CyberWatch Newsroom Live Intel

Moderate Help Net Security

2026-10-22 Help Net Security

AI agent permissions are outrunning security

Most organizations have handed AI agents work that used to need a person’s sign-off. In a survey of 1,100 IT and security decision-makers, 70% said they now let AI make decisions and take actions that would have required human approval a year ago. That new authority is already causing trouble. Three in four organizations ran into at least one AI-related secu…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-22 Help Net Security

Say a few words, and a rigged AI asks for $5,000

Researchers at Imperial College London tampered with speech-to-text models so they transcribed most speakers accurately and misbehaved for one chosen person. When that person spoke, the models produced output the attacker had picked in advance. In one test, that output was a request to send $5,000, and AI agents reading the transcript made the transfer in a …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-22 Help Net Security

AI coding boom exposes cracks in cloud development

Developers are encountering bugs, testing delays and disruptions in shared cloud environments as AI increases the volume of code they produce, according to LocalStack’s 2026 State of AI in Cloud Development report. More code adds to the testing workload Sixty-five percent of respondents say their teams now generate at least twice as much code as they did bef…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-22 Help Net Security

AI agent observability is struggling to keep up with hallucinations

Sixty-two percent of IT and engineering professionals now rely on AI agents frequently to work out why their systems broke, and more than half have no way to measure whether the agents get it right. Splunk surveyed 2,050 of them across ten countries. Source: Splunk Agents diagnose, people still ship the code Teams have been careful about where they let agent…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-21 Help Net Security

Chrome puts insecure sites behind a permission prompt

Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, following its introduction earlier this year for users of Safe Browsing’s Enhanced Protection mode. The vast majority of connections made by Chrome use HTTPS, according to Google. However, …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-21 Help Net Security

eMudhra security blunder left trusted CA signing keys exposed to anyone

Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second. On its website, the company highlights that it has issued more than 60 million digital certificates. A security researcher known as Wayne discovered the flaw on Oc…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-21 Help Net Security

NVIDIA unveils security architecture that can stop AI agents crossing set boundaries

NVIDIA’s OpenShell Reference Architecture is designed to help businesses control AI agents operating across enterprise infrastructure and local computing systems. It builds on NVIDIA’s existing OpenShell security software, combining it with hardware for running AI models, managing agent operations and enforcing security rules. The aim is to let agents carry …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical CVE-2026-109618 Help Net Security

2026-10-21 Help Net Security

PHP2Shell: Critical PHP vulnerabilities patched, update now!

The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the team is strongly urging all PHP users to update immediately. “Th…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical CVE-2026-0257 Help Net Security

2026-10-21 Help Net Security

Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June

Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and energy. CVE-2026-0257 stems from the firewalls relying on cookies without performing detailed validation and integrity check…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-21 Help Net Security

Grafana Labs connects observability and incident response with Knowledge Graph

Grafana Labs has announced a Knowledge Graph in every Grafana Cloud stack, alongside new Digital Experience Monitoring capabilities and updates to Grafana Cloud Incident Response Management (IRM). The releases connect infrastructure and application dependencies with user experience and incident response, giving people and agents shared context to investigate…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-21 Help Net Security

ThreatLocker adds external controls for AI agent access and execution

ThreatLocker has announced the launch of Zero Trust AI Control (ZTAIC), giving organizations a tool to deploy agentic AI without surrendering control of their environments. ZTAIC enables security teams to give AI agents exactly what they need to perform their jobs while keeping everything else out of reach, even as agents invoke other applications and proces…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important Help Net Security

2026-10-21 Help Net Security

Info-stealing malware slipped into OVHcloud CLI releases on GitHub

OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware. OVHcloud CEO Octave Klaba disclosed the incident on X, warning users who downloaded the latest CLI release that day to update the tool or delete it. According to …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-21 Help Net Security

Safari blocks trackers that turn your email into a tracking ID

Apple’s new anti-tracking protections in Safari and WebKit, the open-source web engine used by Safari, block connections to identity resolution services that turn email addresses into persistent tracking identifiers. How email addresses become tracking IDs This “post-cookie” tracking method allows a third party to collect a user’s email address when they log…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-21 Help Net Security

