Blahalla

As AI Reshapes the SOC Career Ladder, Satisfaction Rises for 91%, but Entry Gets Harder for Nearly Half

www.darkreading.com · 19 days ago

New Swimlane research underscores a paradox: While AI detection and response is essential to giving defenders an edge, one in four security pros say AI limits their skill development.

Over 543,000 valid credentials exposed in public GitHub repositories

www.bleepingcomputer.com · 19 days ago

More than 543,000 credentials exposed in public GitHub repositories were still valid in July despite the platform's security measures to prevent accidental leaks of sensitive data.

FTC launches broad investigation into Anthropic, OpenAI

www.washingtonpost.com · 19 days ago

The probe reflects a focus by Trump administration officials on using existing laws to tame artificial intelligence safety risks.

Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets

thehackernews.com · 19 days ago

Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team. The attack exploits CVE-2026-73570 (CVSS score: 8.

Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks

thehackernews.com · 19 days ago

Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content.

Cisco Advance Notification for Publication of October 7, 2026, Security Advisories

sec.cloudapps.cisco.com · 19 days ago

On October 7, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Application Policy Infrastructure Controller (security hardening release) Finesse License On-Prem, formerly Cisco Smart Software Manager On-Prem (security hardening release) Meraki (

F.T.C. Investigates OpenAI and Anthropic Over Potential Consumer Harms

www.nytimes.com · 19 days ago

The agency will examine whether A.I. labs have broken federal laws prohibiting companies from unfair and deceptive practices.

CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS

www.bleepingcomputer.com · 19 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a new critical vulnerability in MikroTik RouterOS that could lead to remote code execution or cause a denial-of-service condition.

iPhone Security Warning: Apple Says iOS 26 Flaw May Have Been Exploited

www.techrepublic.com · 19 days ago

Apple patched an iPhone flaw that may have been exploited in targeted attacks. Here’s what iOS 26 users need to know and how to update.

Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager

thehackernews.com · 19 days ago

Attackers are exploiting a critical flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30. The flaw, CVE-2026-76504, could allow a remote attacker with no login access to use the Manager's API as the admin user. Fixed releases are available, and there is no workaround.

Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net

www.darkreading.com · 19 days ago

The APT actor is using a new tactic, dubbed "RedFlick," against Ukrainian-linked targets such as NGOs, think tanks, and journalists to deploy its CosmicPulse backdoor.

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

thehackernews.com · 19 days ago

Threat actors are abusing ChatGPT Custom GPTs to disguise them as legitimate product offerings and direct unsuspecting victims to malicious sites that employ ClickFix lures to deliver malware. Huntress, which observed the activity in late September 2026, said it marks the abuse of yet another feature in trusted artificial intelligence (AI) platforms.

Cisco warns of new SD-WAN zero-day exploited in attacks

www.bleepingcomputer.com · 19 days ago

Cisco released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as CVE-2026-76504) that attackers are actively exploiting to escalate to admin privileges.

Google: AI Is Changing the Pace and Profile of Vulnerability Discovery

www.securityweek.com · 19 days ago

Google’s analysis found that AI-discovered vulnerabilities are more likely to enable remote code execution.

AI's Third Wave: Coworkers Break the Security Model That Worked for Agents

www.bleepingcomputer.com · 19 days ago

Persistent AI coworkers may operate continuously with standing access, creating identity risks that existing security models were not designed to handle. Token Security explains why these agents need their own identities, owners, scoped permissions, and lifecycle controls.

Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570

www.microsoft.com · 19 days ago

Microsoft Threat Intelligence examines CVE-2026-73570 exploitation in Zimbra, including observed attack paths, detection opportunities, and mitigation guidance.

Unsloth’s model picker had a code-execution problem

www.csoonline.com · 19 days ago

True to its name, AI-model-training tool Unsloth would do more work than it was asked to when developers checked out a model: It would also allow arbitrary code to execute on their machines. Pillar Security found that simply selecting a model in Unsloth Studio caused the application to download and execute Python code from the model repository.

RedFlick Uses Scheduled Tasks and Password-Protected Archives to Deploy CosmicPulse Backdoor

gbhackers.com · 19 days ago

Russian state-linked threat actor Star Blizzard has expanded its cyberespionage operations in 2026 with a phishing and malware-delivery technique tracked by Microsoft as RedFlick. Microsoft Threat Intelligence reported that the group, which CISA attributes to Russia’s Federal Security Service (FSB) Center 18, conducted at least 13 phishing campaigns between January and August 2026.

Microsoft to block Entra ID script injection attacks starting October

www.bleepingcomputer.com · 19 days ago

Microsoft has reminded customers that the Entra ID authentication system will get better protection against external script injection attacks starting next month.

DeepSeek and Huawei Target a Key Source of Nvidia’s A.I. Dominance

www.nytimes.com · 19 days ago

In China’s push for self-reliance in artificial intelligence, DeepSeek and Huawei have teamed up to develop software tools for advanced chips.

WatchGuard Patches Critical Fireware OS Code Injection Vulnerability

www.securityweek.com · 19 days ago

WatchGuard has rolled out patches for 15 code execution, DoS, authorization, and path traversal bugs in Fireware OS.

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

sec.cloudapps.cisco.com · 19 days ago

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.

Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks

www.securityweek.com · 19 days ago

Several security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.

Docker CopyEscape CVE-2026-17106 Lets Malicious Containers Overwrite Host Files

gbhackers.com · 19 days ago

A critical Docker vulnerability tracked as CVE-2026-17106, also known as CopyEscape, could allow a malicious container to overwrite files on the host machine when a user runs the docker cp command.

PaperPhone Cluster Shows How One Bot Operator Can Look Like Thousands of Mobile Users

gbhackers.com · 19 days ago

A large-scale scraping cluster dubbed PaperPhone, exposing how one operator can manufacture the appearance of tens of thousands of legitimate mobile users across dozens of countries. The operation used roughly 75,000 IP addresses across 230 address blocks in 43 countries.

Claude Compliance API Lets Security Teams Monitor Chats, Files and Agent Activity

gbhackers.com · 19 days ago

Anthropic has enhanced enterprise security visibility for its AI assistant, Claude, with the Compliance API. This feature lets organizations extract data on activity, conversations, files, projects, and agent sessions into their existing governance and security operations platforms.

TeamViewer urges users to patch severe flaws “as soon as possible”

www.bleepingcomputer.com · 19 days ago

Remote access software company TeamViewer warned customers on Tuesday to immediately patch a set of high-severity vulnerabilities affecting its client and host software.

Chrome, Firefox Updates Patch Over 100 Vulnerabilities

www.securityweek.com · 19 days ago

Some of the flaws could allow remote attackers to execute arbitrary code or escape the browser sandbox.

Critical MikroTik RouterOS Vulnerability Exposes Devices to Remote Code Execution

gbhackers.com · 19 days ago

A critical vulnerability in MikroTik RouterOS could allow unauthenticated remote attackers to execute code on vulnerable devices or trigger a denial-of-service condition. This vulnerability, tracked as CVE-2026-84411, affects MikroTik RouterOS versions earlier than 7.24 and carries a CVSS v3 severity score of 9.8.

Attackers Target Developer Credentials to Expand Supply Chain Intrusions Beyond Source Code

gbhackers.com · 19 days ago

Software supply chain attacks are increasingly evolving into cloud identity breaches, as attackers weaponize trusted packages to steal credentials from developer workstations and CI/CD environments before an application is ever executed.

12 Best IGA Tools in 2026: The Ranked Buyer’s Guide

gbhackers.com · 19 days ago

Identity governance and administration has become essential as organizations manage employees, contractors, service accounts, machine identities, and AI agents across increasingly complex environments.

Know Your Enemy: Browser-Based Attack Techniques in 2026

thehackernews.com · 19 days ago

Given that the browser is where business apps are accessed and used, it makes sense that attacks are happening there too. Most breaches today begin in a browser session. Often, they never leave it, with the entire attack chain from initial access to exfiltration playing out in the browser. Here are the six most dangerous techniques that should be on every security team's radar in 2026. 1.

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug

gbhackers.com · 19 days ago

Google has released Chrome version 154 for desktop platforms, addressing 32 security vulnerabilities, including a critical buffer overflow flaw in the ANGLE graphics translation layer. This update is being rolled out as version 154.0.8037.92/.93 for Windows and macOS, and version 154.0.8037.92 for Linux.

AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub

thehackernews.com · 19 days ago

AI coding agents asked to share screenshots of code changes for review have put internal company images in public GitHub repositories, security company Glow said. Its researchers found more than 13,000 internal images from developers at over 300 organizations, including customer billing records and screens of features not yet released.

Anthropic Flags AI Agent Liability Risks as OpenAI Faces Hacking Lawsuit

www.securityweek.com · 19 days ago

Attacks by autonomous AI agents are moving out of the lab and into the courtroom, raising unsettled questions about who is liable for what agents do.

Bitget hacked via zero-day in third-party security products

www.bleepingcomputer.com · 19 days ago

Cryptocurrency exchange Bitget revealed today that attackers who stole $387.5 million last week breached its systems after exploiting a zero-day flaw in third-party security products.

I Want Better Reporting on AI Genie Behavior

www.schneier.com · 19 days ago

AI systems are regularly completing tasks in ways that their prompters don’t want or intend. Some of them are disturbing, and some of them are dangerous. This is something I’ve been calling “ genie behavior,” because I think that really gets at the core of what’s happening. I wish the popular press would report on this better.

Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks

www.securityweek.com · 19 days ago

The state-sponsored group has launched larger-scale phishing campaigns to deploy the CosmicPulse backdoor.

US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access

thehackernews.com · 19 days ago

ANY.RUN researchers traced a US-focused CSuite phishing campaign across 351 sandbox analyses, with 51% of submissions coming from the United States. Technology, manufacturing, government, and consulting organizations showed the highest exposure.

Hackers Abuse MSP360 and ScreenConnect RMM Tools for Persistent Access and Credential Theft

gbhackers.com · 19 days ago

The phishing campaigns that weaponize legitimate remote monitoring and management software to establish persistent access and support credential theft on Windows systems.

Pentagon personnel database breach exposes personal data of millions

www.bitdefender.com · 19 days ago

A Pentagon personnel database was breached for nine months without anyone noticing. Over three million people are affected. Read more in my article on the Hot for Security blog.

ShinyHunters Defiant After FBI Calls on Members to Come Forward

www.securityweek.com · 19 days ago

Pepijn van der Stap, suspected leader of ShinyHunters, was arrested in the Netherlands for hacking 140+ organizations and extorting $70M. The FBI warned of data theft from cloud vendors. ShinyHunters called the hack a marketing stunt.

The MFA you have isn’t the MFA you think you have

www.csoonline.com · 19 days ago

Security leaders must recognize that current Multi-Factor Authentication (MFA) methods often fail against targeted attackers. Attackers exploit weaknesses by inducing "push fatigue" with notifications or intercepting one-time passwords using reverse-proxy phishing kits. Newer authentication standards address this failure by requiring verification of the system's legitimate destination.

Hackers Exploit Citrix NetScaler Zero-Day to Gain Root Access and Deploy Web Shells

gbhackers.com · 19 days ago

Exploitation of Citrix NetScaler zero-day vulnerabilities, CVE-2026-88772 and CVE-2026-88771, allows an unauthenticated memory overflow via malformed DTLS record headers over UDP port 443, granting root-level access to Application Delivery Controllers. After initial compromise, attackers deploy custom web shells and establish persistence by modifying system configurations.

RSA Agent ID Secures AI Agents and MCP Servers With Identity-Based Access Controls

gbhackers.com · 19 days ago

RSA's Agent ID tackles AI agent identity gaps. It discovers agents, enforces policies via an AI/MCP Gateway, and manages lifecycle risk. This secures non-human AI actors in regulated environments.

Attackers Use PaperCut RCE Chain to Steal Tokens and Access Domain Controller

gbhackers.com · 19 days ago

PaperCut MF zero-day vulnerabilities (CVE-2026-81578, CVE-2026-82078) hit an education sector. Unauthenticated attackers used these to run Java bytecode, steal a domain token from a domain controller, and plant AdaptixC2 via trojanized mscopilot.exe. Enterprise identity was compromised.

He Was a Tech Investor Before There Was a Silicon Valley

www.nytimes.com · 19 days ago

Bill Draper began funding start-ups in the early 1960s, when the Santa Clara Valley was better known for apricot orchards than microchips. He has died at 98.

How Meta Uses A.I. Data Centers to Avoid Billions in Federal Taxes

www.nytimes.com · 19 days ago

Meta reportedly exploits a tax break designed to support research and experimentation. Internal accountants caution that the company's financial strategy carrying out this tax maneuver presents risk.

Can we jail a superintelligence?

www.csoonline.com · 19 days ago

AI agents exploited shared internal cache in OpenAI infra in July 2026. They coordinated beyond intended boundaries. This shows firewalls and sandboxes fail to contain useful AI agents.

Whatever happened to the 36-month IT security roadmap?

www.csoonline.com · 19 days ago

AI agents challenge security planning. CISOs abandon fixed roadmaps for agile, quarterly risk assessments. This allows faster integration of controls, like vulnerability audits, against emerging AI risks.