Apple patched zero-day CVE-2026-86950 in CoreGraphics, exploited in sophisticated targeted attacks against specific iOS users. Apple has released security updates for iOS, iPadOS and macOS to fix a zero-day vulnerability, tracked as CVE-2026-86950, in CoreGraphics that may have been exploited in attacks against specific individuals. The flaw is an out-of-bounds write that can lead to…

Read more →

Source control records who committed code. It does not record who made the decisions behind it, and that gap is widening as AI agents take on more of the delivery process. This session explores how organisations can adapt accountability models for an AI-assisted development environment. What’s covered: How organisations can adapt accountability models for an…

Read more →

Dyna Software has made Platform Copilot generally available, expanding its use of AI to help ServiceNow teams design, build, test, and review configurations from business requirements. First introduced at Knowledge 2026, Platform Copilot connects to a customer’s ServiceNow development instance and can generate workflows, forms, applications, and other configurations from natural-language requirements and visual inputs.…

Read more →

As laboratories around the world race to build out a cryptographically relevant quantum computer, we at Cloudflare are racing towards a 2029 target deadline for full post-quantum readiness. While we’ve already transitioned many of our products to post-quantum encryption, we still have work to do to support post-quantum authentication and achieve full post-quantum readiness across our platform. We’re…

Read more →

Twelve years ago, during Birthday Week 2014, we turned on Universal SSL and nearly doubled the number of encrypted sites on the web overnight, giving free TLS to every site behind Cloudflare, including the ones that never paid us a cent. Encryption stopped being an expensive, time-intensive undertaking and instead became the default. For Birthday Week…

Read more →

When you type in an address into a browser, how do you know you’re connecting to the right website? The Web Public Key Infrastructure (Web PKI) is the complex and distributed ecosystem of policies, protocols, and infrastructure operators that helps you trust that you’re not being misdirected to an incorrect or malicious website. In the…

Read more →

Organizations can now scale threat intelligence expertise the way they scale infrastructure. Threat intelligence analysts and network defenders have long automated the ingestion of structured threat feeds to help enrich their SIEM or WAF. The harder work has always been unstructured reporting: turning a research post into indicators your tools can use, without losing the…

Read more →

Today, we are introducing additional post-quantum (PQ) cryptography visibility tools into Cloudflare’s Application Security and Logs products. You can now inspect and graph the adoption of post-quantum TLS 1.3 encryption for live traffic from directly within Logpush, Log Explorer, and the HTTP Traffic Analytics dashboard. By surfacing the key exchange algorithm negotiated on every incoming request from visitors…

Read more →

Today, we are launching Application Profiles, a seamless way to enforce a positive security policy. By analyzing the structure and format of HTTP requests and identifying deviations, Cloudflare can help you significantly reduce the attack surface area. Every customer we speak to wants to know how we can protect them from attacks that use frontier…

Read more →

A Facebook Marketplace buyer arrived at a seller’s apartment to collect a keyboard. The seller wasn’t home and didn’t know anyone was coming. Meta’s AI assistant Muse had handled the conversation, shared his address, and arranged the visit without telling him. We often write about AI misalignment and how to use AI agents and browsers…

Read more →

Meta has introduced Muse for Small Business, adding skills and connectors to its personal AI agent to help business owners get work done using the tools they already use. Muse launched earlier this month in the US and Canada and can complete tasks on a user’s behalf. Business owners can connect Muse to their Instagram…

Read more →

Vega has introduced Vega II, its biggest platform release since emerging from stealth. The update brings frontier AI trained for security operations into the SOC, gives teams a lasting record of what they have learned, and removes the legacy SIEM and data pipeline barriers that have kept vital information out of reach. With Vega II,…

Read more →

Plus, Nvidia CEO Jensen Huang says AI advancement and safety go ‘hand-in-hand’

Read more →

Phishing exposure reached 69.9% across five key US industries, with finance and manufacturing facing the highest levels, according to ANY.RUN data.

Read more →

Arms Cyber is increasing its investment in its Managed Security Service Provider (MSSP) program after seeing early traction with MSSP partners, as the company expands its platform beyond ransomware prevention to include AI policy enforcement and data resilience.  The move gives security providers a broader set of services they can layer onto existing customer relationships…

Read more →

Nearly nine in 10 IT leaders surveyed by Delinea said an AI tool or agent accessed sensitive data beyond its intended scope during the past year, highlighting a widening gap between enterprise AI governance policies and organizations’ ability to enforce them. AI policies are widespread, but enforcement lags The research draws on two global surveys…

Read more →

Nearly three-quarters of security leaders have encountered or suspect a deepfake attack in the past year, while just 10% say their organizations have purpose-built defenses, according to Pindrop’s 2026 Deepfake Readiness Index. Real-time communications have become a target for deepfake and AI impersonation attacks. Phone calls to IT help desks, remote job interviews, and video…

Read more →

Malware peddlers are using sponsored Google results to push a malicious ChatGPT Custom GPT named “Plus 5.6,” created to lead users to a fake Cloudflare CAPTCHA check and, ultimately, make them download and run a remote access trojan (RAT). “The campaign has impacted dozens of users: the Huntress SOC has responded to at least 40…

Read more →

What’s been hiding for years is now in plain sight: AI poses a danger to humanity in a way no technology has since the atom bomb. That was made clear in July when OpenAI agents broke loose from a containment area blocked from online access, made their way into the internet, and worked with thousands…

Read more →

A Vietnamese national was charged with money laundering for his role in a massive “pig butchering” scam, which defrauded a victim out of $16 million worth of cryptocurrency. […]

Read more →

OpenAI’s GPT-6 Astra carried out supply chain attacks on software outside the scope of a security test, according to the UK AI Security Institute (AISI). Anatomy of an unsanctioned simulated supply-chain attack (Source: AISI) AISI tested the model before its public release. The tests ran inside a simulation, so no live systems were touched. The…

Read more →

A teen hacker found an authentication flaw in Microsoft’s Titan analytics service, where metadata indicated an estimated 17.3…

Read more →

Plus: U.S. extends 50% rule start under China trade truce, and the possible next House intel chair aims to probe ‘nakedly corrupt dealings’

Read more →

Twenty-minute training sessions that fit into the workweek could help new hires become productive sooner, keep employees’ skills current and build problem-solving skills they can use across different tools, according to SkillBit’s The Shift to Continuous Cybersecurity Micro-Training report. Reasons for missing development goals (Source:SkillBit) More than 80% of executives surveyed used their full 2025…

Read more →

About one-third of MSPs expect their AI-related revenue to increase by more than 20% in 2026 compared with 2025, according to Informa’s latest MSP 501 Survey. The 2026 MSP 501 Survey Insights Report surveyed more than 600 MSPs, drawing on business inputs and aggregated financial and operating data. MSP 501 finds AI revenue expectations rising…

Read more →

Apple has released updates for iPhones, iPads, and Macs to fix a flaw that could let an attacker run code when a device processes a malicious file. Apple says it may have been used in highly targeted attacks against iPhone users running versions of iOS before iOS 27. The fix is in iOS and iPadOS…

Read more →

The smart-ring maker said it was postponing its listing despite strong demand.

Read more →

Palo Alto Networks is expanding its work with NVIDIA to help companies control what AI agents can access and do. The collaboration covers agent activity, network traffic and identity management through NVIDIA’s Open Agent Safety Platform reference design. Palo Alto Networks Securing Agents within NVIDIA Open Agent Safety Platform (Source: Palo Alto Networks) AI agents…

Read more →

Attackers are using greater sophistication to gain access to high-yield targets like executives, and company-wide security measures can easily miss these subtle, personal attacks. Executive Threat Detection offers protection for up to 10 principals, with monthly custom threat hunts and reports relevant to those principals’ corporate systems. Proactive attention from incident response experts gives executives…

Read more →

For a few years now, I have noticed a variety of people misusing the term “technical debt,” incorrectly applying it to almost anything that needs to be updated. Despite Shakespeare’s disregard for the importance of naming (“A CIO by any other name would still be ignored”), naming is strategically vital in enterprise IT. This is…

Read more →

Apple announced its first foldable iPhone on September 9, and scammers were ready to ‘deliver’ one before anyone could buy it. Most of what we found around the launch of the iPhone Duo and iPhone 18 Pro was familiar fraud. But one fake preorder page was different. The fake Apple-style page offers a $500 voucher…

Read more →

Plus, Middle East oil exports rebound and Goldman’s board discusses a plan to name its next CEO.

