U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple Multiple Products flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apple Multiple Products flaw, tracked as CVE-2026-86950 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. This week, Apple has released security updates for iOS, iPadOS…

Read more →

Autonomous AI agents go on a hacking spree, and Microsoft ships what used to be a year’s worth of security patches in one go – here’s how to keep pace

Read more →

Two men who ran BEC and phishing campaigns against US businesses while serving in the Air Force have been sentenced to a combined 189 months in federal prison. According to public documents and evidence presented at sentencing, Chijioke Timothy Odimegwu, 25, and Harafat Mogaji, 26, both from Delaware, spent nearly two years sending spam and…

Read more →

Mandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access. Mandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been…

Read more →

As aviation infrastructure suffers more cyberattacks, air traffic systems are the latest target, with a ransomware toolkit installed on at least one operational network.

Read more →

Genea has announced the release of Genea MCP, a Model Context Protocol (MCP) server that connects AI agents directly to the Genea Access Control platform. Onboarding a new hire, setting up a contractor for two weeks, or unlocking the loading dock now takes one sentence instead of a dozen clicks. Genea is one of the…

Read more →

More than 100 security and compliance vendors have integrations with the Claude Compliance API, which lets a company send Claude activity into the monitoring tools it already uses. CrowdStrike, Microsoft Purview, Splunk, Palo Alto Networks, Cloudflare and Zscaler are among them. For a Claude Enterprise customer, the feed includes the conversations themselves, the files people…

Read more →

OWASP Noir is an open-source static analysis tool that reads an application’s source code and lists the endpoints it exposes: paths, HTTP methods, parameters, headers, and cookies, each tied to the file and line it came from. Here’s where it gets useful. Shadow APIs, the endpoints that live in the code but never made it…

Read more →

Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-88772 (CVSS score: 9.5), has been described as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling that’s rooted…

Read more →

DigiCert AI Trust Manager brings cryptographic identity, authority, and an enforceable kill switch for autonomous agents running in NVIDIA OpenShell.

Read more →

SAS has been named a Leader in the IDC MarketScape: Worldwide Decision Intelligence Platforms 2026 Vendor Assessment.

Read more →

Starting in full force on Dec. 10, 2024, the EU Cyber Resilience Act (CRA) is a regulation (EU 2024/2847) that defines mandatory cybersecurity requirements for all products with digital elements sold in EU markets. Reporting obligations will begin on Sept. 11, 2026, with full enforcement kicking in on Dec. 11, 2027. The CRA brings new requirements for teams working…

Read more →

BH Consulting, the Irish cybersecurity and data protection consultancy, has launched BH Haven, an ongoing service that gives Irish small and medium-sized enterprises (SMEs) access to its specialist consultants, supported by a proprietary AI tool for analysis, evidence review, regulatory mapping and reporting. Ireland and the UK come first, with the Nordic countries and other…

Read more →

Detectify analyzed exposure data from 1,293 of its customers in the US, the UK and the Nordics and found that most serious flaws still open on their internet-facing systems are months old. Of the critical and high-severity vulnerabilities open at the time of the snapshot, 97% in the Nordics had been exposed for more than…

Read more →

Microsoft made WSL containers generally available and shipped the feature with controls that let administrators switch it off or limit where it pulls images from. WSL containers run Linux containers on Windows through the Windows Subsystem for Linux. They install with wsl –update or from Microsoft’s GitHub releases page. If your developers work on Windows…

Read more →

Cisco surveyed 8,000 security professionals in 30 markets about how well their organizations defend against AI-era threats, and only 8% landed in the top group. Cisco gave the most weight in its scoring to internal friction, meaning the delays and turf problems inside a company that slow a security team when something changes. Cisco says…

Read more →

Cloudflare plans to become a public certificate authority (CA), an organization that issues the digital certificates websites use to encrypt traffic and prove who they are. The company said that its CA will issue conventional certificates and a post-quantum type called Merkle Tree Certificates (MTCs), with production MTC issuance scheduled for the first quarter of…

Read more →

The Essential Eight maturity model, last updated in November 2023, is still the current framework Australian organisations are assessed against. ASD consulted in June and July…

Read more →

TrendAI Vision One™ pairs hardware-level detection on NVIDIA BlueField DPUs and network security with Zero Day Initiative™ threat intelligence, helping enterprises safely move…

Read more →

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Read more →

Independent recognition reflects Kinetic IT’s deep public sector experience and expanding technology capabilities.

