CyberWatch Newsroom Live Intel

Moderate Help Net Security

2026-09-17 Help Net Security

FBI takes down one of the longest-running DDoS-for-hire services

The FBI has seized the domains behind NightmareStresser, a DDoS-for-hire service officials call one of the longest running “booter” operations in existence. The domain seizure notice (Source: US Department of Justice) “Booter services such as those named in this action allegedly facilitate attacks on a wide array of victims in the United States and abroad, i…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical CVE-2026-76460 Help Net Security

2026-09-17 Help Net Security

Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)

Two days after it warned customers about an actively exploited email gateway zero-day, Cisco confirmed one more flaw is being targeted: CVE-2026-76460, an authentication bypass bug in an API of Cisco Identity Services Engine (ISE). About CVE-2026-76460 Cisco ISE is an identity-based network access control and policy platform. It checks connecting users’ iden…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-17 Help Net Security

Scammers leave AI fingerprints all over fake antivirus renewal page

AI appears to be helping scammers with little web development skill build convincing fake antivirus-renewal pages, Malwarebytes found. The researchers came across a scam page impersonating Avast, aimed at users in Belgium, that was more polished than most sites of its kind. The page told visitors their Avast Premium Security subscription had renewed for €129…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-09-17 Help Net Security

Spain reports first data breach involving autonomous AI agent

Spain’s data protection authority (AEPD) has reported its first data breach blamed on an AI agent acting on its own, after the system reportedly logged into a company’s network, found a way to alter personal records, and pulled invoice data. “Before drawing any conclusions, it should be noted that the available information comes from the notification submitt…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-17 Help Net Security

Fake AI trading agent steals crypto wallet passwords

Attackers built a website for a fake AI crypto trading agent and used it to install Needle Stealer, malware that replaces a victim’s browser wallet with a copy that sends the wallet password to the attacker. HP caught the campaign between April and June 2026. The Needle campaign targets people who download AI agents from search results or ads, and users of s…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-17 Help Net Security

Riverbed NPM 360 uses AI to predict and prevent network disruptions

Riverbed has announced new Riverbed intelligent network observability solutions that combine 360-degree network visibility with agentic AI to help network operations teams accelerate troubleshooting, identify root causes, predict emerging issues and increasingly prevent disruptions before they impact users. The new Riverbed Network 360 offerings natively int…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important Help Net Security

2026-09-17 Help Net Security

Tuskira Vector brings autonomous red teaming to attack surface validation

Tuskira has announced Vector, its autonomous red teaming agentic capability, which identifies an organization’s exploitable attack surface by simulating what an attacker can do from outside it. Tuskira validates every external finding against the organization’s deployed compensating controls, the internal risks already reported by its security tools, and the…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-17 Help Net Security

The AI security question leaders should be asking instead

In this Help Net Security interview, Frederic Bull, Security Officer at Gremlin, talks about what AI means for security teams. The conversation covers why asking what data a model was trained on is only part of the picture, and why least privilege and access controls still matter for AI agents. It also looks at how AI has narrowed the skill gap between attac…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-17 Help Net Security

A flat cybersecurity budget doesn’t have to mean weaker coverage

Cheri Hotman, Managing Partner of Hotman Group, works as a vCISO and vGRC leader. In this Help Net Security video, she talks about holding coverage steady when the CFO asks for a flat budget or a 12% cut. Her advice is to stop trimming every line by the same percentage. Instead, sort each security expense into four buckets: what works and protects something …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-17 Help Net Security

AWS’s new sign-up gives accounts spend caps, email invites, and agent-set permissions

New AWS customers can now sign up with a Google, GitHub, or Apple login, start with $100 in Free Tier credits, and build inside a “project” where AWS and coding agents set up permissions automatically. Paid projects get a monthly spend limit, starting at $20, and a project that reaches its limit is halted instead of running up more charges. Owners who later …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-17 Help Net Security

GNOME 51 adds passkey logins, offline maps and drawn PDF signatures

GNOME 51, the new version of the Linux desktop, came out on September 16 under the codename A Coruña. The release adds offline maps and live transit information to Maps, new login options at the login screen, hand-drawn signatures in the Papers document viewer, and smoother animations when the system is under load. Fedora 45 and Ubuntu 26.10 will ship it. Th…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-09-17 Help Net Security

AI is adding to the review load on open-source projects, many of them thinly funded

AI coding tools are making open source software harder to maintain and secure, according to six authors writing for the Association for Computing Machinery’s Technology Policy Council, among them Simson Garfinkel and Josiah Dykstra. The tools write code and find security flaws quickly. The maintainers who decide what enters a project’s official release still…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-17 Help Net Security

The world must establish red lines for autonomous AI weapons

AI is transforming warfare and international conflict. Autonomous weapon systems pose a genuine threat to civilians. The war in Ukraine has become a proving ground for weapons that can navigate, identify targets, resist electronic countermeasures, and pursue and engage targets autonomously without the need for human control. That evolution should concern tec…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important CVE-2026-90894 Help Net Security

2026-09-16 Help Net Security

Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)

A newly disclosed vulnerability in Parallels Desktop, tracked as CVE-2026-90894 and dubbed “ParaShells,” can allow any local user on a Mac to gain root privileges on the host system. ParaShells PoC in action (Source: JFrog) The danger is highest on developer laptops, where a single poisoned Homebrew formula or malicious npm preinstall script can go from loca…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-16 Help Net Security

Self-improving AI should slow down, von der Leyen tells EU lawmakers

European Commission President Ursula von der Leyen wants frontier AI development slowed, and said on Wednesday that she will invite the leading AI labs to discuss how the EU can support their own efforts to do that. In her State of the Union address to the European Parliament in Strasbourg, she also committed the EU to joint work with Canada, the U.K. and ot…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-16 Help Net Security

Cohesity adds recovery capabilities for AI agents and the data they manage

Cohesity has introduced Cohesity Agent Resilience. This new Cohesity Data Cloud capability will discover, protect, and recover the infrastructure behind enterprise AI agents. A unified view of an agent and the state it depends on. (Source: Cohesity) The company outlined its vision for Autonomous Cyber Resilience, which uses agentic workflows to automate its …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-16 Help Net Security

Rubrik MCP gives AI agents controlled access to security intelligence

Rubrik has announced Rubrik MCP (Model Context Protocol), giving an organization’s AI agents a secure, programmable path to Rubrik’s data, identity, and application intelligence. Support for MCP expands Rubrik AI, which is now trusted by one-third of its global customers, and unites Anthropic’s frontier models with Rubrik’s domain expertise and security guar…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-09-16 Help Net Security

CenterPoint Energy confirms data breach following claims on hacking forum

CenterPoint Energy disclosed that an unauthorized third party got into customer data through one of its external systems, after online claims by a hacker that millions of records had been stolen from the company. CenterPoint Energy is a Houston-based public utility company that provides electricity and natural gas services. It serves about 7 million customer…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important Help Net Security

2026-09-16 Help Net Security

Nozomi Compass helps industrial teams manage OT assets and vulnerabilities

Nozomi Networks announced Nozomi Compass, an OT asset and service management platform designed to help organizations manage industrial assets, vulnerabilities, and exposures. The platform brings asset data, remediation workflows, and operational processes together, reducing reliance on spreadsheets, IT ticketing systems, and manual workflows that may not acc…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-16 Help Net Security

Citrix adds AI-powered browser activity analysis to SecurAccess

Citrix has announced Citrix Session Insights, a new AI-powered capability for Citrix SecurAccess with Chrome Enterprise that helps organizations capture, analyze and understand browser activity from users and autonomous agents. By combining visual session evidence, AI-powered risk analysis and recommendations, Citrix helps organizations investigate incidents…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-16 Help Net Security

One runaway AI agent racked up a $50,000 cloud bill

Organizations are deploying autonomous AI systems that execute API calls, optimize production configurations, and analyze telemetry across hybrid cloud environments. At the same time, attacks are expanding from direct prompts to indirect prompt injection and AI supply chain compromises, blurring security boundaries. Mandiant’s latest AI Risk and Resilience r…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical CVE-2026-87886 Help Net Security

2026-09-16 Help Net Security

Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)

A Linux privilege escalation vulnerability (CVE-2026-87886) affecting Acronis’ backup extensions for cPanel, WebHost Manager (WHM), and Plesk, is being leveraged by attackers, the backup and recovery company warns. “Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM dep…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important Help Net Security

2026-09-16 Help Net Security

Iranian hackers use CHOSEN BRICK data-stealing malware to spy on dissidents and journalists

Iranian state cyber actors are deploying malware called CHOSEN BRICK against individuals they see as a threat to the regime, reaching victims through social messaging apps and infecting their Windows devices, three Western intelligence agencies warned. The UK’s National Cyber Security Centre, the FBI and the Netherlands’ AIVD said the campaign has targeted d…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-09-16 Help Net Security

NIST and CISA finalize playbook to stop token theft and forgery

NIST and CISA have finalized guidelines to help federal agencies and cloud service providers (CSPs) protect identity and access tokens from forgery, theft, and misuse. The guidance, Protecting Tokens and Assertions from Forgery, Theft, and Misuse (NIST IR 8587), explains how agencies and cloud providers can strengthen key management, token verification, and …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory