NIST and CISA have finalized guidelines to help federal agencies and cloud service providers (CSPs) protect identity and access tokens from forgery, theft, and misuse. The guidance, Protecting Tokens and Assertions from Forgery, Theft, and Misuse (NIST IR 8587), explains how agencies and cloud providers can strengthen key management, token verification, and token lifecycle controls.…

Read more →

Google has released the September 2026 security patches to address 110 vulnerabilities affecting its Pixel devices, including one zero-day flaw actively exploited in targeted attacks. […]

Read more →

Speed and clarity are the ultimate advantages for modern SOC teams. The integration of ANY.RUN into SentinelOne delivers exactly that. Instant threat intelligence and interactive sandbox capabilities embedded right where your analysts already work. Let’s look at how this unified workflow eliminates context switching, accelerates incident response, and drives higher ROI by transforming alerts into…

Read more →

In this interview with Help Net Security, Gourab Basu, Global Head of Engineering at meshIQ, discusses governance in AI agent systems. He argues that instructions written into a prompt are not enough to control what an agent does, since agents can change their own path as they work. Real control means checking proposed actions before…

Read more →

Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. “This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution,” Wordfence said. The WordPress security company said it has blocked over

Read more →

DeepZero is an open-source engine that automates the search for exploitable Windows kernel drivers. You point it at a folder of binaries and it parses them, pulls them apart, scans them, throws most of them away, and asks a language model whether what survives can be attacked. Pipelines are written in YAML, the code is…

Read more →

A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr. The vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the…

Read more →

Over the past two months, I’ve written about the Vercel breach and the Composio breach separately. Both offer lessons to learn on their own. But reading them together, I keep coming back to the same observation: these aren’t isolated incidents. They’re the same attack, run twice, against different targets, where email was not the entry…

Read more →

MSPs estimate that 46% of their customers, on average, look to them to act as CISOs, according to Sophos. Most of those providers do that job without the full set of compliance services, and many spread the work across several tools. Most providers expect this work to grow. For many of those customers, the MSP…

Read more →

The new PoP at 60 Hudson Street connects New York to GNM’s international network and expands its US footprint alongside Ashburn and Miami.

Read more →

Growing a business usually means your back office grows with it, whether you want it to or not.

Read more →

Australian-founded mushroom biotechnology company Lifecykelhttps://lifecykel.com/ moved from Xero and spreadsheets to NetSuite with…

Read more →

The ChatGPT maker has had preliminary investor discussions about a new raise. It is likely to go public next year.

Read more →

Proofpoint, Inc., a global leader in human and agent cybersecurity, today released its 2026 Voice of the CISO report, revealing that local security leaders are facing…

Read more →

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Read more →

It finally works like a chatbot, but AI agent apps such as Instinct and Muse are stealing Siri’s thunder.

Read more →

Leader Cloud collaboration will bring Bitwarden security solutions to more than 16,000 Australian reseller partners, supported by marketplace procurement, enablement, and local…

Read more →

Partnership brings AI-enabled detection, decision support and highly automated remediation to the teams responsible for closing vulnerability and security gaps across Defence,…

Read more →

Global platform helps employers connect employees with benefits, rewards, and wellbeing programs.

Read more →

A swarm of hundreds of OpenAI agents uploaded “malicious packages” to RubyGems and tried to steal API keys, the Ruby community gem hosting service revealed Friday. OpenAI confirmed part of the disclosure, saying, “our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information. We’ll continue to…

Read more →

Using his social-media megaphone to roil the waters, Musk is promoting a new anti-immigration party.

Read more →

A likely North Korean advanced persistent threat (APT) group used a previously undocumented Linux espionage toolkit to compromise load balancers, gain access to communications, and further exploit networks.

Read more →

New capabilities help organisations move from fragmented information to confident action while keeping people in control

Read more →

New AI literacy program equips non-developer employees with the judgment, risk awareness and responsible-use habits needed to safely adopt AI-powered workflows

Read more →

Microlise is set to take the stage at MegaTrans 2026, bringing its expertise in fleet safety, compliance and connected technology to one of Australia’s biggest transport and…

Read more →

SAP SEhttps://www.sap.com/ announced the availability of the new TabPFN-3.5 model from Prior Labs, an SAP company.