Read more →

Apple has shipped iOS and macOS security updates to fix an actively exploited zero-day vulnerability (CVE-2026-86950) in the operating systems’ Core Graphics framework. “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,” the company said,…

Read more →

Microsoft is turning Copilot into more than an AI assistant, giving channel partners more to sell than licenses. The company unveiled a redesigned Copilot built around Home, Code, and Autopilot, expanding the platform into delegated work, app creation, and persistent AI agents. At the same time, Microsoft is pushing usage-based billing, FinOps, incentives, and managed…

Read more →

Tokyo Metro and Keio have revealed separate cyber-attacks

Read more →

Deeper Network Promo

Kiteworks has lifted a temporary shutdown recommendation which was issued on the back of federal intelligence

Read more →

A reminder for anyone who thinks their AI chats are private: A human may see what they upload. A report from 404 Media this week describes contractors reviewing Copilot users’ photos, editing requests, and the images Copilot produces. Some of what they see is disturbing. The third-party companies hired to conduct these reviews present their…

Read more →

Hackers stole patient data from Qbusoft, a Polish medical software maker, weeks after a breach at another provider exposed records of nearly 19 million people in the country. The data comes from Medyc, a platform the company sells to medical offices and clinics to manage patient registration, records and prescriptions. In August, attackers stole data…

Read more →

Midmarket companies often need cloud migration and AI support without the time or staff to build every project from scratch. Accenture Edge and Amazon Web Services announced on September 22 that six packaged offers are now generally available through AWS Marketplace. The services cover data discovery, virtual machine migration, contact centers, cloud cost reviews, AI…

Read more →

Every AI story at Autodesk University this year eventually comes back to the same argument: capacity, not ideas, is the constraint holding architecture, engineering,…

Read more →

American tech company Kiteworks has lifted a precautionary advisory asking customers to shut down systems after patching a critical vulnerability. […]

Read more →

Cloudflare released EmDash 1.0, a free, open source content management system that locks each sandboxed plugin in its own isolated runtime. A plugin starts with access to its own private storage. It cannot reach the site’s content, media, users, secrets, environment, filesystem, or network until it declares what it needs and a site administrator approves…

Read more →

Con artists are targeting timeshare owners who want out – and some victims are hit twice

Read more →

A live, continuously updated timeline of the cyber attacks reported in September 2026 — tracking threat actors, attack techniques, targeted sectors and countries as each incident is vetted and added.

Read more →

Dutch authorities have confirmed that they arrested a 24-year-old man from Amsterdam in connection with the ShinyHunters group. “It is true that this month a 24-year-old man from Amsterdam was arrested in an investigation into the hacker group ShinyHunters,” the Politie Landelijke Opsporing en Interventies said in an X post Monday. Police said the individual…

Read more →

Cyberattacks observed in September showed how difficult it has become to separate malicious activity from legitimate business workflows. Attackers used trusted cloud services, familiar document-sharing platforms, legitimate authentication flows, remote-management software, and rapidly changing infrastructure to hide different stages of their operations. For SOC teams, this creates a visibility problem: one alert rarely shows the…

Read more →

Anthropic has released Claude Sonnet 5.5, an AI model for coding and office work. The company says it responds more than 30% faster than its predecessor and uses fewer tokens to complete many tasks, reducing the cost per task without changing its listed API price. The model is available with zero data retention and through…

Read more →

Apple released security updates to fix a zero-day vulnerability exploited in “extremely sophisticated” targeted attacks on iOS devices. […]

Read more →

Dutch police confirm the arrest of a 24-year-old Amsterdam man as part of an investigation into the ShinyHunters hacking group. Dutch police confirmed this week that a 24-year-old man from Amsterdam was arrested earlier this month as part of an investigation into the cybercrime group ShinyHunters. The suspect appears before Rotterdam District Court today, September…

Read more →

GitHub Security Lab researcher Kevin Stubbings built custom AI-driven audit workflows, called taskflows, on top of the lab’s open source Taskflow Agent, and used them to find and report more than 20 vulnerabilities in Android apps. Two of the disclosed bugs show what’s at stake. In OsmAnd, a navigation app with over 10 million downloads…

Read more →

UK AISI finds GPT-6 Astra launches unsanctioned supply-chain attacks in simulations far more than earlier OpenAI models, even when told not to. The UK’s AI Security Institute tested GPT-6 Astra before its public release, and the results, published September 28, aren’t subtle. When given a routine cybersecurity evaluation, the model went off script and attacked…

Read more →

Check Point’s own research says 77% of organisations have rewritten their security strategy because of AI. Only 26% say they have the architecture to enforce what they wrote.

Read more →

A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real service, the SDK’s maintainers said in a security advisory. Affected versions sent the client secret, the authorization code, and the PKCE proof key to a token endpoint the…

Read more →

OpenAI on Monday shelved plans to release GPT-6.1 Astra, a next-generation artificial intelligence (AI) model that was planned for an October launch, after it failed internal safety and alignment audits. The development was first reported by The Wall Street Journal. The move “marks a rare case of a major AI developer ditching a new release…

Read more →

In this Help Net Security video, Guilliano Molaire, founder of Skycloak, explains how to map vendor concentration risk. A company may pay 30 vendors and think its tools are spread out, but many of those vendors run on the same few providers underneath, such as one cloud, one identity provider, one DNS service, one email…

Read more →

Cofense Vision now fully integrates with Google Workspace, giving organizations a faster, more accurate way to find and remove phishing threats that reach Gmail inboxes. Even with strong email security in place, sophisticated phishing attacks still evade traditional perimeter defenses. How do you find and remove the threats that make it through to the inbox?…

Read more →

OpenAI said it has made the decision to pause training of its most powerful models after one of its agents during reinforcement learning (RL) training contacted an external chatbot by exploiting a loophole in its internet-access restrictions. “An agent attempting to complete a search-based training task queried a public chatbot service through a gap in…

Read more →

Presented here is a curated selection of noteworthy open-source cybersecurity solutions that have drawn recognition for their ability to enhance security postures across diverse settings. Open-source secrets scanning tool Sift hunts credentials in Microsoft 365, Slack, and Jira Sift is a free, open-source command line tool that searches for passwords, API keys, and other sensitive…

Read more →

Application Security Researcher Novee Security | Israel | Hybrid – View job details As an Application Security Researcher, you will test web applications and APIs to verify vulnerabilities found by Novee’s AI platform and document how they can be exploited. You will help customers reproduce and fix findings, investigate missed or inaccurate results, and work…

Read more →

The new DMP370 brings continuous dew point monitoring to hazardous locations across hydrogen, biomethane, natural gas and industrial gas applications

Read more →

No. 3-ranked SAS extends its unmatched 22-year run in the Top 10

Read more →

Australia Post has signed a multimillion-dollar, three-year agreement with Telstra to deliver next-generation connectivity across almost 4,000 locations nationwide, helping to…

Read more →

Together with NVIDIA, SAP is helping shape and strengthen the execution layer for enterprise agentic AI.

Read more →

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Read more →

Nvidia on Monday rolled out an agentic governance system called the Open Agent Safety Platform that combines software with out-of-band DPU-based silicon in a reference system design that it says will secure agents “from testing to deployment.” But while the Nvidia design’s silicon-based component provides some cybersecurity advantages, analysts argued that it cannot help with…

Read more →

Cracked trays, high costs and a dice dilemma bogged down a quest to produce a version of the classic game in the U.S.

Read more →

Citrix took most of the weekend to confirm that attackers were actively exploiting the newest round of NetScaler zero-days, leaving network defenders and threat hunters to react without official confirmation.  Yet, behind the scenes, multiple CERTs, advisory firms, insurance providers, researchers and chatty security professionals warned their respective peers and communities of a live and…

Read more →

This article was first published on LinkedIn.

Read more →

The more data you hand over, the more this talented personal assistant can do for you.

Read more →

For many Australian families, a backyard pool is more than a place to cool off. It is where kids swim after school, friends gather for weekend barbecues, and warm evenings are…

Read more →

Deeper Network Promo

Apple today released patches for all of its operating systems. However, only patches for older branches include a security fix. The vulnerability being addressed in iOS 26, macOS 26 and macOS 15 is already being exploited. iOS and macOS 27 are not affected. Today’s update for the current “27” branch does not address security issues,…

Read more →

The model, dubbed GPT-6.1 Astra, was due to debut inside ChatGPT and Codex in October.

Read more →

ShinyHunters tells Hackread it never planned to publish or sell stolen FBI data and says its ultimatum was part of a marketing campaign to counter FBI claims.

Read more →

The critical vulnerabilities, which impact default configurations of NetScaler products, essentially give attackers a skeleton key to customers’ networks.

Read more →

A high-severity zero-day vulnerability affects the TDengine time-series database used across industrial, IoT, energy, and automotive environments.

Read more →

Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrupting  some of its business systems. […]

Read more →

The first update to iOS 27 squashes a bug in which the iPhone 18 Pro and Pro Max would freeze or restart when you try to use Face ID.

Read more →

Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclosed late last week. […]

Read more →

The botnet uses the open source Hermes Agent AI framework to execute commands via Telegram and steal AI API keys from exposed Docker hosts.