Read more →

Managed cloudhttps://andersenlab.com/services/managed-cloud services are an operational model in which a specialized provider continuously manages, secures, monitors, and…

Read more →

In this post, I will show you how to search the Dark Web safely and what an .onion search engine actually indexes. “Dark web” is a technical description, not a moral one. The name covers anything reachable only through an anonymity network: .onion services on Tor, eepsites on I2P, and the smaller networks beside them.…

Read more →

In this post, I will show you 8 companies delivering CVE-Free container images in 2026. Key Takeaways “CVE-free” can mean zero at delivery, zero under contract, or zero beyond the base layer, and only the last two hold up over time. Echo is the top pick, extending CVE-free coverage from the base image to application…

Read more →

Investors were clamoring for newly issued shares a few months ago, but a recent string of delayed offerings illustrates how quickly investors’ enthusiasm for shares of risky new companies can cool.

Read more →

Key Takeaways – A virtual CISO should function as a security leader, not simply as an external compliance consultant. – Effective engagements usually begin with an assessment…

Read more →

Meta is once again repositioning itself to target the enterprise market. This week, the company announced the Meta Enterprise Platform, which it says will evolve its AI stack into products and services that enterprises can deploy into operations, rather than just using them for advertising and social media campaigns. While the company provided few details…

Read more →

Microsoft is taking Windows Subsystem for Linux beyond just running Linux distributions, as WSL Containers is now generally available. […]

Read more →

Enterprise penetration testing is moving away from a calendar-based exercise. Infrastructure changes continuously; developers release code multiple times a week, or even…

Read more →

Operational technology OT environments are changing rapidly. Digital modernisation has already increased connectivity between industrial systems, IT, cloud platforms,…

Read more →

Last year, Amazon Ads announced the unification of the demand-side platform and ads console into a single media buying experience. One of the standout new features was a…

Read more →

The more than $20 billion award for F/A-XX adds to string of wins for company’s defense business.

Read more →

The activity is linked to a broader campaign that previously used a different delivery mechanism

Read more →

Delivering over 30 of your top-requested features

Read more →

Until recently, Australian CISO’s and security leaders could confidently say they know who has access to the company’s most sensitive systems: a named list of employees, each…

Read more →

Deeper Network Promo

Company becomes first observability provider to earn ISO/IEC 42001 Certification, joins the EU AI Pact

Read more →

Progress is accelerating rapidly and the shifts we are seeing are fundamental. AI-driven software development and autonomous systems are making it significantly easier to write…

Read more →

New research reveals a gap between AI policy and enforcement, and that 64% bypassed the required approval process for using AI

Read more →

New agents enable employee self-service and identity administration capabilities in Google Cloud Gemini Enterprise

Read more →

Research highlights marketplace growth, as influencers and AI reshape Australia’s $2.2 billion beauty ecommerce market

Read more →

A Pennsylvania police department is expanding the role of its community video network after more than 16 years of using Milestone Systems’ open-platform video management…

Read more →

Boomi recognised as a Leader in evaluation of agentic process orchestration software

Read more →

The fact that almost one-fourth of Anthropic’s revenue last year came from just two customers, and that many of its largest customers have not signed long-term contracts, could translate into a much stronger negotiating position for enterprise CIOs. According to a detailed analysis by Reuters, the company’s confidential prospectus depicted a company that might be…

Read more →

Announced at AutoSens Europe, OMNIVISION’s new OAX7700 ASIC enables feature customisation and over-the-air updates for always-on parking surveillance camera systems, supporting…

Read more →

Vodafone is Australia’s first telco to launch a 48-month, interest-free mobile device payment plan, giving customers greater choice and flexibility in how they pay for their…

Read more →

New Automations and an enhanced Resolution Centre help IT teams reduce repetitive troubleshooting and create a more consistent approach to resolving endpoint issues.

Read more →

Dutch police say a ShinyHunters suspect is also suspected of trying to arrange two murders abroad, a case separate from the cybercrime investigation.

Read more →

Attackers are exploiting CVE-2026-86950, an out-of-bounds write flaw, in an extremely sophisticated fashion, according to Apple.

Read more →

Attackers remained undetected for more than three weeks as they exploited a critical zero-day vulnerability affecting Citrix NetScaler appliances en masse.  The earliest known instance of CVE-2026-88772 exploitation occurred Sept. 3, Mandiant researchers told CyberScoop Tuesday.  The besieged security vendor and researchers didn’t confirm the attacks until late last week. By then, Mandiant says, organizations…

Read more →

Signal, the secure messaging app, released version 8.30, completing the rollout of its secure backups feature across all supported operating systems (Android, iOS, Linux, macOS, and Windows). […]

Read more →

A patched Unsloth Studio vulnerability allows malicious AI models to execute arbitrary Python code during inspection, via the trust_remote_code setting.

Read more →

Setting up a self-managed super fund SMSF can look simple—until the hidden costs appear. One provider leaves out the $636 ASIC company fee, another hands over a deed but skips…

Read more →

Custom variants of OpenAI’s ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware. […]

Read more →

Keio, a major Japanese railway operator, was hit by ransomware, disrupting business systems and forcing the company to shut down its network. Keio Corporation, one of Japan’s major private railway operators, was hit by a ransomware attack over the weekend, disrupting some of its business systems. The company detected a system failure early Saturday and…

Read more →

Baha Azarmi runs observability at Elastic, and he keeps coming back to one idea: you can’t trust an autonomous agent you can’t show your working on. It’s a useful lens for…

Read more →

The president says industry “self regulation” and existing authorities including the Justice Department will keep artificial-intelligence tools safe.

Read more →

The FBI is warning members of the ShinyHunters extortion group to turn themselves in after Dutch police arrested a man the bureau described as one of the group’s alleged leaders. […]

Read more →

DNSFilter is expanding its Channel Partner Program with three reseller tiers designed to give partners clearer paths to higher margins, market development funds, dedicated channel support, and executive sponsorship. The new Select, Accelerator, and Strategic tiers are intended to help resellers build and scale protective DNS practices while giving more established partners access to additional…

Read more →

A group of Russian government hackers is refining its attacks to make it easier to eavesdrop on victims and significantly expand its targets among governments, think tanks and nonprofits around the world, with an emphasis on Ukraine, Microsoft research published Tuesday concludes. The company examined a change in the approach of a group it calls…

Read more →

The U.S. government is working with critical infrastructure operators to integrate artificial intelligence into the nation’s most vital systems and strengthen cyber defenses, National Cyber Director Sean Cairncross said Tuesday. “We have been working closely, and I believe it is functioning well to get models deployed throughout sectors as quickly as possible, and they can…

Read more →

Google analysts warn that stolen AI credentials are being sold underground, and businesses are footing the bill.

Read more →

Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. […]

Read more →

SAN FRANSICO, Sept. 25, 2026, CyberNewswire — Archipelo today announced Salmon, Execution Verification Infrastructure (EVI) for AI agents and autonomous systems, powered by a cryptographic protocol designed to make execution history verifiable. Salmon establishes verifiable execution history and state lineage across humans, AI agents, and automation. The launch follows the OpenAI–Hugging Face incident, in which…

Read more →

Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. […]

Read more →

OpenAI now lets teams create documents, build presentations, and work with AI agents inside ChatGPT

Read more →

Learn when stablecoins work for cross-border payments and how businesses can compare settlement speed, FX costs, fees and liquidity with traditional payment rails.

Read more →

An attacker used stolen passwords of staff at France’s tax administration to take tax data on hundreds of thousands of taxpayers and businesses in June and July. Neither the tax administration nor France’s national cybersecurity agency saw the data leave. The attack was not sophisticated, the agency, ANSSI, says in a report (in French) published on Tuesday:…

Read more →

Microsoft has started rolling out Windows 11 26H2 to everyone, and while it’s this year’s big annual feature update, you probably won’t notice a massive difference after installing it. […]

Read more →

Amazon’s free Kindle Unlimited deal only comes around a couple times a year – and I highly recommend it.

Read more →

Deeper Network Promo

AI could change MSP service delivery in a bigger way than simply resolving support tickets faster. Shield Technology Partners recently launched Forge, an internal AI platform designed to automate MSP service delivery. The company says the technology can resolve half of actionable helpdesk tickets, while one MSP using the platform has reduced technician ticket-resolution time…

Read more →

A new Branch Target Reuse (BTR) attack has been devised that can recover root password hashes on Intel computers running Linux in 3-5 minutes on average. […]

Read more →

Automated certificates for everyone, built for today, and hardened for the era of quantum computing.

Read more →

A group of academics from VUSec and Scuola Superiore Sant’Anna have disclosed details of a new Spectre CPU vulnerability variant that affects Just-In-Time (JIT) engines present in web browsers, language runtimes, and the operating system kernel, across multiple CPU vendors. The new Spectre-v2 variant has been codenamed Branch Target Reuse (BTR). “The key insight is…

Read more →

Students, job seekers and university staff, watch out for fake job offers sent from legitimate university email accounts.

Read more →

Students, job seekers and university staff, watch out for fake job offers sent from legitimate university email accounts.

Read more →

Plus, OpenAI scraps a model release, and AI-generated food ads gross people out

Read more →

The Dutch Institute for Vulnerability Disclosure (DIVD) suffered an AI-driven cyberattack that the organization described as “loud and very, very messy.” […]

Read more →

Authorities arrested an alleged leader of ShinyHunters, the notorious cybercrime group responsible for a string of high profile extortion attacks since 2025, including last week’s attack on the FBI. The Dutch National Police said they arrested a 24-year-old man in Amsterdam accused of participating in the cybercrime group. Officials haven’t named the accused man, but…

Read more →

Getting a software product into a cloud marketplace is one step. Turning that listing into repeatable sales is another. Microsoft announced the availability of Frontier Accelerate for Marketplace on September 28. The program gives eligible software companies a staged path to publish B2B products, including AI apps and agents, generate Marketplace transactions, and pursue additional…

Read more →

Microsoft observed a China-based actor using a previously unidentified malware framework in targeted intrusions against telcos, universities, medical, and government-related organizations.

Read more →

Manus’s relationship with Meta? It’s complicated. Just months after they called off their merger, they find themselves competing in the market for agentic AI platforms. Awkward! The company has just released a rebuilt version of its AI agent platform: “Manus 2.0 is not a version update. It’s a new architecture, new products, and new capabilities,”…

Read more →

The hacking of internet-exposed, vulnerable Citrix NetScaler ADC and Gateway deployments has escalated. What started as stealthy targeting via zero-day exploits has now become widespread “spray and pray” exploitation, fueled by the publication of a root-cause analysis and a proof-of-concept exploit for CVE-2026-88771, which is remotely exploitable on unpatched devices with the default configuration. From…

Read more →

OpenAI has scrapped the planned October release of GPT-6.1 Astra after internal testing found the model did not meet the company’s safety and alignment standards. GPT-6.1 Astra was being developed as a more autonomous model capable of handling complex tasks with less human assistance, and was expected to be integrated into ChatGPT and Codex. But…