Read more →

Fujitsu Limited today announced the global open-source release of its quantum application development software, Open Quantum Application Research Package OpenQARP code name.

Read more →

Frontier AI applied to secure, air-gapped code repositories accelerates testing of validated vulnerability chains and recommending remediation of potential issues.

Read more →

Manchester City has today announced an extension of its long-term partnership with Qualtrics, further enhancing its ability to deliver exceptional fan experiences on matchdays…

Read more →

The same casino-style page may support illegal gambling, defraud customers or conceal a command-and-control endpoint.

Read more →

Today, Google is introducing two new models that bring advancements in near real-time reasoning to more effectively enable voice agents and make conversing with AI feel more…

Read more →

Enterprises will gain greater visibility and control as they scale AI while reducing unexpected costs and operational risk with Splunk announcing new observability innovations.

Read more →

Avalara, Inc., the agentic AI leader in global tax and compliance, today announced that after a thorough evaluation of its strategies and capabilities, the company has been…

Read more →

– We’re introducing Meta One, a new subscription service on our apps that offers higher AI usage and enhanced expression features, plus professional tools for creators and…

Read more →

Testing Uncensored refers to a lack of typical guardrails or ethical restrictions, lowering the technical barrier of entry into cybercrime

Read more →

Deeper Network Promo

Internal company materials illustrate an AI-powered effort to make pilfered foreign government documents digestible for police; targets include Russia, Pakistan.

Read more →

AI is expanding what’s possible, but our ability to deliver in the real world hasn’t caught up. We’re still constrained by money, labour, and resources. In Australia, the…

Read more →

Zack Levy, Senior Director of Professional Services, Asia-Pacific Guidewire, the platform insurers trust to engage, innovate, and grow efficiently, has announced the…

Read more →

Splunk has expanded its long-term partnership with AWS to provide customers with faster threat detection and response times, simpler SOC operations and greater automation,…

Read more →

The Global Technology Industry Association GTIA announced its acquisition of The ASCII Group, expanding its global member community and increasing investment in the programs,…

Read more →

Accomplished technology marketing leader joins Nintex to accelerate growth in agentic business orchestration

Read more →

Digital bank Revolut handed hundreds of its customers’ data to someone posing as a government agency.

Read more →

AWS Security Token Service (AWS STS) has simplified session token size limits, giving you more room for your session policies and session tags. STS has replaced the packed policy size and the overall session token size limits with a single token size limit of 4,096 bytes. STS now reports session token size in API responses,…

Read more →

Corsica Technologies and IDEA are partnering to expand adoption of IDEA Exchange by providing electrical distributors and manufacturers access to managed Electronic Data Interchange (EDI) implementation, integration, platform administration, and ongoing technical support.  The partnership targets organizations that lack specialized integration resources but still need to manage ERP changes, new document mappings, eProcurement connections, and…

Read more →

Huntress is expanding into Africa through a distribution partnership with QBS Software Africa, giving MSPs and VARs in the region access to its cybersecurity platform and 24/7 security operations capabilities. The expansion will begin in South Africa before moving into select markets across Sub-Saharan Africa, with QBS providing the local channel relationships, technical support, and…

Read more →

Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild. […]

Read more →

Hours before joining progressives to block a crypto bill that critics said was a handout to President Donald Trump, a top Senate Democrat was lobbying her colleagues to pass the legislation. Sen. Kirsten Gillibrand, D-N.Y., a centrist who leads the Democratic Senatorial Campaign Committee, privately urged fellow Democrats to support advancing a crypto bill that…

Read more →

Oracle addresses 672 CVEs in its September 2026 Critical Security Patch Update with 673 patches, including 104 critical updates. Key Takeaways The September 2026 Critical Security Patch Update (CSPU) contains fixes for 672 unique CVEs in 673 security updates 104 issues (15.5% of all patches) were assigned a critical severity rating Oracle E-Business Suite received…

Read more →

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Secure Email Gateway flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Secure Email Gateway flaw, tracked as CVE-2026-76461 (CVSS score of 9,8), to its Known Exploited Vulnerabilities (KEV) catalog. Cisco disclosed a critical zero-day CVE-2026-76461 this week;…

Read more →

Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to more than 200 customers after a threat actor compromised the maintainer’s website and pushed updates that created a hidden user account. […]

Read more →

You can’t make an omelet without breaking a few eggs, and you can’t patch nearly 1,000 CVEs without a few glitches.

Read more →

Cisco released emergency patches for a critical vulnerability in its Secure Email Gateway appliance that could allow attackers to take over the device by simply sending malicious crafted emails to users. The flaw was already being exploited in the wild when the fixes were released. Tracked as CVE-2026-76461, the vulnerability is described by Cisco as…

Read more →

A Cybersecurity and Infrastructure Security Agency program that provides tools and capabilities to other agencies has to get speedier so it can push them toward being able to move more quickly themselves, an agency official said Tuesday. “We have to get faster,” said Richard Grabowski, acting branch chief of service delivery and deputy program manager…

Read more →

The ‘Breaking’ News: The OpenAI–Hugging Face Incident – A Technical Reconstruction and Its Implications for AI At this Black Hat USA 2026 talk, OpenAI security engineers and researchers will reconstruct the OpenAI-Hugging Face incident and examine its implications for AI security, cyber resilience, and alignment. Throughout the session, they will share insights that address key…

Read more →

Your consumer identity and access management (CIAM) system is the foundation of your customer experience. It’s how users sign in, access services, and engage with your applications. As your business scales across geographies, ensuring authentication is always available becomes a core architectural requirement. However, building multi-Region authentication has traditionally required complex custom replication solutions that…

Read more →

Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on…

Read more →

The organizations shaping agentic AI standards are gaining a philanthropic voice. The Agentic AI Foundation announced that the Gates Foundation has joined as its first philanthropic member. AAIF said the collaboration is intended to bring perspectives from underserved communities into agentic AI development, particularly in agriculture, healthcare, and financial services. For channel partners and technology…

Read more →

AI is changing cybersecurity on both sides of the equation. Attackers are using AI agents to accelerate credential attacks, while businesses face growing risks from employees using unauthorized AI tools. In the first episode of Channel Insider’s new video series, Inside the Headlines, host Victoria Durgin breaks down recent warnings from Google and the UK’s…

Read more →

Join a real-time written chat with WSJ’s personal tech columnist Nicole Nguyen on Wednesday Sept. 16 from 1 p.m. to 2 p.m. ET. WSJ subscribers can submit their questions at any time in the comments space.

Read more →

The full-service malware-as-a-service (MaaS) platform offers a Windows implant, command-and-control (C2) infrastructure, and an operator panel for comprehensive remote access.

Read more →

CenterPoint Energy disclosed a breach compromising some customers’ personal information after an attacker leaked data allegedly stolen from the utility company. […]

Read more →

Cybersecurity agencies in the United States, the United Kingdom, and the Netherlands have detailed a Windows malware that they say Iran’s intelligence service uses to spy on dissidents, journalists, and activists around the world. The malware is controlled via the Telegram messaging app and can copy a target’s emails and chat messages, take screenshots, and…

Read more →

Oracle began a new round of layoffs this week, sending early-morning termination emails to staff for the second time in six months. The latest wave began Monday with affected staff being told, “After careful consideration of Oracle’s current business needs, we have made the decision to eliminate your role as part of a broader organizational…

Read more →

Just because Apple now has AI, a new folding iPhone, and a newly minted CEO doesn’t mean the litigation between it and OpenAI has gone away. Apple now wants to force OpenAI to let it look at the hardware it has been building, according to a new report. A reasonable request? It seems a reasonable request, doesn’t it? After all,…

Read more →

Khosla Ventures, Blackstone and Marc Benioff are among the investors putting $200 million into the startup.

Read more →

Plus, AI honchos call for a slowdown, and SB Energy’s risky business.

Read more →

Cisco’s firewall management infrastructure has become an active entry point for ransomware operators and advanced threat actors. Cisco Talos said Sept. 9 that it is tracking three intrusion clusters exploiting two vulnerabilities in Cisco Secure Firewall Management Center (FMC). The campaigns include an advanced persistent threat actor whose tooling overlaps with Russia-linked Sandworm and a…

Read more →

The principle of least privilege is straightforward to articulate but challenging to maintain at scale. When teams first deploy applications to AWS, they often grant broader permissions than strictly necessary; it’s faster to get things working, and the plan is always to tighten permissions later. But later rarely comes. Permissions accumulate, AWS Identity and Access…

Read more →

Attackers of unknown origins and motivations are exploiting a critical zero-day vulnerability in Cisco Secure Email Gateway, authorities and researchers said Monday. The vulnerability — CVE-2026-76461 —  was exploited before Cisco disclosed and patched the defect Monday and allows unauthenticated, remote attackers to execute commands with root privileges on vulnerable systems. “In practical terms, that…

Read more →

The tech journalists at 404 Media learned that OpenAI is hiring hundreds of contractors to read and review a massive stream of real users’ ChatGPT prompts and responses. “Project Lily” is reportedly a program that asks contractors to score or critique ChatGPT’s answers to improve the chatbot’s quality and behavior. The fact that prompts may…

Read more →

Deeper Network Promo

Passwords are not the only keys attackers want to Microsoft 365 accounts. They are increasingly targeting the authentication process itself. Microsoft warned Sept. 9 that attackers are using passkey-themed social engineering to trick users and compromise cloud identities. The campaigns can ultimately give attackers access to Microsoft 365 services including Exchange Online, SharePoint, OneDrive, and…

Read more →

I have not done this type of diary in a while: What traffic will you see from a system on boot, before a user logs in? I just took a quick look at macOS 27 “Golden Gate” to see what traffic you should expect. Here are some of the highlights: I captured about 300 packets.…

Read more →

Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows and Linux systems. The emerging malware family, codenamed BambooToken, is assessed to be active since at least February 2023 and put to use in attacks targeting organizations across Asia and…

Read more →

The PCI Security Standards Council (PCI SSC) has published a new information supplement addressing the security of artificial intelligence (AI) systems. This document covers both security aspects of using AI in payment environments and considerations when securing traditional systems against attacks that utilize AI systems. PCI SSC developed this document in collaboration with industry stakeholders…

Read more →

A new report highlights the vast growth in fraudulent candidates, presenting significant insider threat challenges to organizations

Read more →

TrustedTech research found a widening gap between AI adoption and enterprise governance, with 87% of IT and telecom workers saying they are confident using AI effectively even as 68% expressed concern about shadow AI.  For MSPs and technology partners, that disconnect is creating an opportunity to help customers put governance, security and approved AI alternatives…

Read more →

The 69th edition of The IT Press Tourhttps://www.itpresstour.net/ ran through Ljubljana on 1 and 2 September, and HYCUhttps://www.hycu.com/ used its slot to make an argument…

Read more →

A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems. […]

Read more →

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical GitLab vulnerability to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. Tracked as CVE-2026-85706, the path traversal flaw carries a CVSS score of 10.0 and affects self-managed GitLab Community Edition and Enterprise Edition installations. Under certain conditions, it can allow…

Read more →

Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress to upload a PHP backdoor. […]

Read more →

Cisco has patched CVE-2026-76461, a critical zero-day vulnerability in Secure Email Gateway appliances that is already being exploited in the wild. The flaw carries a CVSS score of 9.8 and enables an unauthenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system simply by sending a specially crafted email through…

Read more →

Attackers have opened a new front in their war on software developers: Vite servers, which they are probing for sensitive data including cloud credentials, infrastructure configuration and environment files. Vite was created as a build tool for Vue, a JavaScript framework for building user interfaces and web applications, but has now become a widely used…

Read more →

Fenix24 found only four of more than 800 clients came close to stated ransomware recovery targets of 24-48 hours

Read more →

AI is accelerating enterprise IT modernization, but rising costs and continued reliance on legacy systems are complicating those efforts, according to new Ensono research, which found that 71% of organizations have exceeded their original modernization budgets. The State of IT Modernization Report 2026: Enterprise Reality Check found 54% of decision-makers say AI has accelerated modernization…

Read more →

The 69th IT Press Tourhttps://www.itpresstour.net/ ran through Ljubljana on 1 and 2 September, and the Veridion session contained a screenshot of the Slovenian Business…