Read more →

Infostealers are exposing corporate AI accounts, sessions and API keys, giving attackers access to sensitive data, compute and connected systems. SOCRadar analyzed stealer log data from the last 90 days and found 482 companies with exposed AI accounts and credentials. Of those, 295 appeared in active logs during that period, suggesting the exposure is recent…

Read more →

Dutch police have confirmed that a 24-year-old Amsterdam man arrested earlier this month was detained as part of an investigation into the ShinyHunters hacking group. […]

Read more →

Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks. The vulnerability, tracked as CVE-2026-86950, refers to an out-of-bounds write impacting the CoreGraphics component that could lead to arbitrary code execution when processing a maliciously crafted file. The…

Read more →

NVIDIA has launched its Open Agent Safety Platform, bringing together software, compute and infrastructure controls designed to govern autonomous AI agents as more than 100 technology companies back or integrate with the initiative. The platform combines NVIDIA OpenShell, Vera and Sentry to secure how agents execute tasks, access systems and interact with data across software…

Read more →

Researchers found more than 16,000 misconfigured Supabase databases exposing readable tables with personally identifiable information, passwords, or authentication tokens. […]

Read more →

Enterprises regularly rigorously monitor human employees, while autonomous AI agents quietly operate with broad privileges that could turn them into the next generation of insider threats.

Read more →

Hackers have used a malware family called NeedyMantis to maintain long-term access to networks they had already breached, Microsoft said in a technical analysis. The malware has been seen in a small number of targeted intrusions at telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Its use goes back to at least

Read more →

Amid growing concerns from both the public and policymakers about cyberattacks involving advanced AI systems, NVIDIA has released a new open software security platform for AI agents. The Open Agent Safety Platform, according to NVIDIA, will be “an open software platform and reference system design with full-stack governance and control across the software and hardware,…

Read more →

What is IAM for AI agents? AI agents authenticate, invoke tools, and act across enterprise systems with delegated authority. IAM for AI Agents is the identity-control architecture that governs those actors. This guide covers the limits of conventional provisioning, the components that matter, how to evaluate framework choices, and what runtime evidence proves an agent…

Read more →

The PCI Security Standards Council (PCI SSC) has published the first major revision to the PCI Secure Software Lifecycle (Secure SLC) Standard and its supporting Program documents. The PCI Secure SLC Standard is one of two standards that are part of the PCI Software Security Framework (SSF). It provides security requirements and assessment procedures for…

Read more →

Dutch police arrested convicted hacker Pepijn van der Stap in the ShinyHunters probe into the Odido breach, which exposed data belonging to millions of customers.

Read more →

The attacker who stole about $388 million from the cryptocurrency exchange Bitget gained access through a vulnerability in a third-party security product the exchange used, Bitget said on Monday. The attacker exploited the flaw to obtain high-level internal credentials and then, on September 24, used them to send fraudulent withdrawal commands to Bitget’s wallet system.…

Read more →

RatHat’s operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer runs a separate copy. The console stores what the malware collects from…

Read more →

OpenAI has paused training, evaluation, and inference involving tool use for its most-capable AI models after an agent bypassed network restrictions to communicate with an external chatbot during reinforcement-learning training of an internal research model. “Our safety case assumed that the model could not access the live internet and that monitoring would detect attempts that…

Read more →

On Saturday, October 24, 2026 we will conduct an exercise, demonstrating that the AWS European Sovereign Cloud can operate without depending on any infrastructure outside of the European Union (EU). For several hours, the AWS European Sovereign Cloud will operate without a connection to the AWS Global Network backbone. The backbone is the private network…

Read more →

The global tech industry, politicians at home and abroad, and international media coverage are transfixed by one question: Will rogue AI end humanity? Few seem to be asking this question of the Department of Defense. The artificial intelligence sector has rocked itself in recent weeks following a string of disclosures from the frontier AI labs…

Read more →

A purported ad-blocker exfiltrates reams of sensitive information, and benefits from having Google’s stamp of approval despite researcher warnings.

Read more →

The new wired USB-C earbuds mix old-school elements with modern audio features.

Read more →

Channel partners are increasingly being asked to solve a different cybersecurity problem: not how to add more tools, but how to turn sprawling security stacks into services that deliver measurable outcomes. That shift is becoming more urgent as customers face growing security complexity, AI-related risk, and persistent skills shortages. Recent Channel Insider reporting found 46%…

Read more →

The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components. […]

Read more →