Live feed
MyCyber News
Your daily cybersecurity news feed in one view.Curated, concise, and connected.
Your daily cybersecurity news feed in one view.Curated, concise, and connected.
Last feed pull: Sep 24, 2026, 2:02 AM (UTC+3)
Topic · Awareness
Security Slam 2026 – Fall Edition is a 30-day virtual event from October 5 through November 6, 2026. By Eddie Knight and Stacey Potter What Is the Security Slam? The Open Source Security Foundation (OpenSSF) is partnering with the Cloud Native Computing Foundation (CNCF) Security Technical Advisory Group (TAG Security) to support the 2026 Security Slam at KubeCon + CloudNativeCon North America. The 30-day challenge runs from October 5 through November 6 and highlights OpenSSF projects as practical tools that help improve project security posture. Participants will use OpenSSF projects, among others, to achieve security hygiene milestones tailored to their project’s maturity level.
Overview Imprivata Enterprise Access Management (EAM), an authentication and single sign-on platform for enterprise and clinical environments, contains a vulnerability in versions 26. 2. 6 and below. The product provides no supported mechanism to rotate its RSA key pair after deployment, meaning the same key pair is used indefinitely to generate the appliance's X. 509 certificate. Description CVE-2026-82356 Imprivata EAM uses an RSA key pair to generate the X. 509 certificate that identifies the appliance to the clinical workstations, Electronic Health Record (EHR) platforms, and shared-device workflows that rely on it for authentication. After reviewing the product documentation and engaging Imprivata support, it was confirmed that no supported mechanism exists to rotate this RSA key pair after deployment.
A bug in the Windows Sept patch Tuesday update may stop File History from working. But a new optional update fixes it.
By Chad Gish In digital forensics, the difference between a missed lead and a breakthrough can come down to a single artifact, a single decision, or one detail hidden in a sea of data. The goal is not to simply to collect more evidence, but to collect more of the evidence that matters. Effective investigations depend on identifying the right sources, preserving the most relevant data, understanding what the evidence means, and avoiding the missteps that can leave critical information undiscovered. Evidence that once existed only in notebooks, photographs, and witness statements now lives across smartphones, computers, cloud platforms, vehicles, applications, and countless connected devices. This evolution has created incredible opportunities for investigators, but has also introduced significant challenges: • The volume of digital evidence continues to grow.
A sideloaded package turns a Microsoft-signed binary into an OAuth token theft tool. No phishing domain, no spoofed UI, no browser. Here's how to detect it.
CVE ID : CVE-2026-95626 Published : Sept. 23, 2026, 10:17 a. m. • 42 minutes ago Description : Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce. Severity: 8.3 • HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Concerns over agentic risks are rising, and identity and access management (IAM) giant Okta believes it’s making the moves of a would-be leader in this emerging cyber market. “Identity is the primary control plane for securing AI,” said Okta CEO and co-founder Todd McKinnon in an earnings call in late August , telling investment analysts that the company’s customers see Okta as well-positioned to secure this agentic future. “And so we’re going after that on all fronts.” “We think that being the system of record for agents in the enterprise and being the system of record for agent identity, in the fullness of time, could be the biggest category of cyber,” he added. At the center of that strategy is Okta for AI Agents, an identity management and security platform for tracking and controlling agentic entities and activity.
The Cybersecurity and Infrastructure Security Agency (CISA) is going old school to help organizations with limited resources set traps for hackers.
Microsoft, along with a group of industry partners, disrupted EvilTokens, a short-lived but highly consequential cybercrime platform that investigators linked to more than 12,000 compromised Microsoft customer email inboxes across more than 10,000 organizations globally, the company said Tuesday. Acting on federal court order Sept. 15, Microsoft and partners seized 50 websites the phishing-as-a-service used for operations and disabled more than 175 domains linked to EvilTokens’ supporting infrastructure. EvilTokens, launched in February 2026, was “a powerful cybercrime platform that used AI at every step of the attack chain — from compromising email accounts to designing intricate roadmaps for financial fraud and scams,” Steven Masada, associate general counsel and general manager of Microsoft’s Digital Crimes Unit, wrote in a blog post .
Your conversations with AI chatbots are both highly personal and deeply vulnerable to surveillance. Here’s how you can protect yourself.
Security teams investigating possible AI-related security events need guardrail intervention data alongside their existing security telemetry. When a guardrail identifies or blocks a prompt injection attempt or redacts sensitive data, that intervention carries additional investigative value comparable to a failed sign-in or a network intrusion alert. AWS Bedrock publishes this telemetry to AWS CloudWatch metrics and model invocation logs for operational monitoring. In this post, I show you how to transform AWS Bedrock Guardrails intervention events into structured Open Cybersecurity Schema Framework (OCSF) Detection Finding records and land them in the CloudWatch unified data store . Launched in December 2025 , the unified data store consolidates operational, security, and compliance data from AWS services and third-party sources into a single platform.
