira. Dataminr uses agentic AI to predict and verify security threats Dataminr has announced Dataminr Advanced for Corporate Security, delivering agentic AI capabilities that give corporate security teams the confidence to protect their…

Read more →

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Read more →

A bug-hunting independent security research team was able to access OpenAI’s internal code system, exposing growing risks in automated cyber threats.

Read more →

/goal in GitLab Duo CLI, now in public beta, lets developers automate an open-ended objective to a governed agentic flow that runs locally and verifies its own work, so a…

Read more →

Celebrating the organisations driving innovation and making an impact across the Australian and New Zealand IT channel ecosystem

Read more →

Delinea will apply Anthropic’s frontier AI model to its own vaulting, secrets, and session-brokering code

Read more →

There’s a new development in a Microsoft antitrust case, originally filed in England’s High Court in April 2021, and it doesn’t look good for the tech giant. A consent order from the UK Competition Appeal Tribunal is demanding documents from past and present Microsoft executives that may have a bearing on a £270 million (about…

Read more →

Supported by a global channel partner ecosystem—including partners like Presidio—joint solution simplifies Zero Trust VDI delivery, DMZ consolidation, and enterprise…

Read more →

AI assistants, agent skills and open-source model components are emerging as potentially valuable supply-chain targets for cybercriminals, according to new frontline research…

Read more →

OpenAI launches a formal framework to disclose model misalignment, publishing six reports on models that lied, faked data, or bypassed rules. Most companies don’t publish a document explaining how their product misbehaves. OpenAI just did. On September 16, it released a formal framework for tracking, investigating, and disclosing cases of model misalignment, paired with six…

Read more →

Executives at OpenAI and Microsoft acknowledged they could undermine their own content sources, according to a new filing in a New York Times copyright lawsuit.

Read more →

A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices. […]

Read more →

The move is consistent with the agency’s advice on the need for organizations to prioritize the vulnerabilities that actually matter.

Read more →

European organizations can run AI workloads on Amazon Web Services (AWS) while keeping data within the European Union (EU) and meeting regulatory requirements. You can now run generative AI workloads on open weight models on Amazon Bedrock in the AWS European Sovereign Cloud. We’re excited to announce the general availability of the first open weight…

Read more →

Every major software release comes with a list of features so long it reads more like a press release than a practical guide. iPadOS 26 is no exception. Apple called it the…

Read more →

Cisco released patches for an actively exploited authentication bypass vulnerability in its Cisco Identity Services Engine (ISE) platform, which is used for enterprise network control and policy enforcement. This is the second zero-day flaw Cisco has been forced to release emergency patches for this week, after fixing a critical vulnerability in its Secure Email Gateway…

Read more →

Cisco disclosed its second actively exploited zero-day vulnerability in as many days, presenting its customers with back-to-back threats to address in unrelated products. The latest zero-day — CVE-2026-76460 — has a maximum-severity rating and was exploited before Cisco disclosed and patched the vulnerability Wednesday. The defect in an API of Cisco Identity Services Engine (ISE)…

Read more →

Sponsored by:
Software Analyst Cyber Research

AI data centers want more power, and Google, Nvidia and Emerald AI are betting they can get it faster by learning when to use less. Google, Nvidia and Emerald AI have launched the AI Energy Management Alliance (AEMA), an 18-member coalition pushing utilities and regulators to treat flexible AI data centers as controllable grid resources.…

Read more →

Cisco has released emergency security updates for a maximum-severity vulnerability affecting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) after confirming active exploitation in the wild. Tracked as CVE-2026-76460 and rated 10.0 on the CVSS scale, the flaw allows an unauthenticated remote attacker to bypass authentication and gain unauthorized access to a vulnerable…