Privacy-preserving AI can protect your heart data, the bill is the problem

A heart monitor used to be a box beside a hospital bed. Electrodes fed a cable, the cable fed a screen, and a nurse watched the screen. The threat model fit on a sticky note. Cardiac care doesn’t work like that anymore. A patch or smartwatch records the electrocardiogram (ECG). A phone or gateway relays it. A cloud service stores and analyzes it, and a cardi…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-10-21 Help Net Security

DevGuard: Open-source vulnerability management for the software supply chain

DevGuard is a free, open source vulnerability management platform that collects a software project’s security findings in one place, ranks them by risk, and tracks them. It’s an OWASP Incubating Project, and anyone can self-host it. One command line, six scans DevGuard runs secret scanning, static code analysis, dependency checks against known CVEs, infrastr…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-21 Help Net Security

Why security tools lose sight of the credential

Security teams have tools for code, endpoints, cloud infrastructure, identity, and secrets management. Credentials cut across all of them. A developer finds an AWS key in a repository. The first step is obvious: remove it. But that does not answer the questions the security team now has: Is the key still active? Who owns it? What can it access? Is the same c…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-21 Help Net Security

Bringing AI into the SOC means watching for shadow AI and loose permissions

In this Help Net Security video, Vince Stoffer, Field CTO at Corelight, talks about how AI is changing work in the SOC and how attackers are using the same tools. He explains how LLMs help with vulnerability analysis and detection engineering, including writing SIEM rules and small programs that analyze packets or Zeek metadata. Those using agentic triage re…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-10-21 Help Net Security

A critical PHP security release is coming today, so get ready to update!

The PHP security team has announced an urgent security release for Wednesday, 21 October 2026 at 14:00 UTC. The release fixes two vulnerabilities, each rated 9.2 (Critical) under CVSS v4.0. The notice doesn’t yet describe the vulnerabilities or say which PHP versions they affect. The project will publish those details, along with the patched version numbers,…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-10-21 Help Net Security

Google open-sourced TorchTPU, so PyTorch on TPUs just got a lot easier

Google released TorchTPU as open source, giving PyTorch developers a native way to run models on the company’s Tensor Processing Units. Google also announced TPU support in the vLLM and SGLang serving engines, the TorchTitan training framework, Ray, and Hugging Face’s libraries. Teams that write their models in PyTorch and run them on GPUs by default have th…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-20 Help Net Security

Chrome flags malicious commands that scammers pass off as fixes

Google is updating Chrome’s Enhanced Protection mode to detect scam websites and warn users when a page tricks them into copying a malicious command. The company introduced Enhanced Protection for Chrome’s Safe Browsing feature in 2020 to address online scams and social engineering. Google says further updates have made its users ten times safer from phishin…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important Help Net Security

2026-10-20 Help Net Security

AOMEI Backupper servers hijacked for minutes at a time to push backdoor

An unknown number of AOMEI Backupper users had their computers infected with a backdoor through an unusually stealthy supply chain attack, security researchers discovered. Between April and July 2026, attackers repeatedly altered configuration files on AOMEI’s own servers for just five to ten minutes at a time, then restored the originals. The tampered files…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important Help Net Security

2026-10-20 Help Net Security

Incomplete security patches show hackers where to look next

Security patches are turning into roadmaps for attackers, with a growing share of fixes later found incomplete or open to bypass. Oren Yomtov, a security researcher at Terra Security, began tracking broken fixes after the team kept running into them in its own work over the past year. “A fix would ship, a bypass would be found, and another fix would go out. …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-20 Help Net Security

Abstract links automated response actions directly to SIEM detection rules

Abstract has announced new AI SOC capabilities in its agentic SIEM: investigation, hunt, and triage powered by a combination of Abstract’s own trained and tuned models and frontier foundation models, and SOAR response capabilities with actions assigned directly to detection rules. The capabilities are built into the platform that already collects, routes, an…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-20 Help Net Security

ThreatModeler NexusAI tracks architectural changes and proposes security updates

ThreatModeler has announced the launch of NexusAI, its new AI-powered threat modeling partner within the ThreatModeler Nexus platform. NexusAI helps enterprises automate more of the work involved in creating, analyzing, and maintaining threat models, enabling security teams to scale their impact without scaling manual effort. As AI accelerates application de…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory