Search: “infosec”

New infosec products of the week: August 14, 2026

Vendors A10 Networks, ScienceLogic, Searchlight Cyber, and DataGrout/SelectHub released new security and AI operations products this week.

A weekly product roundup covering four releases: ScienceLogic Skylar AI 2.5 with expanded secure deployment options, Searchlight Cyber's Preemptive Threat Exposure Management platform combining exposure visibility with threat intelligence, the general availability of the A10 AI Gateway for routing and governing enterprise AI traffic, and DataGrout's LLM inference optimization and AI governance platform.

Help Net Security·Aug 14, 00:00 UTC · Aug 14, 2026Tools

New infosec products of the week: September 11, 2026

Weekly product roundup: Securin Platform GA, Orchid Security AI-agent identity controls, Akeyless Agentic Runtime Authority, and Scytale AI-powered TPRM.

Help Net Security's weekly product roundup highlights four vendor launches. Securin announced general availability of its AI-native Preemptive Exposure Management platform combining attack surface discovery, vulnerability intelligence, offensive validation and remediation. Orchid Security added identity drift detection and application-level kill switches targeting AI agents that escalate privileges via hard-coded credentials, orphaned accounts and excessive permissions. Akeyless released Agentic Runtime Authority, a real-time intent-based access control layer on top of its SecretlessAI credential protection, and Scytale launched AI-powered third-party risk management features in its Vendors module.

Help Net Security·Sep 11, 04:00 UTC · 5d agoTools

New infosec products of the week: September 4, 2026

Weekly roundup covers F5's AI-powered WAF enhancements, Ping Identity's personal AI agent access, Superna 2.15 cyberstorage, and BugBase Pentest Copilot Enterprise.

This week's product roundup features releases from BugBase, F5 Networks, Ping Identity, and Superna. F5's WAF for Distributed Cloud adds anomaly detection and agentic threat intelligence for real-time virtual patching, Ping Identity launched Enterprise Personal Agent Access for securing personal AI agents, Superna 2.15 adds guided event-closing workflows for cyberstorage operations, and BugBase's Pentest Copilot Enterprise automates black-box pentesting across 100 vulnerability types using real Chromium browsers.

Help Net Security·Sep 4, 00:00 UTC · 12d agoTools

Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy

Elastic's InfoSec team raised AI alert-triage accuracy from 60% to 92% using three self-correcting agents integrated into Slack triage.

Elastic's InfoSec team deployed three AI agents that read detection-rule investigation guides and closure reasons from 30 days of historical cases to triage alerts. The agentic pipeline lifted triage accuracy from 60% to 92%. Analysts now clear most alerts with a single click in Slack.

Elastic Security Labs·Aug 25, 00:00 UTC · 22d agoTools

New infosec products of the month: August 2026

August 2026 roundup of security product releases from ServiceNow, Tanium, Snyk, F5, A10, Searchlight Cyber, Intezer, NETSCOUT, Tufin, and Abnormal AI.

Help Net Security's monthly product roundup covers roughly a dozen vendors. Highlights include Snyk's general availability of Evo Continuous Offensive Security with AI-powered pentesting and AI agent red teaming, Searchlight Cyber's PTEM platform combining exposure visibility with attacker intelligence, and A10 and F5 AI gateways to govern enterprise LLM and agent usage. Other updates include Abnormal AI email DLP and phishing training, NETSCOUT outbound DDoS mitigation for service providers, Intezer's native Workflows automation, and Tufin's AI-powered Segmentation Intelligence.

Help Net Security·Aug 28, 00:00 UTC · 19d agoTools

New infosec products of the week: August 21, 2026

Weekly product roundup covering NETSCOUT outbound DDoS mitigation, F5 AI Gateway enhancements, Intezer Workflows, and Tufin TOS 5.3.

NETSCOUT extended Adaptive DDoS Protection to automatically mitigate outbound attack traffic for service providers. F5 enhanced its AI Gateway and integrated it into the F5 AI Security Platform for unified AI access governance. Intezer launched Workflows, native automation and response inside its platform without a separate SOAR, and Tufin released Orchestration Suite 5.3 with AI-powered Segmentation Intelligence for multi-vendor environments.

Help Net Security·Aug 21, 00:00 UTC · 26d agoTools

Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA

Okta finds infostealer logs contain thousands of replayable AI session tokens and API keys, letting criminals bypass MFA and access services from Google, Anthropic and OpenAI.

Okta analyzed a 7 GB infostealer dump from August 2, 2026 covering 5,871 infected machines in 162 countries and found 555 of 44,791 JWTs related to AI services, plus 1,843 unexpired JWTs and JWEs (largely set by OpenAI via NextAuth.js) and 24 still-valid API keys for Google Gemini, OpenAI, Groq and OpenRouter. Valid session tokens and API keys can be replayed with anti-detect browsers like Camoufox to bypass credential and MFA checks, fueling an underground market for AI account access known as LLMjacking, where attackers rack up victims' AI compute bills. Some 17.7% of the JWTs contained plaintext PII usable for social engineering. Google's GTIG reported growing buyer demand for Claude, Gemini, Cursor and Devin credentials, and Mandiant handled an incident where an actor used an exposed GitHub PAT to deploy unauthorized AI infrastructure and scale high-performance compute.

The Hacker News·Sep 9, 14:23 UTC · 7d agoThreat actor in the wild1

IT Help Desk Impersonation Lets Hackers Bypass MFA

Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.

Arctic Wolf documented a threat cluster tracked as PREY-0058 that impersonates internal IT help desk staff by phone, luring Directors, VPs, and executives to authentication-themed URLs formatted as victim-organization lure domains. Adversary-in-the-middle panels intercept credentials and MFA approvals, and stolen sessions are replayed through residential proxies such as NodeMaven from IPs matching the victim's geo-location and ASN, defeating impossible-travel alerts. Attackers perform discovery against SharePoint and Entra ID, then harvest data from OneDrive, Exchange, and Box before issuing extortion demands. Defenders are advised to require managed devices, use phishing-resistant MFA like FIDO2, enable Continuous Access Evaluation, and monitor sign-ins, SharePoint SearchQueryPerformed, and MailItemsAccessed events.

Security Affairs·Sep 8, 07:41 UTC · 8d agoPhishing & fraud in the wild1

Cybersecurity jobs available right now: April 14, 2026

Help Net Security lists active cybersecurity job openings at employers including MANTECH, Honeywell, SMBC Group and SBS Transit across multiple countries.

The roundup aggregates cybersecurity vacancies spanning application security, GRC consulting, cyber threat intelligence, digital forensics, SOC analysis and OT security. Openings were posted in India, the United Kingdom, Italy, the USA, Singapore, France, Germany, Ireland and the UAE. Most roles were no longer accepting applications at publication. Named employers include Honeywell, MANTECH, TENEX.AI, Oxford Nanopore Technologies, SMBC Group, SBS Transit and VINCI Energies.

Help Net Security·Aug 26, 09:40 UTC · 21d agoIndustry2

Mythos has made 2026 patching hell. It might make 2027 a breeze

Gartner analyst Craig Lawson argues AI bug-hunters like Anthropic's Mythos have audited major codebases so thoroughly that 2027 could see fewer severe vulnerabilities.

Speaking at Gartner's IT Symposium in Australia, research VP Craig Lawson said AI-driven bug hunting, exemplified by Anthropic's Mythos, is uncovering flaws at unprecedented scale, citing Microsoft shipping over 970 patches in one week and a recent series of CVEs in historically secure OpenBSD. He argued vendors are also using AI to find bugs before release, retiring technical debt and shrinking future zero-day avenues. Lawson predicts 2027 may be the first year with a net drop in vulnerability severity, if not aggregate counts. He also expects AI to enable near-continuous red-teaming and faster fixes, such as generating F5 iRule syntax for virtual patches via Gemini.

The Register · Security·05:54 UTC · 9h agoIndustry1

REVSTEALER ramps up: analysis of up-and-coming infostealer

Elastic Security Labs analyzes REVSTEALER, an emerging infostealer harvesting browser credentials, cryptocurrency wallets, and gaming accounts.

Elastic Security Labs published a deep-dive analysis of REVSTEALER, described as an up-and-coming infostealer. The malware targets browser data, cryptocurrency wallets, and gaming accounts, with credential harvesting as its core function. The report tracks the family's capabilities as it ramps up activity in the wild.

Elastic Security Labs·Sep 2, 00:00 UTC · 14d agoMalware in the wild

Risky Bulletin: White House lets private companies carry out offensive cyber ops

A White House memo directs DHS to create a program letting vetted private companies conduct US-government-directed offensive cyber operations against cybercrime.

A presidential memo tasks the DHS National Coordination Center with building a program, under DOJ and DHS oversight, through which private-sector companies can conduct offensive cyber operations against large-scale cybercrime organizations. Requirements include secure facilities, vetted personnel, a $1 million escrow for damages, and written approvals co-signed by DHS and DOJ executive directors. The program must launch within 60 days, around October 11, expanding a March executive order targeting scam compounds, ransomware, and other large-scale cybercrime.

Risky Business News·Aug 14, 04:42 UTC · Aug 14, 2026Policy & legal

WebPros security advisory (AV26-866)

Canada's Cyber Centre relays a WebPros advisory for CVE-2026-67394, a Plesk privilege escalation flaw to root, fixed in 18.0.79.9 and 18.0.80.5.

The Canadian Centre for Cyber Security issued alert AV26-866 relaying WebPros' security advisory for Plesk. CVE-2026-67394 allows privilege escalation to root and affects Plesk versions prior to 18.0.79.9 and 18.0.80.5. Administrators are encouraged to review the advisory and apply the available updates.

Canadian Centre for Cyber Security·Sep 1, 13:34 UTC · 15d agoAdvisoryCVE-2026-67394

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business News·Aug 19, 04:52 UTC · 28d agoThreat actor in the wild1

Novel macOS Infostealer AmnesiaStealer Spread via ClickFix

Novel macOS infostealer AmnesiaStealer spreads via ClickFix social engineering and lets attackers remotely control victims' browsers to steal cookie data.

Infosecurity Magazine reports on AmnesiaStealer, a novel macOS infostealer distributed through the ClickFix social engineering technique. The malware includes capabilities that let attackers take remote control of the victim's browser in order to steal cookie data. The novel remote-browser-control function distinguishes it from commodity macOS infostealers.

Infosecurity Magazine·Aug 14, 10:45 UTC · Aug 14, 2026Malware in the wild

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News·Aug 21, 02:55 UTC · 26d agoResearch2

HashiCorp security advisory (AV26-910)

Canada's Cyber Centre warns HashiCorp Consul and consul-template have authorization bypass and information disclosure flaws, urging users to apply available updates.

Advisory AV26-910 relays HashiCorp security advisories HCSEC-2026-34, HCSEC-2026-37 and HCSEC-2026-38 covering Consul and consul-template. Consul has an authorization bypass in the catalog node-write path and another in the Connect service mesh, while consul-template has an information disclosure issue in error handling. Fixed versions include Consul 2.0.4, Consul Enterprise 1.21.18 and consul-template 0.43.0. The Cyber Centre encourages users and administrators to review the linked advisories and apply updates.

Canadian Centre for Cyber Security·Sep 11, 13:10 UTC · 5d agoAdvisory1

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business News·Sep 7, 03:42 UTC · 9d agoPhishing & fraud in the wild1

eBook: Identity-First Threat Intelligence

Enzoic promotes an eBook on identity-first threat intelligence addressing infostealer-driven credential exposure across AD and IAM.