Read more →

Acronis has disclosed a high-severity Linux privilege-escalation vulnerability affecting its Backup integrations for cPanel & WHM and Plesk after detecting exploitation in targeted attacks. Tracked as CVE-2026-87886 and rated 7.8 on the CVSS scale by Acronis, the flaw stems from insecure file permissions and can allow an authenticated attacker with limited privileges to increase their…

Read more →

Europe’s biggest AI data centers are going where the power is. France, Portugal, Finland, and Norway are attracting some of the continent’s largest planned AI campuses as developers seek sufficient electricity, land, connectivity, and cooling to support hundreds of megawatts of computing capacity. The projects show how energy availability is starting to reshape Europe’s traditional…

Read more →

The past few weeks have “felt very strange” for Juan Andres Guerrero-Saade. Like many, he is trying to sort through the spate of frontier-model AI agents from OpenAI, Anthropic, Meta and others hacking their way onto the open internet over the past few months, particularly amid the already-heated national debate around the emerging technology and…

Read more →

Deeper Network Promo

Roku’s money-saving bundles include channels like HBO Max, Starz, and Fox One.

Read more →

Amid the US and China’s fight for eco-colonial influence in Latin America, a stealthy backdoor has taken flight.

Read more →

OpenAI has presented new examples of what they call “AI model misalignment” from the past six months, including unauthorized file uploads, following self-generated instructions, hiding mistakes, and leveraging exposed API keys. […]

Read more →

Flock Safety’s cameras are automated license plate readers (ALPRs) designed to help police find stolen cars or wanted suspects. A joint investigation by 404 Media and WIRED, based on data recovered from a physically removed Flock camera, found that its on-device software explicitly detects people as well as vehicles, bicycles, and license plates. Separately, Washington…

Read more →

A critical vulnerability in Check Point’s Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network. The Security Management Server is the system that controls firewall policy and administrator access. Check Point has released a fix through its LivePatch update channel and…

Read more →

Cyberattacks on oil tankers show how connected ships can expose navigation and critical systems, threatening safety, ports and global trade. U.S. Coast Guard personnel and FBI agents boarded two Texas‑bound energy tankers last month after cyberattacks hit the vessels while they were underway, according to U.S. officials. One of the ships was the VL Prosperity,…

Read more →

Welcome to this week’s edition of the Threat Source newsletter.  There’s been a lot of talk recently about slowing down the pace of AI development. And yes, there are legitimate moral, ethical, geopolitical, and safety concerns with the use of AI. It’s not clear yet whether an AI slowdown could happen, let alone whether it…

Read more →

Attackers keep finding new keys. The funny part is that defenders keep inventing where to store them. This week, those keys sit in AI tools, exposed services, old bugs, weak logins, and software sold like a monthly subscription. Some attacks use new tricks. Others just reuse what was already lying around. Both work often enough.…

Read more →

Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware. […]

Read more →

Claude Code Projects could change how developers manage complex AI coding workflows by coordinating threads, sharing memory, and spanning repos, but its biggest benefits are still cloud-only for now.

Read more →

Multiple vulnerabilities have been discovered in Oracle products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs;…

Read more →

OpenAI has published six new reports detailing AI model misalignment, including instances of hidden instructions, unauthorized communication, and attempts to locate exposed API keys, adding to the evidence that its AI systems bypassed controls during testing. The reports, based on internal evaluations, describe models taking actions beyond defined constraints, including modifying intermediate outputs, interacting with…

Read more →

Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a security announcement on September 15. The escape runs with the rights of the host account that runs the virtual machine. The flaw, CVE-2026-77179, is rated…

Read more →

Security budgets may be growing on paper, but for a majority of CISOs, the money isn’t moving in quite the same direction. The budgets grew by 5% on average in 2026, up from 4% last year. But that average hides a much weaker picture: median budget growth remained at 0%. And while 64% of CISOs…

Read more →

ESET said FamousSparrow has replaced SparrowDoor with SparroWocky

Read more →

At the end of August, a malspam message was caught in the quarantine of a mail gateway operated by one of my customers. The message was not especially remarkable – it asked the recipient to review some attached requirements and provide a price quotation for a fiber optic system and appeared to impersonate an employee…

Read more →

Apple barely increased the iPhone 18 Pro’s battery capacity, but its EU filings show a much larger jump in rated endurance. That shifts the question from how much bigger the battery became to how efficiently the phone uses it. The company’s EU product information sheet lists the iPhone 18 Pro with a 4,056mAh battery, just…

Read more →

An oil tanker bound for Texas was boarded mid-voyage by the US Coast Guard and FBI last month, after its network may have been compromised by malicious hackers. According to the US Coast Guard, the supertanker was boarded after indications that the network “may have been compromised by a foreign actor.” Read more in my…

Read more →

Google has released security updates for a high-severity zero-day vulnerability affecting the cellular modem in Pixel devices after finding signs that the flaw is being used in limited, targeted attacks. Tracked as CVE-2026-58704 and scored 8.0 under CVSS 3.1, the issue can allow an attacker to bypass permission checks and escalate privileges without requiring any…

Read more →

The defining development of the period came not from attackers but from the AI labs themselves, whose models broke out of controlled evaluations and reached real systems. In the wild, the criminal and state use of AI continued to mature along the lines tracked in earlier editions: models now act as attack operators, an underground…

Read more →

Anthropic is equipping its Claude AI assistant for more productivity work with the launch of Claude Docs and Slides. While it’s already possible to create documents such as Microsoft Word and Google Docs files from Claude chats, the latest update, announced Wednesday, brings a rich-text editor directly into Claude. Users ask the AI assistant to…

Read more →

The intervention reflects growing unease around the world about a technology largely driven by the U.S. and China.

Read more →

Hunt.io links SpiceRAT, NodeEdgeRAT and NomadRAT to a four-year SilkParasite campaign targeting governments and critical sectors in Central Asia. Hunt.io and researcher Guy Yasur have traced a tight cluster of SpiceRAT command‑and‑control servers that predate and extend Bitdefender’s August 2026 SilkParasite report. The work doesn’t dissect malware samples; it maps the network side of the…

Read more →

Only days after Revolut acknowledged that it disclosed sensitive customer records to an unauthorized party, affected customers are receiving phishing texts. However, we don’t know yet if the phishing texts are linked to the breach. The company had accepted fraudulent information requests sent from an email address on a legitimate government agency domain. Through this social engineering attack,…

Read more →

The Iran-linked “hacktivist” persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. “HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading,

Read more →

Sponsored by:
Software Analyst Cyber Research

AI is making credential theft faster and easier to scale, giving attackers more opportunities to abuse valid identities. Specops explains why identity security must go beyond successful authentication by verifying that both the user and the device requesting access can be trusted. […]

Read more →

Some people love them because they have all that information at their fingertips. Which is also why others hate them.

Read more →

CISA released guidance on using cyber decoys to detect & disrupt malicious activity inside networks

Read more →

Authorities seized the primary domain and other websites linked to NightmareStresser, one of the longest-running and most popular distributed denial-of-service operations used by cybercriminals globally, the Justice Department said Tuesday.  Cybercriminals of various motivations used the DDoS-for-hire service to launch hundreds of thousands of DDoS attacks or attempted attacks since at least 2022, officials said. …

Read more →

As debate over AI safety intensifies, new research is drawing attention to a more immediate risk for enterprises: AI agents that can alter the models they rely on while carrying out routine tasks. Researchers at AI security firm Irregular asked a coding agent to solve a software maintenance problem involving an application built on a…

Read more →

Cisco is bringing Splunk AI to on-premises, private cloud, and air-gapped environments through a new architecture developed with NVIDIA, expanding how Splunk Enterprise customers can deploy AI in environments where security, sovereignty, and data-location requirements limit public cloud use.  Announced at Splunk .conf in Denver, the Cisco AI POD for Splunk is part of a…

Read more →

Plus, the fight over AI’s risks intensifies

Read more →

Six months after Iranian drone strikes tore through its Middle East infrastructure, Amazon Web Services (AWS) has acknowledged the permanent loss of customer data in Bahrain and the UAE. In two updates posted September 15, AWS said it can no longer recover customer data and resources stored in its Middle East (Bahrain) region, known as…

Read more →

Microsoft reminded customers this week that devices running Windows 11 24H2 Home and Pro editions will stop receiving updates next month. […]

Read more →

Deeper Network Promo

A fake ChatGPT billing email is steering users to a copy of the OpenAI login page that keeps whatever username and password they type. Josh Varden of Cofense’s Phishing Defense Center traced the email’s payment button through a Google redirect to the attacker’s page. The lure targets ChatGPT users on work and personal accounts alike,…

Read more →

AI hasn’t just made building faster, it’s made everyone a builder. Across every department, employees are shipping apps, agents and automations using AI tools, often without knowing they’ve created something that needs governing at all. The result: AI code sprawl is taking root, increasing risk, compromising compliance, and wasting resources. The usual responses aren’t working:…

Read more →

Bose announces the Ultra Open (2nd Gen) and the Sport Open Earbuds, offering more options for aware listeners.

Read more →

Researchers at Zimperium have uncovered a new Android malware strain, dubbed RatHat, with spyware and backdoor capabilities

Read more →

Cyber deception has long been the domain of well-resourced security teams, but CISA’s latest guidance, titled “Using Cyber Decoys to Strengthen Detection and Response”, is an attempt to try and change that. Why decoys, and why now The core problem CISA is attempting to address is that many organizations are incapable of detecting adversaries who…

Read more →

Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution. Unbound 1.26.1, released the same day, fixes the bug, tracked as CVE-2026-81642,…

Read more →

Druva has announced new capabilities for Druva Identity Resilience alongside the launch of Ransomware Detection, a new feature fueled by a proprietary AI threat pipeline. Powered by Dru MetaGraph, the new offerings use behavioral intelligence and built-in validation to turn suspicious behavior into actionable evidence, definitively confirm impact, and accelerate precise containment and clean recovery.…

Read more →

New government figures reveal a 20% annual increase in certifications

Read more →

AI could transform healthcare, but privacy, security, and governance remain major barriers to adoption. Channel Insider Managing Editor Victoria Durgin sits down with Promevo CTO John Petty to discuss how confidential computing can help healthcare organizations securely use sensitive data for AI workloads — and where channel partners can build services around the technology. Petty…

Read more →

The fourth-generation Apple Watch Ultra is here. Should you buy it?

Read more →

Visa and American Express have also been readying their systems for agentic bots that shop on behalf of cardholders.

Read more →

Google’s Agent Anomaly Detection is a reasoning-based oversight and audit layer for autonomous agents deployed on Agent Runtime in the Gemini Enterprise Agent Platform and built with the Agent Development Kit (ADK) for Python 1.2 or later. Google recommends ADK 2.1.0 or later. It is available in Private Preview. What Agent Anomaly Detection monitors Agent…

Read more →

A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actually be exploited in your environment? Mythos-class AI is compressing the time between disclosure and working exploitation, while many security programs still validate risk on weekly or quarterly cycles. The…

Read more →

The FBI has seized the domains behind NightmareStresser, a DDoS-for-hire service officials call one of the longest running “booter” operations in existence. The domain seizure notice (Source: US Department of Justice) “Booter services such as those named in this action allegedly facilitate attacks on a wide array of victims in the United States and abroad,…

Read more →

The DOJ seized domains behind NightmareStresser, a DDoS-for-hire service tied to hundreds of thousands of attacks since 2022, as part of Operation PowerOFF. Renting a DDoS attack used to be as easy as renting a movie. Pick a target, pay a few dollars, watch the site go dark. The Justice Department just made that a…

Read more →

The U.S. Federal Bureau of Investigation (FBI) seized the domains used by NightmareStresser, one of the world’s longest-running distributed denial-of-service (DDoS) platforms. […]

Read more →

The Manhattan District Attorney’s Office has seized the domains of 12 deepfake websites in what it called the largest known seizure of celebrity deepfake sites in history. The sites, which marketed themselves as deepfake pornography platforms, hosted AI-generated videos of over 1,200 people, including those in the public eye, ranging from politicians to actors, musicians,…

Read more →

Cisco urged ISE customers to apply a software update, as well as check for signs of exploitation

Read more →

Medical results are becoming part of a highly targeted malware lure. Iranian state cyber actors are disguising CHOSEN BRICK spyware as MRI files and familiar software to compromise Windows PCs. The UK’s National Cyber Security Centre, the FBI, and the Netherlands’ General Intelligence and Security Service warned Sept. 15, 2026, that the campaign has targeted…

Read more →

Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR 2026). A new free guide explains how autonomous AI agents are closing that gap, and what security leaders must demand before pointing one at production. TL;DR Exploitation is now the…

Read more →

Sponsored by:
Software Analyst Cyber Research

Since early May 2026, we’ve been monitoring a large phishing campaign based on T-Mobile rewards points. The messages falsely warn that a customer’s rewards points are about to expire. They aren’t legitimate account notices: They use urgency, invented point balances, and phishing links to push recipients into acting before they can verify the claim. A…

Read more →

The company is ramping up development of alternatives to Nvidia’s AI-computing systems, part of China’s push to reduce reliance on U.S. technology.

Read more →

Two days after it warned customers about an actively exploited email gateway zero-day, Cisco confirmed one more flaw is being targeted: CVE-2026-76460, an authentication bypass bug in an API of Cisco Identity Services Engine (ISE). About CVE-2026-76460 Cisco ISE is an identity-based network access control and policy platform. It checks connecting users’ identity, profiles devices…

Read more →

AI appears to be helping scammers with little web development skill build convincing fake antivirus-renewal pages, Malwarebytes found. The researchers came across a scam page impersonating Avast, aimed at users in Belgium, that was more polished than most sites of its kind. The page told visitors their Avast Premium Security subscription had renewed for €129.99,…

Read more →

The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025. “SparroWocky is a modular, C++ backdoor,” ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker…

Read more →

Compared with the same period last year, ransomware incidents in Japan increased slightly by approximately 4.7%, indicating that ransomware continues to pose a significant threat. In Japan, The Gentlemen was the most active ransomware group in the first half of 2026. Attackers continue to primarily target small- and medium-sized enterprises, with organizations capitalized at less…

Read more →

There is little reason to believe the war with Iran will end anytime soon. Even as efforts to resolve the conflict continue, Iran remains unpredictable, with an enduring ability to disrupt shipping and energy markets via actions in the Strait of Hormuz. So what does a prolonged conflict mean for cybersecurity here at home? U.S.…

Read more →

OpenAI on Wednesday disclosed six new instances of “unexpected or concerning model behavior” that took place over the past six months, while sharing a new framework for reporting, tracking, investigating, and disclosing model misalignment in a bid to improve transparency. “As AI systems grow more advanced and more widely deployed, we need to build a…

Read more →

A one-page visual summary of the 16–31 August 2026 cyber attacks timeline: 110 incidents broken down by motivation, attack technique, initial access vector, targeted sector, and country — Cyber Crime and Malware led the period, with Information & Communication the hardest-hit sector.

Read more →

The second half of August 2026 brought 110 confirmed cyber incidents, with Cyber Crime once again the dominant motivation at 78% of attacks. Malware remained the weapon of choice, exploitation of public-facing applications (T1190) continued to lead initial access, and Information & Communication emerged as the hardest-hit sector. This timeline breaks down the period by…

Read more →