Read more →

NinjaOne is expanding its Unified IT Operations Platform with Browser Management, giving MSPs and enterprise IT teams centralized visibility and control over browser extensions, web access, and policies.  The new capability extends NinjaOne’s endpoint management model into a layer increasingly tied to SaaS, AI tool usage, and browser-based security risk. READ MORE: NinjaOne continues to…

Read more →

F5 has announced enhancements to F5 Distributed Cloud Bot Defense, introducing new device intelligence capabilities and specialized agentic AI protections. These capabilities bring persistent device context and continuous risk decisioning to application security, giving organizations the real-time agent management designed to help welcome trusted digital interaction while helping stop automated fraud and abuse. These updates…

Read more →

AI is shrinking the time between vulnerability disclosure and exploitation, leaving defenders less time to wait for patches or public exploits. Picus Security explains how exploitability validation, security control testing, and autonomous pentesting can help teams close exposure gaps before attackers arrive. […]

Read more →

Alleged Black Axe leaders extradited to the US over romance scams, BEC and money laundering claims

Read more →

Postman has announced the general availability of Passport by Postman, marking the company’s expansion into API security with a standalone product that gives organizations a secure way to consume APIs as human and non-human identities increasingly work side by side. The new product keeps real API credentials inside customers’ environments while giving security teams full…

Read more →

UltraViolet Cyber has announced the launch of Equinox, its proprietary detection engineering platform, built and operated by the Threat Intelligence & Detection Engineering (TIDE) team. Equinox maximizes detection coverage across customers’ Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) tooling using AI and automation. Security environments, telemetry and threat frameworks change…

Read more →

Australia’s move from the Essential Eight to an outcomes-based cybersecurity model will push organizations from conducting periodic point-in-time, checklist compliance assessments to having continuous evidence of a solid security posture. Key takeaways The Australian Signals Directorate (ASD) is moving from the Essential Eight cybersecurity framework to a new outcomes-focused Essentials series covering enterprise IT, cloud,…

Read more →

Multiple vulnerabilities have been discovered in Cisco Secure Email products, the most severe of which could allow for remote code execution. Cisco Secure Email Gateway (formerly ESA) is an email security appliance that filters spam, malware, and other threats at the mail gateway. Cisco Secure Email and Web Manager (formerly SMA) is a centralized management…

Read more →

Globalgig has expanded its managed security portfolio to cover enterprise AI, bringing together services that discover, assess, and protect the AI applications, agents, models, and data enterprises are putting into production. The services are delivered through the same managed model that already covers the edge, endpoints, identities, and security operations. Enterprises are adopting AI faster…

Read more →

Even if you’re not ready for iOS 27, there’s an important new update for you too. Here’s what’s new.

Read more →

Plus, how FedEx’s CEO and tech chief work together

Read more →

Cisco warns of a critical zero-day in Secure Email Gateway, exploited in the wild to gain root access through malicious emails. Cisco disclosed a critical zero-day, tracked as CVE-2026-76461 (CVSS score of 9.8), affecting Secure Email Gateway appliances. The flaw can be exploited remotely without authentication. Attackers can send specially crafted emails containing malicious SQL…

Read more →

Attackers increasingly bypass traditional defenses by logging in with credentials that have already been stolen, exposed, or sold on the Dark Web. As infostealer malware accelerates credential theft, organizations need greater visibility into identity risk across Active Directory, IAM, and authentication environments. Download the e-book to explore: How infostealers are reshaping the credential threat landscape…

Read more →

Bring-your-own-cloud (BYOC), eBPF and OpenTelemetry (OTel)-native platform, groundcover, is joining the Google Cloud Partner Network as a Select Google Cloud Technology Partner and will now be an approved workload for Google Kubernetes Engine (GKE) Autopilot. groundcover brings observability to GKE Autopilot GKE Autopilot is Google’s fully managed Kubernetes cluster and protects users by only running…

Read more →

Fleet Device Management has joined Anthropic’s Project Glasswing as the device management vendor looks to address a widening security gap between how quickly vulnerabilities can be exploited and how fast organizations can identify and remediate them. The move comes as Fleet’s recent Road to AI in IT survey found 79% of organizations take more than…

Read more →