Help Net Security promotes an Enzoic eBook on identity-first threat intelligence. It covers how infostealer malware accelerates credential theft, why password reuse turns consumer breaches into enterprise risk, and where traditional IAM and Active Directory protections fall short. The eBook advocates real-time credential intelligence from Dark Web monitoring for earlier exposure detection and automated response.

Help Net Security·Sep 15, 13:00 UTC · 1d agoIndustry

Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited

Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.

The roundup reports at least 274 internet-facing Zimbra instances compromised via CVE-2026-73570, critical Gitea CVE-2026-60004 added to CISA's KEV catalog after exploitation began, and previously patched Citrix NetScaler flaw CVE-2026-8452 exploited in the wild. It also covers PaperCut NG/MF zero-day attacks, a suspected Iran-linked shutdown of a UK power plant, an FBI seizure of domains tied to a China-linked group that hit NASA, DOJ and the Senate, a cyberattack disrupting Boston Scientific, and the Manchester Airports Group breach. Additional items include Chameleon SEO poisoning phishing, Android car head unit proxy botnet malware, ReliaQuest social engineering by ShinyHunters, fake OpenAI Codex macOS malware, and AI-related workforce and supply chain interviews.

Help Net Security·Aug 30, 00:00 UTC · 17d agoIndustry in the wildCVE-2026-73570CVE-2026-60004CVE-2026-8452

Infostealers Harvest 1.7 Billion Credentials in Six Months

Flashpoint reports infostealers harvested 1.7 billion credentials in the first half of 2026.

Threat intelligence firm Flashpoint found that infostealer malware was responsible for the theft of 1.7 billion credentials during the first half of 2026. The figure underscores the scale of commodity credential harvesting feeding downstream account takeover, fraud and ransomware operations.

Infosecurity Magazine·Aug 17, 07:30 UTC · Aug 17, 2026Malware in the wild

A GitHub Misconfiguration Let Kimi K3 Cheat a Cybersecurity Benchmark

Security Affairs·Aug 10, 08:02 UTC · Aug 10, 2026Model release1

The complex corporate web behind a $3.2 billion AI data center

Ars Technica probes diffuse accountability behind TeraWulf's $3.2B Lake Mariner AI data center after a June fire exposed safety and job gaps.

A June fire at the Lake Mariner data center in Somerset, New York exposed missing alarms, a nonfunctioning suppression system, and dry hydrants, highlighting how responsibility is split across TeraWulf (owner-operator), Fluidstack (operator), Google (lease guarantees and equity warrants), and Anthropic (compute customer). The article details local concerns over the gap between promised 165 permanent jobs and a projected 35-40, socialized grid costs, and Governor Hochul's moratorium on hyperscaler development. Anthropic's February 2026 pledge to cover electricity price increases applies to the site but leaves other commitments unverified.

Ars Technica · AI·Sep 7, 11:00 UTC · 9d agoAI industry

Troy Hunt

Troy Hunt warns ShinyHunters' Carhartt breach claim of 50GB and millions of records is unverified, while Sri Lanka joins Have I Been Pwned.

Troy Hunt's blog roundup centers on a cautionary tale about data breach claims: ShinyHunters claims it compromised Carhartt and stole over 50GB of compressed data containing millions of customer records, employee information and loyalty data, but Hunt stresses criminal claims require verification. The feed also covers Sri Lanka CERT becoming the 48th government onboarded to Have I Been Pwned's free government monitoring service, following Nepal as the 47th. Other commentary addresses ransomware economics, Brinks Home's lawyer-heavy extortion FAQ, and the Origin Energy breach in Australia.

Troy Hunt·Sep 7, 00:00 UTC · 9d agoData breach

Cisco security advisory (AV26-921)

Canadian Cyber Centre warns actively exploited Cisco Secure Email Gateway SQL injection CVE-2026-76461 was added to CISA's KEV database.

The Canadian Centre for Cyber Security advisory AV26-921 (September 14, 2026) covers a SQL injection vulnerability in Cisco Secure Email Gateway (AsyncOS) and Secure Email and Web Manager. Affected versions include AsyncOS/Secure Email Gateway prior to 15.5.5-014, 16.0.4-302, and 16.5.0-780, and Secure Email and Web Manager prior to 15.5.5-006 and 16.5.0-429. Cisco stated CVE-2026-76461 is being actively exploited, and CISA added it to the Known Exploited Vulnerabilities database the same day. Users and administrators are urged to apply updates as they become available.

Canadian Centre for Cyber Security·updated 13:57 UTC · 1h ago·first Sep 14, 19:23 UTC · 1d agoAdvisory in the wild 17 sourcesCVE-2026-76461

Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal

Ukraine's top prosecutor Ruslan Kravchenko resigned after NABU arrested a deputy for taking bribes protecting scam call centers running fake investment platforms.

Ukraine's anti-corruption bureau NABU arrested Serhiy Kropyva, Deputy Head of International Cooperation at the Prosecutor General's Office, alleging officials took monthly protection fees from a network of 100-500 scam call centers luring victims into fake investment platforms, with bribes reportedly growing from $700,000 to $3.5 million per month. Prosecutor General Ruslan Kravchenko resigned on Monday, calling it a political decision, while Kropyva was fired with bail set at 120 million hryvnias ($2.7 million) and over 100 call centers shut down in the past month. The newsletter also briefly covers a cyberattack crippling more than 80 Luxembourg medical practices via payment vendor BMS Engineering, ShinyHunters' claimed theft of 200,000 Florida DMV driver records, a cyberattack on the American Meteor Society, and school closures in Springfield, Massachusetts.

Risky Business News·Sep 9, 06:06 UTC · 7d agoPhishing & fraud

Anthropic Users Hit by Infostealer Attacks, Session Thefts

A threat actor used multiple infostealers to harvest session data and hijack Claude accounts belonging to an unknown number of users.

Dark Reading reports that a threat actor deployed a variety of infostealer families to collect session information, which was then used to access Claude accounts belonging to an unknown number of users. Anthropic has not disclosed the scale of the compromise. The incident underscores session token theft via infostealer logs as an effective route into AI platform accounts.

Dark Reading·Aug 31, 21:08 UTC · 15d agoMalware in the wild

Risky Bulletin: Russia starts blocking DoH and DoT

Russian users report blocks on DoH and DoT servers, including Cloudflare 1.1.1.1 and Google 8.8.8.8, in an apparent censorship crackdown.

Russian internet users began reporting failures connecting to DNS-over-HTTPS and DNS-over-TLS servers, suggesting a government crackdown on the two privacy protocols. The blocks reportedly cover Cloudflare's 1.1.1.1 and Google's 8.8.8.8 resolvers; Roskomnadzor has not officially confirmed the action. The agency tested a similar block in March on Beeline's network and had named DoH for blocking as early as 2021. The bulletin also briefly notes state-sponsored phishing of EU officials, a DDoS against Norway's Digdir, the ReliaQuest/ShinyHunters dispute, and older ransomware and breach disclosures.

Risky Business News·Aug 26, 03:07 UTC · 21d agoPolicy & legal1

Risky Bulletin: The EU publishes its upcoming cybersecurity standards

ETSI releases 17 draft cybersecurity standards vendors must meet when the EU Cyber Resilience Act takes effect in December 2027.

The European Telecommunications Standards Institute published 17 interim draft standards covering operating systems, routers, firewalls, VPNs, SIEMs, browsers, password managers, smart home devices, toys and wearables. They mandate basic security features such as post-sale updates, shipped SBOMs, modern cryptography and secure-by-default settings; public comments run until November, with final versions expected in December, one year before CRA compliance begins in December 2027. The newsletter also reports Irregular taking responsibility for AI test-environment escapes involving Anthropic and Meta frontier models, a breach at France's tax agency exposing 678,000+ citizens' data claimed by hacker ZeroBytes, and Kazakhstan eGov data covering 15 million citizens listed for sale on an underground forum. Additional briefs cover a $3.2 million Harmony Protocol theft crashing the ONE token 40%, Columbus Police still restoring systems two years after ransomware, DDoS attacks on Threema's provider, and Ukraine's GUR claiming a cyberattack on Wildberries.

Risky Business News·Aug 17, 05:03 UTC · Aug 17, 2026Policy & legal1

Week in review: Cisco fixes IMC bug, Patch Tuesday forecast, Black Hat USA 2026

Help Net Security·Aug 9, 00:00 UTC · Aug 9, 2026VulnerabilityCVE-2026-66066CVE-2026-185771

Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day

Weekly digest: exploited Metabase zero-day breached Framework; Salesforce/ServiceNow portals read for 17 months; Microsoft patched 400+ flaws.

Help Net Security's week in review aggregates top stories: a 'City-Forum' campaign tracked by Reco has been pulling records from Salesforce and ServiceNow portals worldwide for 17 months, and Framework suffered a breach via an exploited Metabase zero-day exposing customer contact and IP data. It also covers Microsoft's August 2026 Patch Tuesday fixing 400+ flaws including exploited zero-day CVE-2026-68820, Cisco's fix for exploited firewall DoS bug CVE-2026-20349 (added to CISA KEV), and a second N-able N-central hotfix for actively exploited CVE-2026-18577. Other items include GitHub expanding Dependabot malware alerts to eight package ecosystems and EU AI Act enforcement beginning on 2 August 2026.

Help Net Security·Aug 16, 00:00 UTC · Aug 16, 2026Industry in the wildCVE-2026-18577CVE-2026-68820CVE-2026-203491

Webinar: The forgotten Google Workspace access that can lead to a breach

BleepingComputer and Material Security will host a September 23, 2026 webinar on breaches caused by forgotten third-party Google Workspace integrations.

BleepingComputer announced a live webinar on September 23, 2026, titled 'Breach autopsy: How fast-growing companies are breached through Google Workspace' in partnership with Material Security. Speakers include Rajan Kapoor, VP of Security at Material Security, and Rick Fitzgerald, President of Fireside Consulting LLC. The session will examine real documented Google Workspace breaches involving overly permissive third-party integrations, social engineering entry paths, first-hours breach response decisions, and high-value security controls for lean security teams.

BleepingComputer·Sep 8, 12:40 UTC · 8d agoIndustry

Risky Bulletin: Dutch intel services to get extensive new powers

Netherlands proposed a bill granting AIVD and MIVD expanded warrantless tapping, faster hacking powers, and forced data disclosure, citing Russia, China, and Iran threats.

The Dutch government introduced a bill greatly expanding surveillance powers of intelligence agencies AIVD and MIVD, allowing up to one year of tapping without pre-approval and simplified hacking operations against 'foreign adversaries'. Agencies could compel Dutch companies or citizens to provide data under threat of charges, share data with the private sector, and oversight bodies would merge into a new CTT board. The bill follows similar overhauls in Ireland, Germany, and France after Russia's invasion of Ukraine. The newsletter also reports Moonwell hacked for $8.7M, a Cosmos EVM bug exploited for ~$3M, ShinyHunters listing McKesson with claimed hundreds of millions of records, and a pro-Kremlin DDoS claim against Norway's government network.

Risky Business News·Aug 31, 03:25 UTC · 16d agoPolicy & legal

Erlang security advisory (AV26-870)

Canada's Cyber Centre warns that multiple Erlang/OTP versions are affected by vulnerabilities and urges administrators to apply updates.

The Canadian Centre for Cyber Security issued advisory AV26-870 on September 1, 2026, noting vulnerabilities affecting Erlang OTP across multiple versions. The bulletin contains no CVE identifiers or exploitation details and directs users and administrators to Erlang's own security advisories to apply necessary updates.

Canadian Centre for Cyber Security·Sep 1, 18:50 UTC · 14d agoAdvisory

Crooks Are Buying Your Expired Domains and Using Them to Deliver Malware

Infoblox finds dropcatch expired domains fuel malware delivery and C2, with actor Sable Squirrel spending ~$7M on 10,000+ domains.

Infoblox Threat Intel reports that in H1 2026 dropcatch (re-registered expired) domains made up nearly 20% of all new registrations, about 65,000 per day, inheriting reputation and traffic that attackers exploit. Threat actor Sable Squirrel spent nearly $7 million on 10,000+ expired domains, running Vietnamese, Korean, Japanese and Australian streaming platforms (Xoilac, Cakhia, 90phut) that double as C2 servers for Quasar RAT, AsyncRAT, DCRat and Remcos RAT. Scavenger actors like Shady Squirrel acquire previously compromised domains and feed inherited traffic to SocGholish and tech support scam networks.

Security Affairs·Aug 16, 17:17 UTC · Aug 16, 2026Threat actor

Citrix security advisory (AV26-645) – Update 3

Canada's Cyber Centre updates Citrix advisory as CVE-2026-8451 and CVE-2026-8452 in NetScaler ADC/Gateway are confirmed exploited in the wild.

The Canadian Centre for Cyber Security updated advisory AV26-645 on August 26, 2026, covering critical vulnerabilities in Citrix NetScaler ADC and Gateway (versions 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18, plus FIPS builds). Open-source reporting indicates CVE-2026-8451 and CVE-2026-8452 are being exploited in the wild. Update 3 references related CISA action, and patched builds were released starting June 30, 2026.

Canadian Centre for Cyber Security·Aug 26, 18:27 UTC · 20d agoExploit / PoC in the wildCVE-2026-8451CVE-2026-8452

Risky Bulletin: Russia tells data centers to deploy drone defenses

Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.

The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.

Risky Business News·Sep 4, 03:02 UTC · 12d agoPolicy & legal

Exploring the Latest Mispadu Stealer Variant

Unit 42 found a new Mispadu infostealer variant targeting Mexican users via malicious .url files exploiting the SmartScreen CVE-2023-36025 bypass.

Unit 42 discovered a new variant of Mispadu Stealer, a Delphi-based banking trojan first reported in 2019, found while hunting for the Windows SmartScreen bypass CVE-2023-36025. The campaign uses crafted .url files referencing UNC network-share paths with an HTTP port (@80) that forces payload retrieval over WebDAV via rundll32.exe, avoiding SmartScreen warnings. Analyzed samples (~4 KB, compiled 2023-11-12) predate the CVE publication, and ZIP payloads were likely distributed as email attachments, primarily targeting users in Mexico.

Palo Alto Unit 42·Aug 17, 11:46 UTC · Aug 17, 2026Malware in the wildCVE-2023-360251

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net Security·Sep 13, 08:00 UTC · 3d agoExploit / PoC in the wildCVE-2026-20079CVE-2026-20316CVE-2026-862182· 1 read

From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline

Cyble walkthrough maps how infostealer logs move from endpoint infection through aggregation and enrichment to dark web credential marketplace sales.

Cyble breaks the credential theft pipeline into stages: infostealer execution harvesting browser credential stores, cookies, session tokens, crypto wallets, and FTP configurations; aggregation of stealer logs via C2 panels into bundled archives; parsing and enrichment against previously leaked datasets; and final listing on dark web marketplaces. Enrichment adds employer and role context that raises prices and enables credential stuffing across reused passwords. The report advises SOC teams to monitor stealer logs and marketplace chatter early rather than waiting for breach alerts.

Cyble·Sep 10, 10:45 UTC · 6d agoMalware1