Cybersecurity is often perceived in a highly formal, checkbox way: a mandatory line item in the budget, insurance against an attack, or an extra task for the IT team. But for SMBs, this approach doesn’t work well. As a company grows, so does its dependency on digital technology, which increases the number of potential entry points for attackers. Cloud services, business applications, extra devices for new hires: all of this generates new risks. Eventually, the question of how much to invest in cybersecurity gives way to a different one: how can it help the business grow without putting extra strain on the budget and staff? That’s the point where cybersecurity stops being just defense against threats, and instead becomes a driver of business growth.
AI agents are becoming the new attack surface, exposed to poisoned skills, prompt injection, jailbreaks and attacks through connected tools. I read the AI security research published in a single month, February 2026, and when you put it all together, it’s not a list of curiosities. It’s a field guide to a new attack surface. In my previous piece, I explained how MITRE ATLAS catalogs threats to AI. Here, I take the next step: I map that research onto ATLAS. What emerges is a complete kill chain, and the target is no longer the model. It’s the agent. A Month of Research, and a Shifting Target When you look at AI security research published in a single month, one thing stands out: much of the work has stopped focusing on model behavior in isolation and has started examining real attack paths through agents, skills, protocols, and connected environments .
This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804 , that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif . The root cause of the bug was a dangling COM object registration for the CrossDevice COM object with the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} . A COM registration typically needs two parts: a server executable, which for in-process components is a DLL and a CLSID entry under the HKEY_CLASSES_ROOT registry key which points to that DLL. This object was registered in the system wide classes key, meaning it was accessible to all users on the system, including system services. However the server executable was missing. Specifically it was registered to use the DLL %PROGRAMDATA%\CrossDevice\CrossDevice. Streaming. Source. dll .
CVE ID : CVE-2026-94038 Published : Sept. 20, 2026, 5:16 p. m. • 3 hours, 40 minutes ago Description : A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main. tsx of the component Deno Backend. Such manipulation of the argument supabase_url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 8389032e5d52c28c4855c6126ca7d0eae8af346a. It is best practice to apply a patch to resolve this issue. Severity: 7.5 • HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...
The audit blind spot in external OS command execution Responsible-research note. Everything below was performed on a self-owned SAP lab. No third-party or production system was involved. The purpose is defensive: to show exactly where SAP does, and does not, record operating-system command execution, and to give blue teams working detections and remediation. The audit-log screenshots have been redacted to remove the workstation account name and local file paths; the remaining identifiers ( vhcalnplci, NPL, npladm) are the public defaults of the free SAP Developer Edition and carry no sensitive information. No IP addresses, credentials, or license keys appear anywhere in this article. Why I went looking Every SAP hardening checklist says the same thing about external operating-system commands: restrict S_LOG_COM and S_RZL_ADM, and review your SM69 command list. Good advice.
Cybercrime is any criminal activity that targets or uses a computer, network, or internet-connected device, from stealing financial data and holding systems for ransom to impersonating individuals online and disrupting critical infrastructure. Unlike traditional crime, it rarely requires physical proximity to a victim: a single attacker can compromise thousands of accounts across different countries without ever leaving their desk. What makes cybercrime distinct isn’t just where it happens, but how fast it’s growing and how much it costs. Global losses from cybercrime are projected to reach $10. 5 trillion annually by 2025, according to Cybersecurity Ventures, a figure that would make it, if measured as a national economy, larger than every country except the US and China.
How to Comply with MiCA Regulations for Crypto Asset Service Providers in the European Market? hackread. com
Back in my analyst days , I built maturity models for a SOC (2018), a SIEM (2018), vulnerability management (2017) and threat intel (201?) Later, just for fun, I cooked up a simple SOAR adoption maturity model (2022). All of them were vaguely CMM-shaped: you start ad hoc, you get defined, you get measured, you get optimizing, magic! The ordering was not decorative. Each level existed because the one below it produced something the next level needed. Largely, you cannot jump levels, and if you do jump, you land in clown realm . this is how Gemini imagines this blog 2026, now the pitch has changed. With AI (agentic, of course!) , the story goes, a low maturity SOC can leap to maturity Level 3 or 4 “because AI”. No slog through the “defined process” desert, no “organic” growth through stages. Buy the agents, skip the years!
As part of DataBreaches. net ’s ongoing investigation into the Navigate360 breach, this report covers approximately 94,000 unclassified but sensitive tips submitted through P3 Global Intel apps and websites used by the military. What has Homeland Security done in response to the breach? When the Navigate360 breach first broke, DDoSecrets. org called it “BlueLeaks 2. 0” because of the… Source https://databreaches.net/2026/09/18/the-u-s-military-leaked-more-than-93000-tips-via-insecure-p3-global-intel-has-anyone-been-notified/1post-1participantReadfulltopic
Why adding nodes to your primary site hurts performance, and how to scale with secondary sites instead https://www.security.com/product-insights/part-1-why-less-more-symantec-pam-clustering1post-1participantReadfulltopic
These invites sneak past your security software to embed themselves in your calendar. But you can thwart them before they do any damage.
How to quickly check to see if your Linux server is under a DoS attack from a single IP address TechRepublic
Nominations are open for the 2026 Security Serious Unsung Heroes Awards , celebrating the people working behind the scenes to make the UK safer and better protected from cyber threats. This year’s awards will take place on 20 October at Balfour St Barts in London, bringing together cybersecurity professionals, educators, researchers, journalists and industry leaders during Cybersecurity Awareness Month. A new Best Academic Entrepreneur category has also been introduced for 2026, recognising academics who have taken cybersecurity research beyond the university environment and turned their ideas into viable businesses. The new category is supported by CyberASAP, the UK Government-backed Cyber Security Academic Start-Up Accelerator Programme, which celebrates its tenth anniversary this year.
How to Become a White Hat Hacker TechRepublic
AI-powered malware is making a familiar security problem harder to contain. Instead of keeping the same code long enough for antivirus tools to recognize it, these programs can alter their form repeatedly while retaining the same harmful purpose. The emerging model relies on large language models as an automated code factory. A malicious dropper can request a newly obscured version of itself at regular intervals, while related tools can generate short commands for collecting documents. That reduces the time and specialist skill traditionally needed to create fresh samples. Morphisec analysts noted the shift after reviewing reports of PROMPTFLUX, an experimental dropper disclosed by Google’s threat researchers in late 2025. The sample reportedly queried the Gemini API about once an hour and regenerated obfuscated code, with researchers seeing more than 70 variants in under four hours.
Quick Answer: Cloud compliance splits into two jobs: technical posture against benchmarks where free Prowler and CNAPP compliance ( Wiz , Prisma Cloud , Orca ) lead and audit evidence automation for SOC 2/ISO where Vanta , Drata , and Scrut dominate. Most teams need one from each column. Compliance is where security meets paperwork, and the cloud has made both continuous: auditors now expect automated evidence, not annual screenshots, while frameworks from SOC 2 to PCI DSS 4.0 demand proof that controls run all the time. The critical buying insight for 2026 is that “cloud compliance tool” means two different products technical posture scanners that check configurations against CIS/NIST benchmarks, and compliance-automation platforms that collect audit evidence across your whole stack.
How to reset a user’s privacy permissions on macOS and iOS TechRepublic
OpenAI launches a formal framework to disclose model misalignment, publishing six reports on models that lied, faked data, or bypassed rules. Most companies don’t publish a document explaining how their product misbehaves. OpenAI just did. On September 16, it released a formal framework for tracking, investigating, and disclosing cases of model misalignment, paired with six actual incident reports covering the last six months. OpenAI admits that its previous way of sharing these findings was not very organized. Some discoveries were grouped together, others were saved for system cards, while some were held back until there was enough information for a larger report. The new framework aims to make the process faster by publishing what researchers find, even before OpenAI fully understands the issue or knows how to fix it. There is also a pretty direct admission in the announcement.
Malicious extensions and ClickFix attacks are two hugely popular topics on our blog, and for a good reason: they’re both very common. In this post, we bring them together. Here’s the thing: in our posts about malicious ClickFix instructions, we don’t always explain exactly how users end up on the attackers’ pages in the first place. A recent study gives us a chance to fill that gap and talk about one of those methods: malicious extensions. Readers who are not deep into cybersecurity may already have a bunch of questions at this point: how can extensions be malicious? where do they come from? and what exactly is ClickFix, anyway? Fret not: this post answers all these questions. The danger of browser extensions Let’s start with the basics. Browser extensions or add-ons are lightweight tools installed in your browser to give it extra capabilities or change how it works with web pages.
The past few weeks have “felt very strange” for Juan Andres Guerrero-Saade. Like many, he is trying to sort through the spate of frontier-model AI agents from OpenAI , Anthropic , Meta and others hacking their way onto the open internet over the past few months, particularly amid the already-heated national debate around the emerging technology and its impact on society. Guerrero-Saade, a fellow for AI and threat intelligence at SentinelOne and an adjunct professor at Johns Hopkins University, said the hacks are worth taking seriously, but at a time when businesses and open-source maintainers should be focused on further hardening their systems and policymakers should be discussing new solutions, “what we see is cybersecurity being used essentially as an excuse for these AI doomer arguments.”
At the end of August, a malspam message was caught in the quarantine of a mail gateway operated by one of my customers. The message was not especially remarkable â it asked the recipient to review some attached requirements and provide a price quotation for a fiber optic system and appeared to impersonate an employee of a legitimate company.
An incident response plan only works if it’s tested. Learn the 5 pillars of operational resilience and how to turn your plan into muscle memory before an attack hits.
AI hasn’t just made building faster, it’s made everyone a builder. Across every department, employees are shipping apps, agents and automations using AI tools, often without knowing they’ve created something that needs governing at all. The result: AI code sprawl is taking root, increasing risk, compromising compliance, and wasting resources. The usual responses aren’t working: not because they’re poorly executed, but because they were never built for a problem at this scale or speed. Drawing … More → The post Download: The IT leader’s guide to AI code sprawl appeared first on Help Net Security .
Cybersecurity awareness has traditionally focused on teaching people not to click suspicious links, open unexpected attachments or hand over their credentials. However, the growing use of an AI assistant inside workplace email systems is creating an attack surface that does not always depend on fooling a person. Research from KnowBe4 ThreatLabs has demonstrated how an indirect prompt injection hidden inside an apparently routine email could manipulate an AI assistant, gain access to information contained in other messages and place that data into an attacker-controlled tracking mechanism. In the researchers’ controlled Google Workspace test, the target did not need to interact with the malicious email itself. An automated workflow processed the message and generated a seemingly legitimate Gmail draft.
Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR 2026). A new free guide explains how autonomous AI agents are closing that gap, and what security leaders must demand before pointing one at production. TL;DR Exploitation is now the front door. It starts 31% of breaches (Verizon DBIR
AI agents are rapidly becoming part of everyday business operations and this increases non-human insider risk. They can improve productivity, reduce repetitive work and help organisations accomplish tasks far more efficiently. The answer, therefore, is not to ban them. Instead, organisations need to manage AI agents with the same discipline applied to human identities, privileged accounts and other powerful technologies. Following on from last weeks article where we explained the ways organisations create non-human insider risk, here are six practical steps security teams can take: • Start with visibility You cannot secure AI agents you do not know exist. Organisations should maintain an inventory of deployed agents, record who owns them, identify the systems and data they can access, and document the actions they are authorised to perform.
CSIDES has unveiled its full agenda for its 2026 cybersecurity community event, with more than 25 industry speakers and a programme of talks, workshops and hands-on activities set to take over Weston-super-Mare’s Grand Pier. Returning on 9th October following its inaugural event in 2025, CSIDES aims to make cybersecurity more accessible to the wider public while encouraging more people to consider careers in the industry. Among those taking to the Main Stage will be threat intelligence manager and award-winning cyber expert Sophia McCall, who will open the event with a session on understanding and managing your personal attack surface. Ant Davis, founder of Risky Creative and a popular cybersecurity content creator, will explore what security awareness professionals can learn from some of history’s most manipulative cult leaders.
Every DevOps team member knows that dealing with an AI is like being a circus lion tamer. The boss and the audience are happy when the lions sit on the pedestal and roar on cue, but there’s always the danger that they’ll go rogue and bring the whole show to a quick and disastrous end. The reality is that running LLMs in production means being ready to handle hallucinations, data leakage, misinformation, madness, or worse. Lately, a range of companies have emerged to offer tools, platforms, and systems aimed at helping AIOps teams shoulder the load of keeping AIs in check. They’re building algorithms that are an amalgamation of psychiatrist, police officer, social worker, politruk, and office snitch. Yes, some have their own LLMs buried inside, an irony not lost on anyone, but at least they’re trying.
Choosing an enterprise threat intelligence solution is about more than just data volume or integrations. The right provider should deliver relevant intelligence, fit existing workflows, and help security teams investigate threats faster. While SOCs may prioritize rapid investigation and enrichment at scale, MSSPs may focus more on multi-tenancy and customer separation. This enterprise threat intelligence buying guide covers the key criteria to consider, including intelligence quality, integrations, data privacy, scalability, and proof-of-concept testing. Key Takeaways • Start by defining your threat intelligence requirements and the security workflows you need to support. • Focus on intelligence quality, freshness, context, and threat intelligence enrichment rather than data volume alone. • Check integrations, API capacity, and STIX/TAXII support before making a decision.