Read more →

RatHat’s C2 panel now builds malware and ranks victims with AI across nearly 100 deployments

Read more →

Apple has released emergency security updates to address a CoreGraphics vulnerability that may have been exploited in a highly targeted attack against specific individuals. Tracked as CVE-2026-86950, the flaw is an out-of-bounds write issue that can lead to arbitrary code execution when a vulnerable Apple device processes a maliciously crafted file. The vulnerability was reported…

Read more →

Kiteworks on Monday said it worked with federal intelligence authorities over the weekend as it identified and addressed a critical security vulnerability during the scheduled precautionary shutdown. “During the shutdown, this activity led to the discovery of a previously unknown critical vulnerability confined to a capability that is enabled for less than 1% of the…

Read more →

Kiteworks, a provider of secure file transfer and data-sharing tools, told customers Monday they could resume normal operations after a weekend-long precautionary shutdown prompted by what it called “credible threat intelligence” from federal authorities. The recommendation, issued last week, advised customers to take production systems offline ahead of a potential imminent attack. The company also…

Read more →

Pentagon personnel agency breach exposed data of 3 million people after attackers accessed a file-sharing server for about nine months. The U.S. Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense, is notifying people that their personal information was exposed in a data breach. According to the agency, unauthorized users…

Read more →

Identity governance helps control who should have access, but periodic reviews alone may not reveal attacks as they happen. tenfold Software explains how real-time identity telemetry can help security teams investigate suspicious activity before it escalates. […]

Read more →

AWS AgentCore SDK flaws could let attackers run commands in AI sandboxes and reach AWS credentials

Read more →

LastPass has announced an expansion of its Business Max offering to include AI Monitoring & Protect and Web Monitoring & Protect, new visibility and governance capabilities that enable organizations to identify and secure the AI tools, SaaS applications, and websites its employees use, all from its existing browser-native extension. AI Monitoring & Protect closes the…

Read more →

Cybersecurity researchers have identified a cluster of 101 npm packages that are used to trap developers into a WhatsApp group subscriber campaign dubbed PhantomSub. “The malicious packages abuse the ‘Baileys’ WhatsApp open source project to add the victims to groups without their consent,” OX Security researchers Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko…

Read more →

Postman has announced the general availability of Fabric Gateway, a protocol-agnostic control plane for governing how AI agents, LLMs, and MCP servers discover and interact with APIs, tools, and other agents. With Fabric Gateway, organizations can securely connect AI agents to their APIs while centrally controlling what agents can discover, access, and do without introducing…

Read more →

Microsoft Threat Intelligence warns that NeedyMantis threat actor from China has targeted organizations across a range of industries

Read more →

Starting yesterday, our sensors picked up a small number of scans for “wordfence-waf.php”. This particular script is used by Wordfence, a solution to protect WordPress sites. During the Wordfence install, the wordpress-waf.php file will be created in the site’s root directory [1]. The requests themselves are unremarkable, not including any headers like User-Agent. Just the…

Read more →

Apple patched zero-day CVE-2026-86950 in CoreGraphics, exploited in sophisticated targeted attacks against specific iOS users. Apple has released security updates for iOS, iPadOS and macOS to fix a zero-day vulnerability, tracked as CVE-2026-86950, in CoreGraphics that may have been exploited in attacks against specific individuals. The flaw is an out-of-bounds write that can lead to…

Read more →

Source control records who committed code. It does not record who made the decisions behind it, and that gap is widening as AI agents take on more of the delivery process. This session explores how organisations can adapt accountability models for an AI-assisted development environment. What’s covered: How organisations can adapt accountability models for an…

Read more →

Dyna Software has made Platform Copilot generally available, expanding its use of AI to help ServiceNow teams design, build, test, and review configurations from business requirements. First introduced at Knowledge 2026, Platform Copilot connects to a customer’s ServiceNow development instance and can generate workflows, forms, applications, and other configurations from natural-language requirements and visual inputs.…

Read more →